classification

What it observes

The sensitivity label and classification on a site, and whether they can be resolved to a name.

m365-governance collect classification \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --output ./evidence/classification.json

No profile of its own, and that is a decision

A profile selects rules. The three classification rules are the only ones that read this evidence, so a profile naming them would repeat what the evidence already says. The omission is recorded here so it does not read as an oversight.

An empty label is an observation, not a gap

The first version reported an empty SensitivityLabelId as missing, which says "the collector did not obtain this fact". Run against a tenant, all three sites came back that way and the derived classified fact was false: an answer built out of three admissions of ignorance.

Whichever of the two was right, the pair could not both be. An unlabelled site is a site that is unlabelled, and the engine now says so.

Why resolvability is collected separately

A label identifier that cannot be resolved to a name is a different situation from no label at all: the site is classified and the reader cannot see as what. Reporting both as "unclassified" would merge a configuration state with a visibility problem.