Created by Claude - please verify

Container labels - assignedLabels from Microsoft Graph, site labels from Get-PnPTenantSite; group-connected sites inherit the group's label.

Required Microsoft Graph permissions

Group.Read.All SharePoint: Sites.FullControl.All (application, certificate) — application permissions, granted to the app registration with admin consent.

Licence: Microsoft 365 E3 / Business Premium (or Azure Information Protection P1) for container labels; labels must be enabled for groups (EnableMIPLabels).

Endpoints: GET /v1.0/groups?$filter=groupTypes/any(c:c eq 'Unified')&$select=assignedLabels · Get-PnPTenantSite -Detailed (SensitivityLabel)

If no container has a label, labels for groups and sites are probably not enabled in the tenant - see the group settings report (EnableMIPLabels). A site label that shows as an id is not used on any group, so its name is unknown here.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Sensitivity Label Coverage of Groups & Sites

Container sensitivity labels decide privacy, guest access and unmanaged-device access for a team, group or site - and they are what Copilot and DLP policies key on. Every container without a label is governed by defaults alone. Public groups without a label are listed first.