Data-35018: Downgrade Justification Required for Sensitivity Labels #755
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a new security assessment test (ID: 35018) that verifies whether Microsoft 365 sensitivity label policies require users to provide justification when downgrading or removing classification labels. This control helps maintain audit trails and prevents silent reduction of data classification levels.
Key Changes:
- Added PowerShell test script to check if enabled label policies have the
requiredowngradejustificationsetting enabled - Created markdown documentation explaining the security rationale and remediation steps
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| src/powershell/tests/Test-Assessment.35018.ps1 | Implements the assessment logic to query label policies, parse settings, and evaluate downgrade justification requirements |
| src/powershell/tests/Test-Assessment.35018.md | Provides documentation on the security risk, remediation steps, and reference links |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ($policy.ExchangeLocation -match '^All$') -or | ||
| ($policy.ModernGroupLocation -match '^All$') -or | ||
| ($policy.SharePointLocation -match '^All$') -or | ||
| ($policy.OneDriveLocation -match '^All$') -or | ||
| ($policy.SkypeLocation -match '^All$') -or | ||
| ($policy.PublicFolderLocation -match '^All$') |
There was a problem hiding this comment.
The regex pattern '^All$' may not be necessary here. Based on similar patterns in Test-Assessment.35004.ps1 (lines 67-70), the comparison should use -contains "All" instead of regex matching. This is more efficient and aligns with the codebase's existing patterns for checking location scope.
| ($policy.ExchangeLocation -match '^All$') -or | |
| ($policy.ModernGroupLocation -match '^All$') -or | |
| ($policy.SharePointLocation -match '^All$') -or | |
| ($policy.OneDriveLocation -match '^All$') -or | |
| ($policy.SkypeLocation -match '^All$') -or | |
| ($policy.PublicFolderLocation -match '^All$') | |
| ($policy.ExchangeLocation -contains 'All') -or | |
| ($policy.ModernGroupLocation -contains 'All') -or | |
| ($policy.SharePointLocation -contains 'All') -or | |
| ($policy.OneDriveLocation -contains 'All') -or | |
| ($policy.SkypeLocation -contains 'All') -or | |
| ($policy.PublicFolderLocation -contains 'All') |
alexandair
left a comment
There was a problem hiding this comment.
Would this work for your test:
# Determine scope
$isGlobal =
($policy.ExchangeLocation -contains 'All') -or
($policy.ModernGroupLocation -contains 'All') -or
($policy.SharePointLocation -contains 'All') -or
($policy.OneDriveLocation -contains 'All') -or
($policy.SkypeLocation -contains 'All') -or
($policy.PublicFolderLocation -contains 'All')I've also added a commit to make .md file better.
No description provided.