{
  "id": "CB-M365-DATA-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-006.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DATA-006",
    "title": "Extend sensitivity labels to SharePoint, groups and sites, with default and automatic labelling",
    "finding": {
      "title": "Sensitivity labels are published but not applied to containers, by default or automatically",
      "description": "Labels depend entirely on users remembering to apply them, SharePoint cannot process labelled files, and Teams, groups and sites carry no classification."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "sensitivity-labels",
      "information-protection",
      "purview",
      "sharepoint",
      "groups",
      "auto-labeling"
    ],
    "description": "On top of published labels (CB-M365-DATA-005):\n\n- sensitivity labels are enabled for Office files in SharePoint and OneDrive\n  (`EnableAIPIntegration` = `True`), so that labelled and encrypted files can be searched,\n  co-authored and scanned by DLP;\n- labels are enabled for Microsoft 365 groups, Teams and SharePoint sites (directory setting\n  `EnableMIPLabels` = `True`), and at least one label defines privacy, external sharing and\n  guest access settings for containers;\n- the publishing policy sets a default label for documents and emails, and requires a\n  justification to remove or lower a label;\n- at least one auto-labelling policy (service-side, or client-side in the label) applies a label\n  to content that matches the sensitive information types of CB-M365-DATA-001, and is turned on\n  after simulation.\n",
    "rationale": "Manual labelling alone leaves most content unlabelled. Default labels and automatic labelling\ngive a baseline classification without user effort, container labels carry the classification\nto Teams and sites where data is shared, and SharePoint integration keeps encrypted files usable\nby search, eDiscovery and DLP instead of making them opaque.\n",
    "impact": "Service-side auto-labelling needs Microsoft 365 E5 or E5 Compliance (or the Information\nProtection and Governance add-on). Container labels change the options shown to users when they\ncreate a team or site. Run auto-labelling in simulation and review matches before turning it on.\n",
    "audit": {
      "manual": "1. In SharePoint Online PowerShell (as at least a SharePoint Administrator in read use, or with\n   Global Reader through the SharePoint admin center), run\n   `Get-SPOTenant | Select-Object EnableAIPIntegration` and check it is `True`.\n2. In Microsoft Graph PowerShell (scope `Directory.Read.All`), run\n   `(Get-MgBetaDirectorySetting | Where-Object DisplayName -eq 'Group.Unified').Values` and check\n   that `EnableMIPLabels` is `True`.\n3. In the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader,\n   browse to **Solutions** > **Information Protection** > **Sensitivity labels** and check that at\n   least one label has the **Groups & sites** scope configured.\n4. Open **Publishing policies** and check that a default label is set for documents and emails\n   and that **Users must provide a justification to remove a label or lower its classification**\n   is on. PowerShell: `Get-LabelPolicy | Format-List Name,Settings`.\n5. Browse to **Solutions** > **Information Protection** > **Auto-labeling policies** and check\n   that a policy is **On** (not in simulation). PowerShell:\n   `Get-AutoSensitivityLabelPolicy | Format-List Name,Mode,ApplySensitivityLabel`.\n6. Fail if any of these elements is missing.\n"
    },
    "remediation": {
      "manual": "1. In SharePoint Online PowerShell as a SharePoint Administrator: `Set-SPOTenant\n   -EnableAIPIntegration $true`.\n2. As a Global Administrator, set `EnableMIPLabels` to `True` in the `Group.Unified` directory\n   setting (Graph PowerShell `Update-MgBetaDirectorySetting`), then synchronize labels with\n   `Execute-AzureAdLabelSync` in Security & Compliance PowerShell.\n3. In the Microsoft Purview portal as an Information Protection Admin, edit the labels to add the\n   **Groups & sites** scope with privacy, external user access and sharing settings.\n4. Edit the publishing policy: set a default label for documents and emails and require\n   justification for label removal.\n5. Create an auto-labeling policy for the sensitive information types of CB-M365-DATA-001 on\n   Exchange, SharePoint and OneDrive, run it in simulation, review, then turn it on.\n",
      "rollback": "Set the auto-labelling policy back to simulation, remove the default label from the publishing\npolicy, or set `EnableAIPIntegration` to `False`.\n"
    },
    "references": [
      {
        "title": "Enable sensitivity labels for Office files in SharePoint and OneDrive",
        "url": "https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites",
        "url": "https://learn.microsoft.com/purview/sensitivity-labels-teams-groups-sites",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Apply a sensitivity label to content automatically",
        "url": "https://learn.microsoft.com/purview/apply-sensitivity-label-automatically",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD Blueprint for Secure Cloud",
        "url": "https://blueprint.asd.gov.au/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-16",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "MP-3",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DATA-005",
        "type": "requires"
      },
      {
        "id": "CB-M365-TENANT-007",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}