What it decides

Rule
SPO-CLASS-001
Applies to
sharepoint · site
Default severity
low
Basis
documented-guidance

On what authority

Microsoft's published deployment model names the unlabelled site as the thing to go and find. It describes stopping "the proliferation of unlabeled sites", and lists identifying the remaining ones and applying a container label to them as the work of the final step. That is guidance and not a requirement, and the distinction is the whole reason for the type. Nothing in Microsoft 365 refuses to create a site without a label, no licence depends on it, and a tenant that has not enabled container labels at all cannot comply. What the documentation supports is that an organisation deploying labels should be able to see which sites still have none. It does not support calling those sites misconfigured.

What it needs to decide

  • classification.classified

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • classification: what a site records about the kind of content it holds · live-validated

What a pass does not establish

Any label passes. A site labelled Public and a site labelled Highly Confidential are indistinguishable to this rule, and so is a site labelled with whatever came first in the dropdown. It reports that the question was answered, never that the answer was right.

  • A classification string is enough to pass, and it is the older mechanism. A site carrying a classification set years ago and no sensitivity label passes this rule while having none of the protection a container label brings, because the string is a word and the label is a configuration.
  • Where the tenant has not enabled sensitivity labels for containers, no site can carry one, and every site fails. The rule cannot see that setting: it is a tenant fact and this evidence describes a site. Run against a tenant of 53 sites, all 53 failed for exactly this reason, which is a true answer to the question asked and a misleading one to the question a reader will have in mind.
  • It says nothing about the documents inside. Container labels do not flow to items, and a labelled site can hold entirely unlabelled files.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.