SCSensitivityLabel - DisplayName can be duplicated which causes issues in Delta reports

[rayakajamon]

No description provided.

[andikrueger]

Could you provide some additional information to this issue?

[rayakajamon]

Hi Andi, here is what I am trying to convey.... For example, we can have a label Highly Confidential with DisplayName 'Contains Personal Information' and we can have another label ‘Confidential’ with same DisplayName ‘Contains Personal Information' Delta reports treat these two different labels as the same, due to the DisplayName value and generates incorrect output in the reports. Does that help any? Thank you

…

-Ray "Where your treasure is, there your heart will be also" (Luke 12:34)

________________________________ From: Andi Krüger ***@***.***> Sent: Tuesday, June 14, 2022 8:55 AM To: microsoft/Microsoft365DSC ***@***.***> Cc: rayakajamon ***@***.***>; Author ***@***.***> Subject: Re: [microsoft/Microsoft365DSC] SCSensitivityLabel - DisplayName can be duplicated which causes issues in Delta reports (Issue #2008) Could you provide some additional information to this issue? — Reply to this email directly, view it on GitHub<#2008 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AFLUUXT6P5DWBE7TXU7VRWLVPB6MPANCNFSM5YVPZIEA>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[andikrueger]

Thanks a lot. This is a good examples and shows a further challenge we do have with exports.

There are various resources that use the (display) name as key parameter. I raised another issue #2006 that mentions this behavior.

[rayakajamon]

Really appreciate the feedback and help, Andi. Thanks for the support!

…

-Ray "Where your treasure is, there your heart will be also" (Luke 12:34)

________________________________ From: Andi Krüger ***@***.***> Sent: Tuesday, June 14, 2022 2:09 PM To: microsoft/Microsoft365DSC ***@***.***> Cc: rayakajamon ***@***.***>; Author ***@***.***> Subject: Re: [microsoft/Microsoft365DSC] SCSensitivityLabel - DisplayName can be duplicated which causes issues in Delta reports (Issue #2008) Thanks a lot. This is a good examples and shows a further challenge we do have with exports. There are various resources that use the (display) name as key parameter. I raised another issue #2006<#2006> that mentions this behavior. — Reply to this email directly, view it on GitHub<#2008 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AFLUUXRBIC7VDUMR7MKK2JDVPDDG3ANCNFSM5YVPZIEA>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[NikCharlebois]

@rayakajamon can you provide additional information on how to replicate the scenario? We are unable to create two labels at the same hierarchy level with the same name. Thanks

[rayakajamon]

My apologies Nik for the delay, I have missed some time to covid. I got the below back from the customer In Microsoft Information Protection / Sensitivity Labels, you can create sub-labels to the main labels. For instance: * Public * General * Confidential * Contains Personal Information * Does not Contain Personal Information * Highly Confidential * Contains Personal Information * Does not Contain Personal Information Note the two sets of sub-labels have the same display name. The DSC tool should be looking at the GUID’s of the labels, which will be unique, and not the physical display names, which can be identical. We have a longstanding DCR with Microsoft to make multi-labeling a real thing, vs. having redundant sub-labels, but this is not in the product as of yet.

…

-Ray Gonzalez ***@***.***

________________________________ From: Nik Charlebois ***@***.***> Sent: Friday, July 22, 2022 4:01 PM To: microsoft/Microsoft365DSC ***@***.***> Cc: rayakajamon ***@***.***>; Mention ***@***.***> Subject: Re: [microsoft/Microsoft365DSC] SCSensitivityLabel - DisplayName can be duplicated which causes issues in Delta reports (Issue #2008) @rayakajamon<https://github.com/rayakajamon> can you provide additional information on how to replicate the scenario? We are unable to create two labels at the same hierarchy level with the same name. Thanks [image]<https://user-images.githubusercontent.com/2547149/180518382-bc84a997-91a5-4ceb-ab11-6c87592d2ec6.png> — Reply to this email directly, view it on GitHub<#2008 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AFLUUXT5WRDOIVXFRZTS6VLVVL4ZJANCNFSM5YVPZIEA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[andikrueger]

Microsoft365DSC/Modules/Microsoft365DSC/DSCResources/MSFT_SCSensitivityLabel/MSFT_SCSensitivityLabel.schema.mof

Lines 14 to 17 in 6d83ac9

	class MSFT_SCSensitivityLabel : OMI_BaseResource
	{
	[Key, Description("The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.")] String Name;
	[Write, Description("Specify if this rule should exist or not."), ValueMap{"Present","Absent"}, Values{"Present","Absent"}] String Ensure;

This resource does only define one key parameter. This key needs to be unique. As you pointed out, the label name can be reused at different levels. these levels are handled, but are not part of the set key parameters.

Adding the ParentId as a secondary key could solve this problem, but would raise another issue on how to add a top level label, as $nullor an empty string would not be a valid value for this key.

Microsoft365DSC/Modules/Microsoft365DSC/DSCResources/MSFT_SCSensitivityLabel/MSFT_SCSensitivityLabel.schema.mof

Line 22 in 6d83ac9

[Write, Description("The ParentId parameter specifies the parent label that you want this label to be under (a sublabel). You can use any value that uniquely identifies the parent sensitivity label for example name.")] String ParentId;

Using the Id of the label is no option either, as we do not know this Id during creation time. (see: #2006)

[NikCharlebois]

Still, I don't know how to reproduce this scenario. Trying to replicate your scenario, I get the following error when using the same name/display name for two sub-labels with a different parent id:

Just giving it a different displayname doesn't work, the Name property is the key. So I append a '2' at the end of the Name portion and it gets created. Doing that, I end up with the following:

Through PowerShell, here is what I am getting:

The Get-TargetResource uses the Name property and not the DisplayName, therefore this ensures we don't ever have a naming conflict even for sub-labels

[NikCharlebois]

I am however able to reproduce the issue with Delta report. It's as if the function thinks DisplayName is the primary key. Stay tuned

[NikCharlebois]

Problem comes from here: https://github.com/microsoft/Microsoft365DSC/blob/Dev/Modules/Microsoft365DSC/Modules/M365DSCReport.psm1#L691

Will be looking at making this more dynamic

[NikCharlebois]

Will also work on adding support for ParentId as a separate PR