Created by Claude - please verify

Sensitivity labels - labels, label policies and auto-labelling policies from Security & Compliance PowerShell.

Required Microsoft Graph permissions

Exchange.ManageAsApp Purview role for the app: Compliance Administrator (or a view-only compliance role) — application permissions, granted to the app registration with admin consent.

Licence: Microsoft 365 E3 / Business Premium for manual labels; E5 (or E5 Compliance / Information Protection) for auto-labelling.

Endpoints: Connect-IPPSSession (prefix Cc) · Get-Label · Get-LabelPolicy · Get-AutoSensitivityLabelPolicy

Mandatory / default labelling is read from the label policy's advanced settings. Container labels for teams and sites: see Sensitivity Label Coverage of Groups & Sites.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Sensitivity Label & Auto-labelling Policies

Labels only protect what gets labelled. Which labels are actually published to users, is labelling mandatory or at least defaulted, and are auto-labelling policies applying labels - or have they sat in simulation for months?