pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x KnowledgeSharePoint

How to read the sensitivity label and classification of a SharePoint site

What does this site record about the kind of content it holds?

By João Livio·pH7x Knowledge

30-second answer

powershell
$site = Get-PnPSite -Includes SensitivityLabelId, SensitivityLabelInfo, Classification
$site.SensitivityLabelInfo.Id            # the label GUID, empty when none
$site.SensitivityLabelInfo.DisplayName   # the label name, when resolvable
$site.Classification                     # the older classification string

What this proves

Whether a sensitivity label is applied to the site container, what it is called when the name resolves, and whether the older classification string is set. Together these are everything the site itself records about the kind of content it holds.

What it does not prove

  • An empty value is an answer, not a gap. A property that loaded and came back empty is SharePoint saying there is no label. Only a property that could not be read is unknown. Collapsing the two turns "none of these sites is classified" into "nothing here is known", and those belong in different columns of any report.
  • Nothing about the documents inside. Container labels do not flow to items; a labelled site can hold entirely unlabelled files.
  • That the label enforces anything. A label is configuration; what it does depends on how it was set up in Purview.

PowerShell

powershell
$site = Get-PnPSite -Includes SensitivityLabelId, SensitivityLabelInfo, Classification
[pscustomobject]@{
    LabelApplied  = -not [string]::IsNullOrWhiteSpace("$($site.SensitivityLabelInfo.Id)")
    LabelName     = $site.SensitivityLabelInfo.DisplayName
    Classification = $site.Classification
}

Example output

text
LabelApplied LabelName     Classification
------------ ---------     --------------
        True Confidential

Explanation

The label id lives on the site; the name lives in the compliance centre. A site can carry a label whose definition your identity cannot resolve, and then Id is a GUID with no DisplayName. That site is classified, and no report built from your read can say as what, which is a governance finding of its own rather than a collection error. On a tenant that has never enabled container labels, every site returns empty on all three, which is a true answer about every site and a statement about the tenant.

Production considerations

  • Site read access is enough; no admin-centre connection is needed for the site-side values.
  • SensitivityLabelInfo must be requested with -Includes; unloaded CSOM properties return null rather than failing, which reads exactly like "no label" if you are not careful.
  • The classification string is the older mechanism and still set on sites that predate labels. Treat it as a separate fact, not as a fallback.

References