What it decides

Rule
SPO-CLASS-004
Applies to
sharepoint · site
Default severity
low
Basis
documented-guidance

On what authority

The classification page opens with Microsoft's own note: "You can now use sensitivity labels instead of sites classification to help protect your SharePoint sites." The Teams documentation states the difference plainly: classifications "are text strings that can be associated with a Microsoft 365 group but don't have any actual policies associated with them", while label policies "are automatically enforced end-to-end", and it points to the procedure for converting classification values to labels. It is guidance rather than a requirement: the classification mechanism still works, nothing forces the conversion, and an organisation with its own enforcement tooling built on the strings may reasonably keep them.

What it needs to decide

  • classification.classification_set
  • classification.label_applied

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • classification: what a site records about the kind of content it holds · live-validated

What a pass does not establish

Any label passes. A site whose label carries none of the protections the old string was meant to imply passes this rule exactly like one whose label enforces all of them: the rule reads that a label is applied, never what the label does.

  • Where the tenant has not enabled sensitivity labels for containers, no site can carry one, and every classified-by-string site fails. The rule cannot see that tenant setting: this evidence describes a site.
  • The rule does not read what the string says. A site classified "Public" and one classified "Highly Confidential" fail identically, because in both cases the enforcement the string implies does not exist.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.