What it decides

Rule
SPO-CLASS-002
Applies to
sharepoint · site
Default severity
low
Basis
convention

On what authority

Microsoft documents that the label applied to a container is identified by a GUID and that its name and settings live in Microsoft Purview, which is why applying one by script takes the GUID and applying one in the browser shows the name. Nothing in the documentation says a site whose label cannot be named is misconfigured, and nothing is: the configuration is correct and the reader is the one missing something. What this reports is a property of the evidence rather than of the tenant, and it is reported as a finding rather than as an `unknown` on purpose. A label that nobody can name is a governance answer nobody can use, and burying that inside "not established" would hide it among the sites where nothing was found at all.

What it needs to decide

  • classification.label_applied
  • classification.label_resolved

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • classification: what a site records about the kind of content it holds · live-validated

What a pass does not establish

A resolved name passes, and a name is a word. It says nothing about what the label is configured to do: privacy, guest access, the default sharing link and conditional access are all label settings this rule never reads. A site labelled Confidential by a label that enforces nothing passes.

  • It cannot distinguish a label that no longer exists from a label this identity cannot see. Both produce an id with no name, and the fix for one is a different fix from the other. The collection state beside the finding is where that difference would show, if the product reported it.
  • Never observed to fail. Against the tenant this rule set was validated on, 47 sites returned no label at all, so every one of them was not-applicable and the failing path has been exercised only against fixtures.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.