How to Audit Sensitivity Labels in SharePoint Online

Managing SharePoint Online sites by sensitivity level helps to protect sensitive data and reinforces overall organizational security. Follow the steps below to apply and remove sensitivity labels on SharePoint sites.

Many organizations rely on sensitivity labels to protect their sensitive data in SharePoint Online. Therefore, it has become essential to audit events generated by label-applied files to track how they are accessed and modified. This process helps to identify any unauthorized changes or access attempts and enhances your oversight of data handling practices.

To audit events associated with sensitivity label applied files, connect to Exchange Online PowerShell using the Connect-ExchangeOnline cmdlet.

Next, run the following cmdlet to export details of sensitivity-label applied files’ activities.

$Operations = "FileSensitivityLabelChanged, FileSensitivityLabelRemoved, DocumentSensitivityMismatchDetected, SensitivityLabeledFileOpened, SensitivityLabeledFileRenamed"

Search-UnifiedAuditLog –StartDate <MM/DD/YYYY> -EndDate <MM/DD/YYYY> -Operations $Operations –SessionCommand ReturnLargeSet | Export-Csv –path "<FileName>.csv"

Additionally, auditing file usage in SharePoint Online enhances your ability to monitor confidential data and ensures that security measures, such as sensitivity labels, DLP, and IRM, are correctly applied.

Organizations often recommend using PDFs files to share sensitive information because of their widely recognized non-editable format. However, the risk of data leakage still exists, as users can copy text from PDFs.

To mitigate this risk, it is crucial to apply and audit sensitivity labels on PDF files regularly, ensuring that access to sensitive content is securely managed and controlled within SharePoint Online.

Follow these steps to audit sensitivity labels on PDF files in SharePoint Online.

You can also track other file formats that support sensitivity labels, such as Word (.docx, .docm), Excel (.xlsx, .xlsm, .xlsb), and PowerPoint (.pptx, .ppsx) using the steps mentioned above.

Note: By default, sensitivity label support for PDF files is disabled in Microsoft 365. To enable it, run the following cmdlet in SharePoint Online Management Shell.

Set-SPOTenant -EnableSensitivityLabelforPDF $True

A document sensitivity label mismatch occurs when a file has a higher-priority label than the site where it’s stored. This can expose metadata like titles and author, even if the file remains inaccessible to users.

When mismatches are detected, details like sensitivity label IDs, the priority levels for both the file & the site, along with the file's name and location, are provided. However, the identity of the user responsible for the mismatch is not included.

To retrieve the user responsible for a mismatch, you can use the FileUpload and FileModified events through Exchange Online PowerShell. Simply run the following PowerShell script, replacing <MM/DD/YYYY> with the appropriate start and end date.

Connect-ExchangeOnline 

$auditData = Search-UnifiedAuditLog -StartDate <MM/DD/YYYY> -EndDate <MM/DD/YYYY> -ResultSize 5000 -Operations "FileUploaded, FileModified, DocumentSensitivityMismatchDetected"  

$event = @{}  

$auditData | Where-Object {$_.Operations -ne "DocumentSensitivityMismatchDetected"} | ForEach-Object {  
    $data = $_.AuditData | ConvertFrom-Json  
    $event[$data.ListItemUniqueId] = $data.UserId
}  

$mismatchReport = $auditData | Where-Object {$_.Operations -eq "DocumentSensitivityMismatchDetected"} | ForEach-Object {  
    $data = $_.AuditData | ConvertFrom-Json  
    $user = if ($event[$data.ListItemUniqueId]){
    $event[$data.ListItemUniqueId]  
    } else { "SharePoint Online" }  
    [PSCustomObject]@{  
        Date         = $_.CreationDate  
        FileName     = $data.SourceFileName  
        User         = $user  
        SitePriority = $data.SiteSensitivityLabelOrder  
        FilePriority = $data.SensitivityLabelOrder  
    }
}  
$mismatchReport | Sort-Object Date | Format-Table

The script will provide key details about document sensitivity label mismatches, including the date, file name, responsible user, and sensitivity priorities for both the file and site. This helps you quickly resolve these mismatches in SharePoint Online.