Find sites and groups with missing sensitivity labels

Find the sites, Teams and Microsoft 365 groups that carry no sensitivity label or the wrong one, and set the right label on the groups.

Before you begin

• Your Rencore role needs the permissions to create reports and policies, and to run built-in actions. See Rencore roles.
• Microsoft 365 and SharePoint are connected. Sensitivity labels are read from Microsoft Purview, so the Microsoft 365 consent must cover label scanning. See Reconsent for Sensitivity Label Scanning.
• Rencore Governance uses your Purview labels as they are. It has no label list of its own.

Steps

Find sites without a label

1. Go to Policies > Policy Options ([…]) > Create Policy.
2. In the “Policy Template Library”, choose SharePoint site collection lacks sensitivity label.
3. Save the policy. See Create a Policy from a Template.

Find sites with the wrong label

1. Creating a Custom Policy on the SharePoint object “Site Collection”.
2. Add a filter on “Sensitivity Label” that matches the label the site should not have, for example a public label.
3. Add a second filter for the sites that need a stricter label, for example on “Title”, “Url” or a custom metadata field.
4. To limit the policy to sites of Teams and Microsoft 365 groups, add the filter “Is Group Connected”.

For Teams and Microsoft 365 groups, you can also Creating a Custom Policy on the object “Group” or “Team” and add the related object “Sensitivity label” to the logic. 5. Click Preview to check the result, then save.

For an overview without violations, Create a Custom Report on “Site Collection” and break it down by “Sensitivity Label”.

Set the label on a group

1. Open the Microsoft 365 group in the inventory.
2. Run the built-in action Set Sensitivity Label for a Microsoft 365 Group and choose the label. See Executing an Action.
3. To do this for every violation, Create a Custom Automation with the trigger “on policy violation” and the action “Set Sensitivity Label for a M365 Group”.

What you see

The policy lists every site without a label or with the wrong one. After a label is set, the site leaves the policy on the next scan.

Limits

• Labels can be set on Microsoft 365 groups only. Rencore Governance does not set labels on standalone sites or on files.
• A label chosen in a provisioning template is fixed for every workspace made from that template.