SCSensitivityLabel¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| Name | Key | String | The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks. | |
| Ensure | Write | String | Specify if this rule should exist or not. | Present, Absent |
| Comment | Write | String | The Comment parameter specifies an optional comment. | |
| AdvancedSettings | Write | MSFT_SCLabelSetting[] | The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting. | |
| DisplayName | Write | String | The DisplayName parameter specifies the display name for the sensitivity label. The display name appears in the Microsoft Office and is used by Outlook users to select the appropriate sensitivity label before they send a message. | |
| LocaleSettings | Write | MSFT_SCLabelLocaleSettings[] | The LocaleSettings parameter specifies one or more localized label name or label Tooltips in different languages. Regions include all region codes supported in Office Client applications. | |
| ParentId | Write | String | The ParentId parameter specifies the parent label that you want this label to be under (a sublabel). You can use any value that uniquely identifies the parent sensitivity label for example name. | |
| Priority | Write | UInt32 | The Priority parameter specifies a priority value for the sensitivity label that determines the order of label processing. A lower integer value indicates a higher priority. | |
| Tooltip | Write | String | The ToolTip parameter specifies the default tooltip and sensitivity label description that's seen by users. It the value contains spaces, enclose the value in quotation marks. | |
| ApplyContentMarkingFooterAlignment | Write | String | The ApplyContentMarkingFooterAlignment parameter specifies the footer alignment. | Left, Center, Right |
| ApplyContentMarkingFooterEnabled | Write | Boolean | The ApplyContentMarkingFooterEnabled parameter specifies whether to enable or disable the sensitivity label. | |
| ApplyContentMarkingFooterFontColor | Write | String | The ApplyContentMarkingFooterFontColor parameter specifies the color of the footer text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000. | |
| ApplyContentMarkingFooterFontSize | Write | SInt32 | The ApplyContentMarkingFooterFontSize parameter specifies the font size (in points) of the footer text. | |
| ApplyContentMarkingFooterMargin | Write | SInt32 | The ApplyContentMarkingFooterMargin parameter specifies the size (in points) of the footer margin. | |
| ApplyContentMarkingFooterText | Write | String | The ApplyContentMarkingFooterText parameter specifies the footer text. If the value contains spaces, enclose the value in quotation marks. | |
| ApplyContentMarkingHeaderAlignment | Write | String | The ApplyContentMarkingHeaderAlignment parameter specifies the header alignment. | Left, Center, Right |
| ApplyContentMarkingHeaderEnabled | Write | Boolean | The ApplyContentMarkingHeaderEnabled parameter enables or disables the Apply Content Marking Header action for the label. | |
| ApplyContentMarkingHeaderFontColor | Write | String | The ApplyContentMarkingHeaderFontColor parameter specifies the color of the header text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000. | |
| ApplyContentMarkingHeaderFontSize | Write | SInt32 | The ApplyContentMarkingHeaderFontSize parameter specifies the font size (in points) of the header text. | |
| ApplyContentMarkingHeaderMargin | Write | SInt32 | The ApplyContentMarkingHeaderMargin parameter specifies the size (in points) of the header margin. | |
| ApplyContentMarkingHeaderText | Write | String | The ApplyContentMarkingHeaderText parameter specifies the header text. If the value contains spaces, enclose the value in quotation marks. | |
| ApplyWaterMarkingEnabled | Write | Boolean | The ApplyWaterMarkingEnabled parameter enables or disables the Apply Watermarking Header action for the label. | |
| ApplyWaterMarkingFontColor | Write | String | The ApplyWaterMarkingFontColor parameter specifies the color of the watermark text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. | |
| ApplyWaterMarkingFontSize | Write | SInt32 | The ApplyWaterMarkingFontSize parameter specifies the font size (in points) of the watermark text. | |
| ApplyWaterMarkingLayout | Write | String | The ApplyWaterMarkingAlignment parameter specifies the watermark alignment. | Horizontal, Diagonal |
| ApplyWaterMarkingText | Write | String | The ApplyWaterMarkingText parameter specifies the watermark text. If the value contains spaces, enclose the value in quotation marks. | |
| ContentType | Write | String[] | The ContentType parameter specifies where the sensitivity label can be applied. | File, Email, Site, UnifiedGroup, PurviewAssets, Teamwork, SchematizedData |
| EncryptionContentExpiredOnDateInDaysOrNever | Write | String | The EncryptionContentExpiredOnDateInDaysOrNever parameter specifies when the encrypted content expires. Valid values are integer or never. | |
| EncryptionDoNotForward | Write | Boolean | The EncryptionDoNotForward parameter specifies whether the Do Not Forward template is applied. | |
| EncryptionEncryptOnly | Write | Boolean | The EncryptionEncryptOnly parameter specifies whether the encrypt-only template is applied. | |
| EncryptionEnabled | Write | Boolean | The EncryptionEnabled parameter specifies whether encryption in enabled. | |
| EncryptionOfflineAccessDays | Write | SInt32 | The EncryptionOfflineAccessDays parameter specifies the number of days that offline access is allowed. | |
| EncryptionPromptUser | Write | Boolean | The EncryptionPromptUser parameter specifies whether to set the label with user defined permission in Word, Excel, and PowerPoint. | |
| EncryptionProtectionType | Write | String | The EncryptionProtectionType parameter specifies the protection type for encryption. | Template, RemoveProtection, UserDefined |
| EncryptionRightsDefinitions | Write | String | The EncryptionRightsDefinitions parameter specifies the rights users have when accessing protected. This parameter uses the syntax Identity1:Rights1,Rights2;Identity2:Rights3,Rights4. For example, john@contoso.com:VIEW,EDIT;microsoft.com:VIEW. | |
| EncryptionRightsUrl | Write | String | The EncryptionRightsUrl parameter specifies the URL for hold your own key (HYOK) protection. | |
| SiteAndGroupProtectionAllowAccessToGuestUsers | Write | Boolean | The SiteAndGroupProtectionAllowAccessToGuestUsers parameter enables or disables access to guest users. | |
| SiteAndGroupProtectionAllowEmailFromGuestUsers | Write | Boolean | The SiteAndGroupProtectionAllowEmailFromGuestUsers parameter enables or disables email from guest users. | |
| SiteAndGroupProtectionAllowFullAccess | Write | Boolean | The SiteAndGroupProtectionAllowFullAccess parameter enables or disables full access. | |
| SiteAndGroupProtectionAllowLimitedAccess | Write | Boolean | The SiteAndGroupProtectionAllowLimitedAccess parameter enables or disables limited access. | |
| SiteAndGroupProtectionBlockAccess | Write | Boolean | The SiteAndGroupProtectionBlockAccess parameter blocks access. | |
| SiteAndGroupProtectionEnabled | Write | Boolean | The SiteAndGroupProtectionEnabled parameter enables or disables the Site and Group Protection action for the labels. | |
| SiteAndGroupProtectionPrivacy | Write | String | The SiteAndGroupProtectionPrivacy parameter specifies the privacy level for the label. | Public, Private, Unspecified |
| SiteAndGroupExternalSharingControlType | Write | String | The SiteAndGroupExternalSharingControlType parameter specifies the external user sharing setting for the label. | ExternalUserAndGuestSharing, ExternalUserSharingOnly, ExistingExternalUserSharingOnly, Disabled |
| AutoLabelingSettings | Write | MSFT_SCSLAutoLabelingSettings | The AutoLabelingSettings parameter specifies the conditions for label to be automatically applied to files and emails. | |
| Credential | Write | PSCredential | Credentials of the Exchange Global Admin | |
| ApplicationId | Write | String | Id of the Azure Active Directory application to authenticate with. | |
| TenantId | Write | String | Id of the Azure Active Directory tenant used for authentication. | |
| CertificateThumbprint | Write | String | Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication. | |
| CertificatePassword | Write | PSCredential | Username can be made up to anything but password will be used for CertificatePassword | |
| CertificatePath | Write | String | Path to certificate used in service principal usually a PFX file. | |
| ManagedIdentity | Write | Boolean | Managed ID being used for authentication. | |
| AccessTokens | Write | String[] | Access token used for authentication. |
Embedded Instances¶
MSFT_SCLabelSetting¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| Key | Required | String | Advanced settings key. | |
| Value | Write | String[] | Advanced settings value. |
MSFT_SCLabelLocaleSettings¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| LocaleKey | Required | String | Name of the Local key. | |
| LabelSettings | Write | MSFT_SCLabelSetting[] | The locale settings display names. |
MSFT_SCSLAutoLabelingSettings¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| Groups | Required | MSFT_SCSLSensitiveInformationGroup[] | Groups of sensitive information types. | |
| Operator | Required | String | How to process the various groups | And, Or |
| PolicyTip | Write | String | Display this message to users when the label is applied | |
| AutoApplyType | Required | String | Specifies what to do when content matches the conditions | Automatic, Recommend |
MSFT_SCSLSensitiveInformationGroup¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| SensitiveInformationType | Write | MSFT_SCSLSensitiveInformationType[] | Sensitive Information Content Types | |
| TrainableClassifier | Write | MSFT_SCSLTrainableClassifiers[] | Trainable Classifiers | |
| Name | Required | String | Name of the group | |
| Operator | Required | String | How to process the Sensitive Information Types and Trainable Classifiers | And, Or |
MSFT_SCSLSensitiveInformationType¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| name | Required | String | Name of the Sensitive Information Type | |
| confidencelevel | Write | String | Confidence level value for the Sensitive Information | Low, Medium, High |
| classifiertype | Write | String | Type of Classifier value for the Sensitive Information | |
| mincount | Write | String | Minimum Count value for the Sensitive Information | |
| maxcount | Write | String | Maximum Count value for the Sensitive Information |
MSFT_SCSLTrainableClassifiers¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| name | Required | String | Name of the Trainable Classifier | |
| id | Write | String | Id of the Trainable Classifier |
Description¶
This resource configures Sensitivity labels in Purview.
Permissions¶
Purview¶
To authenticate with Microsoft Purview, this resource requires the following permissions:
Roles¶
- Read
- Sensitivity Label Reader
- Update
- Sensitivity Label Administrator
Role Groups¶
- Read
- Security Reader
- Update
- Compliance Data Administrator
Office 365 Exchange Online¶
To authenticate with the Office 365 Exchange Online API, this resource requires the following permissions:
Delegated permissions¶
- Read
-
None
-
Update
- None
Application permissions¶
- Read
-
Exchange.ManageAsApp
-
Update
- Exchange.ManageAsApp
Examples¶
Example 1¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param
(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
Node localhost
{
SCSensitivityLabel 'SCSensitivityLabel-Example'
{
Name = "Confidential"
Comment = "Applied to internal business documents"
ToolTip = "Use for information that must stay inside the company"
DisplayName = "Confidential"
Priority = 3
ContentType = @("File", "Email", "Site", "UnifiedGroup")
ApplyContentMarkingFooterAlignment = "Center"
ApplyContentMarkingFooterEnabled = $true
ApplyContentMarkingFooterFontColor = "#FF0000"
ApplyContentMarkingFooterFontSize = 10
ApplyContentMarkingFooterMargin = 5
ApplyContentMarkingFooterText = "Contoso Confidential"
ApplyContentMarkingHeaderAlignment = "Center"
ApplyContentMarkingHeaderEnabled = $true
ApplyContentMarkingHeaderFontColor = "#FF0000"
ApplyContentMarkingHeaderFontSize = 10
ApplyContentMarkingHeaderMargin = 5
ApplyContentMarkingHeaderText = "Confidential - Do Not Distribute"
ApplyWaterMarkingEnabled = $true
ApplyWaterMarkingFontColor = "#FF0000"
ApplyWaterMarkingFontSize = 10
ApplyWaterMarkingLayout = "Diagonal"
ApplyWaterMarkingText = "Confidential"
EncryptionEnabled = $true
EncryptionProtectionType = "Template"
EncryptionRightsDefinitions = "contoso.com:VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD"
EncryptionOfflineAccessDays = 30
EncryptionContentExpiredOnDateInDaysOrNever = "Never"
SiteAndGroupProtectionAllowAccessToGuestUsers = $true
SiteAndGroupProtectionAllowEmailFromGuestUsers = $true
SiteAndGroupProtectionAllowFullAccess = $true
SiteAndGroupProtectionAllowLimitedAccess = $false
SiteAndGroupProtectionBlockAccess = $false
SiteAndGroupProtectionEnabled = $true
SiteAndGroupProtectionPrivacy = "Private"
SiteAndGroupExternalSharingControlType = "ExternalUserSharingOnly"
LocaleSettings = @(
MSFT_SCLabelLocaleSettings{
LocaleKey = "DisplayName"
LabelSettings = @(
MSFT_SCLabelSetting{
Key = "en-us"
Value = "Confidential"
}
MSFT_SCLabelSetting{
Key = "fr-fr"
Value = "Confidentiel"
}
)
}
MSFT_SCLabelLocaleSettings{
LocaleKey = "Tooltip"
LabelSettings = @(
MSFT_SCLabelSetting{
Key = "en-us"
Value = "Use for information that must stay inside the company"
}
MSFT_SCLabelSetting{
Key = "fr-fr"
Value = "A utiliser pour les informations qui doivent rester dans l'entreprise"
}
)
}
)
AdvancedSettings = @(
MSFT_SCLabelSetting{
Key = "color"
Value = "#40e0d0"
}
MSFT_SCLabelSetting{
Key = "DefaultSharingScope"
Value = "SpecificPeople"
}
)
AutoLabelingSettings = MSFT_SCSLAutoLabelingSettings{
Operator = "And"
AutoApplyType = "Recommend"
PolicyTip = "This document contains financial data and will be labelled Confidential."
Groups = @(
MSFT_SCSLSensitiveInformationGroup{
Name = "Financial account details"
Operator = "Or"
SensitiveInformationType = @(
MSFT_SCSLSensitiveInformationType{
name = "ABA Routing Number"
confidencelevel = "High"
maxcount = "-1"
mincount = "1"
}
)
TrainableClassifier = @(
MSFT_SCSLTrainableClassifiers{
name = "Finance"
}
)
}
MSFT_SCSLSensitiveInformationGroup{
Name = "Customer identity details"
Operator = "And"
SensitiveInformationType = @(
MSFT_SCSLSensitiveInformationType{
name = "All Full Names"
confidencelevel = "High"
maxcount = "100"
mincount = "10"
}
)
TrainableClassifier = @(
MSFT_SCSLTrainableClassifiers{
name = "Legal Affairs"
}
)
}
)
}
ParentId = "Personal"
Ensure = "Present"
ApplicationId = $ApplicationId
TenantId = $TenantId
CertificateThumbprint = $CertificateThumbprint
}
}
}
Example 2¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param
(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
Node localhost
{
SCSensitivityLabel 'SCSensitivityLabel-Example'
{
Name = "Confidential"
Comment = "Applied to internal business documents and customer records" # Updated Property
ToolTip = "Use for information that must stay inside the company"
DisplayName = "Confidential"
Priority = 3
ContentType = @("File", "Email", "Site", "UnifiedGroup")
ApplyContentMarkingFooterAlignment = "Center"
ApplyContentMarkingFooterEnabled = $true
ApplyContentMarkingFooterFontColor = "#FF0000"
ApplyContentMarkingFooterFontSize = 10
ApplyContentMarkingFooterMargin = 5
ApplyContentMarkingFooterText = "Contoso Confidential"
ApplyContentMarkingHeaderAlignment = "Center"
ApplyContentMarkingHeaderEnabled = $true
ApplyContentMarkingHeaderFontColor = "#FF0000"
ApplyContentMarkingHeaderFontSize = 10
ApplyContentMarkingHeaderMargin = 5
ApplyContentMarkingHeaderText = "Confidential - Do Not Distribute"
ApplyWaterMarkingEnabled = $true
ApplyWaterMarkingFontColor = "#FF0000"
ApplyWaterMarkingFontSize = 10
ApplyWaterMarkingLayout = "Diagonal"
ApplyWaterMarkingText = "Confidential"
EncryptionEnabled = $true
EncryptionProtectionType = "Template"
EncryptionRightsDefinitions = "contoso.com:VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD"
EncryptionOfflineAccessDays = 30
EncryptionContentExpiredOnDateInDaysOrNever = "Never"
SiteAndGroupProtectionAllowAccessToGuestUsers = $true
SiteAndGroupProtectionAllowEmailFromGuestUsers = $true
SiteAndGroupProtectionAllowFullAccess = $true
SiteAndGroupProtectionAllowLimitedAccess = $false
SiteAndGroupProtectionBlockAccess = $false
SiteAndGroupProtectionEnabled = $true
SiteAndGroupProtectionPrivacy = "Private"
SiteAndGroupExternalSharingControlType = "ExternalUserSharingOnly"
LocaleSettings = @(
MSFT_SCLabelLocaleSettings{
LocaleKey = "DisplayName"
LabelSettings = @(
MSFT_SCLabelSetting{
Key = "en-us"
Value = "Confidential"
}
MSFT_SCLabelSetting{
Key = "fr-fr"
Value = "Confidentiel"
}
)
}
MSFT_SCLabelLocaleSettings{
LocaleKey = "Tooltip"
LabelSettings = @(
MSFT_SCLabelSetting{
Key = "en-us"
Value = "Use for information that must stay inside the company"
}
MSFT_SCLabelSetting{
Key = "fr-fr"
Value = "A utiliser pour les informations qui doivent rester dans l'entreprise"
}
)
}
)
AdvancedSettings = @(
MSFT_SCLabelSetting{
Key = "color"
Value = "#40e0d0"
}
MSFT_SCLabelSetting{
Key = "DefaultSharingScope"
Value = "SpecificPeople"
}
)
AutoLabelingSettings = MSFT_SCSLAutoLabelingSettings{
Operator = "And"
AutoApplyType = "Recommend"
PolicyTip = "This document contains financial data and will be labelled Confidential."
Groups = @(
MSFT_SCSLSensitiveInformationGroup{
Name = "Financial account details"
Operator = "Or"
SensitiveInformationType = @(
MSFT_SCSLSensitiveInformationType{
name = "ABA Routing Number"
confidencelevel = "High"
maxcount = "-1"
mincount = "1"
}
)
TrainableClassifier = @(
MSFT_SCSLTrainableClassifiers{
name = "Finance"
}
)
}
MSFT_SCSLSensitiveInformationGroup{
Name = "Customer identity details"
Operator = "And"
SensitiveInformationType = @(
MSFT_SCSLSensitiveInformationType{
name = "All Full Names"
confidencelevel = "High"
maxcount = "100"
mincount = "10"
}
)
TrainableClassifier = @(
MSFT_SCSLTrainableClassifiers{
name = "Legal Affairs"
}
)
}
)
}
ParentId = "Personal"
Ensure = "Present"
ApplicationId = $ApplicationId
TenantId = $TenantId
CertificateThumbprint = $CertificateThumbprint
}
}
}