How to combine retention with sensitivity

Reading time: 2 minutes

Retention labels and sensitivity labels are two different components within Microsoft Purview. Where one is used for retaining, removing, and even deleting content, the other is needed for classifying and protecting information.

In some organizations, notably governmental, there is a use-case for combining the two types of labels. For example, information marked (labeled) as “Departmental – confidential” should be held for at least two years. Unfortunately, sensitivity labels are not (yet?) supported as a condition for the auto-application of retention labels.

However, we can use the label GUID for this. Again, the use-case: applying a retention label on a document, based on the sensitivity label that has been applied to this document. In order to make this work, we will need this GUID or ImmutableId for the label.

Using the Security & Compliance PowerShell, we can get this id pretty easily.

Connect-IPPSSession
(Get-label -Identity "Label_name").ImmutableId

For example:

If you want to get an overview of all IDs, then use this cmdlet.

Connect-IPPSSession 
Get-label | Format-Table - Property Name, ImmutableId, Disabled

The GUID can now be used in the conditions for auto-labeling. The metadata to look for in the query is the “InformationProtectionLabelID”. And your query will look somewhat like this:

InformationProtectionLabelId:22894bc5-c24e-4aaa-9515-fbd37d92ae62

Microsoft just announced a “simulation mode” for these auto-classification functions. This means we can test these out! But this option is not yet available. So to test this query, use the Search bar in SharePoint.

In the end, you auto-apply policy will find all documents based on this label-id. You can, of course, modify the query to make it even better. Please do note that it can take a while (7-10 days!) for the label to be applied using this function. If you’re looking for real-time functions: go for Microsoft Syntex.

I hope this helps!