What it decides

Rule
SPO-CLASS-003
Applies to
sharepoint · site
Default severity
medium
Basis
convention

On what authority

Microsoft documents what a container label controls on a group-connected site, and the list is specific: privacy, external user access, external sharing, access from unmanaged devices, conditional access, and discoverability of private teams. It also documents that setting privacy through a label locks it, so that it can only be changed by removing the label. That the controls exist is documented. That every group-connected site should use them is not, and it is ours. An organisation can reasonably manage all of it through group settings and conditional access instead and never apply a container label, and this rule will report every one of its sites. Separated from SPO-CLASS-001 rather than folded into it because the consequence differs. An unlabelled site with no group has no group controls to leave unset.

What it needs to decide

  • classification.group_connected
  • classification.label_applied

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • classification: what a site records about the kind of content it holds · live-validated

What a pass does not establish

Any label passes, including one configured to set nothing. A label whose protection settings were left empty leaves privacy and guest access exactly where this rule found them and satisfies it completely.

  • Group connection is read from `GroupId` on the site, which answers whether a group exists and not whether Teams is on top of it. `IsTeamsConnected` is a property of the tenant record, and PnP refuses to reach the administration context after a device login, so this evidence does not carry it. A Teams-connected site is group-connected, so nothing escapes the rule; the report simply cannot say which of the two it is looking at.
  • It overlaps SPO-CLASS-001 by construction. Every site that fails this rule also fails that one, because a site with no label and no classification is unclassified whether or not it has a group. Against the validating tenant, 22 of 47 sites failed both.
  • It says nothing about the group's own settings. Whether the group is public or private, and whether guests are on it, are Microsoft 365 group facts and this evidence describes a SharePoint site. The rule reports that nothing pins them, never what they currently are.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.