[Security&Compliance] Labelpolicy errors because Label ID not found in published labels #2840
Assignees
Labels
Comments
|
Can you share you complete configuration (redacted) for us to troubleshoot? Thanks |
|
Below is the full script, it's a full SC export from our dev enviroment, so you might see some copy or test stuff in it. # Generated with Microsoft365DSC version 1.23.118.1
# For additional information on how to use Microsoft365DSC, please visit https://aka.ms/M365DSC
param (
[parameter()]
[System.Management.Automation.PSCredential]
$Credential
)
Configuration SC-RWO-V1
{
param (
[parameter()]
[System.Management.Automation.PSCredential]
$Credential
)
if ($null -eq $Credential)
{
<# Credentials #>
$Credscredential = Get-Credential -Message "Credentials"
}
else
{
$CredsCredential = $Credential
}
$OrganizationName = $CredsCredential.UserName.Split('@')[1]
Import-DscResource -ModuleName 'Microsoft365DSC' -ModuleVersion '1.23.118.1'
Node localhost
{
SCComplianceTag 6bb0a1e7-1d03-49c1-a5c9-f624600bf93f
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "2 jaar retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "KeepAndDelete";
RetentionDuration = "730";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag b46dcca7-a009-40ad-baa5-9a54c1569c5d
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "1 jaar geen retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "Delete";
RetentionDuration = "365";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag 229f8609-f8c9-4b97-8176-5bc904402216
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "7 jaar geen retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "Delete";
RetentionDuration = "2555";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag fc718e61-7d6c-4633-ab8b-ba113564f3f5
{
Comment = "**normally filled with text**
";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "1 jaar retentie";
Notes = "**normally filled with text**
";
Regulatory = $False;
RetentionAction = "KeepAndDelete";
RetentionDuration = "365";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag dc97249c-a282-495b-8585-ccf09b9f3158
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "Email - 10 jaar - delete mail";
Notes = "**normally filled with text**
";
Regulatory = $False;
RetentionAction = "Delete";
RetentionDuration = "3650";
RetentionType = "TaggedAgeInDays";
}
SCComplianceTag be0ac4c1-7325-40c7-a511-0f9158c2cc01
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "5 jaar geen retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "Delete";
RetentionDuration = "1825";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag b3f2352b-700a-4264-b8cf-d1501db856da
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "10 jaar retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "KeepAndDelete";
RetentionDuration = "3650";
RetentionType = "CreationAgeInDays";
}
SCComplianceTag 7545b2f9-041e-4957-b297-ab671f590c15
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "2 jaar geen retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "Delete";
RetentionDuration = "730";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag dc71a3d1-a5d5-4178-91ee-1dd3a30e326f
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "5 jaar retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "KeepAndDelete";
RetentionDuration = "1825";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag 182f4ced-11ec-48fe-8adf-4c20d37aee05
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "7 jaar retentie";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "KeepAndDelete";
RetentionDuration = "2555";
RetentionType = "ModificationAgeInDays";
}
SCComplianceTag 1f7e4146-6425-4b35-98cb-efb8ac5e60b9
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "Email - 10 weken - wijzig label naar 10 jaar";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "Delete";
RetentionDuration = "70";
RetentionType = "CreationAgeInDays";
}
SCComplianceTag bdb283e1-49b6-4951-acfe-fdc93d35b098
{
Comment = "Email wordt niet verwijderd";
Credential = $Credscredential;
Ensure = "Present";
IsRecordLabel = $False;
Name = "Email - blijvend bewaard";
Notes = "**normally filled with text**";
Regulatory = $False;
RetentionAction = "Keep";
RetentionDuration = "Unlimited";
RetentionType = "CreationAgeInDays";
}
SCDLPCompliancePolicy c0e8d19b-cc18-4e1f-8a8b-3289c32c8153
{
Comment = "Test Prevent Copy Classified Data to USB, Network Share, Print";
Credential = $Credscredential;
Ensure = "Present";
ExchangeSenderMemberOf = @();
ExchangeSenderMemberOfException = @();
Mode = "Enable";
Name = "Copy hoog geclassificeerde data naar USB Test";
OneDriveLocationException = @();
Priority = 0;
SharePointLocationException = @();
TeamsLocation = @();
TeamsLocationException = @();
}
SCDLPCompliancePolicy 259ba8d5-5196-4456-8650-286da5dec930
{
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
ExchangeLocation = "All";
ExchangeSenderMemberOf = @();
ExchangeSenderMemberOfException = @();
Mode = "Enable";
Name = "Departementaal vertrouwelijk Waarschuwing";
OneDriveLocation = "All";
OneDriveLocationException = @();
Priority = 1;
SharePointLocation = "All";
SharePointLocationException = @();
TeamsLocationException = @();
}
SCDLPComplianceRule 64d2b56b-d87c-4b39-9326-3c1088710851
{
BlockAccess = $False;
Comment = "Warn user when sensitivity information is used";
Credential = $Credscredential;
Disabled = $False;
DocumentIsPasswordProtected = $False;
DocumentIsUnsupported = $False;
Ensure = "Present";
ExceptIfDocumentIsPasswordProtected = $False;
ExceptIfDocumentIsUnsupported = $False;
ExceptIfHasSenderOverride = $False;
ExceptIfProcessingLimitExceeded = $False;
GenerateAlert = @("true");
HasSenderOverride = $False;
Name = "Copy hoog geclassificeerde data naar USB";
NotifyEmailCustomText = "Please handle privacy information with care according to the AVG and GDPR Regulations (RWO-V 2)";
NotifyPolicyTipCustomText = "Please handle privacy information with care according to the AVG and GDPR Regulations (RWO-V 3)";
NotifyUser = @("LastModifier");
Policy = "Copy hoog geclassificeerde data naar USB Test";
ProcessingLimitExceeded = $False;
RemoveRMSTemplate = $False;
ReportSeverityLevel = "Low";
StopPolicyProcessing = $False;
}
SCDLPComplianceRule 2122b418-239a-4504-8505-4d7deba2cb25
{
BlockAccess = $False;
Comment = "test";
Credential = $Credscredential;
Disabled = $False;
DocumentIsPasswordProtected = $False;
DocumentIsUnsupported = $False;
Ensure = "Present";
ExceptIfDocumentIsPasswordProtected = $False;
ExceptIfDocumentIsUnsupported = $False;
ExceptIfHasSenderOverride = $False;
ExceptIfProcessingLimitExceeded = $False;
GenerateAlert = @("true");
HasSenderOverride = $False;
Name = "Copy hoog geclassificeerde data naar USB (High)";
NotifyEmailCustomText = "Please use with care 2";
NotifyPolicyTipCustomText = "Please use with care 3";
NotifyUser = @("LastModifier");
Policy = "Copy hoog geclassificeerde data naar USB Test";
ProcessingLimitExceeded = $False;
RemoveRMSTemplate = $False;
ReportSeverityLevel = "Low";
StopPolicyProcessing = $False;
}
SCDLPComplianceRule 5e17851e-70be-4e75-b928-67175f60c638
{
BlockAccess = $True;
BlockAccessScope = "PerUser";
Comment = "Delen hoog geclassificeerde data";
Credential = $Credscredential;
Disabled = $False;
DocumentIsPasswordProtected = $False;
DocumentIsUnsupported = $False;
Ensure = "Present";
ExceptIfDocumentIsPasswordProtected = $False;
ExceptIfDocumentIsUnsupported = $False;
ExceptIfHasSenderOverride = $False;
ExceptIfProcessingLimitExceeded = $False;
HasSenderOverride = $False;
Name = "Delen hoog geclassificeerde data";
NotifyEmailCustomText = "Let op: U bent hoog geclassificeerde data aan het delen met externen.";
NotifyPolicyTipCustomText = "Let op: U bent hoog geclassificeerde data aan het delen met externen.";
NotifyUser = @("LastModifier");
Policy = "Departementaal vertrouwelijk Waarschuwing";
ProcessingLimitExceeded = $False;
RemoveRMSTemplate = $False;
ReportSeverityLevel = "Low";
StopPolicyProcessing = $False;
}
SCLabelPolicy b264c8ce-589b-4ad9-b403-88c1e5a22fd2
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'mandatory'
Value = 'false'
}
MSFT_SCLabelSetting
{
Key = 'powerbimandatory'
Value = 'false'
}
MSFT_SCLabelSetting
{
Key = 'requiredowngradejustification'
Value = 'true'
}
MSFT_SCLabelSetting
{
Key = 'defaultlabelid'
Value = 'bf964080-fc69-40c3-b6eb-daad6736c8b7'
}
MSFT_SCLabelSetting
{
Key = 'disablemandatoryinoutlook'
Value = 'true'
}
MSFT_SCLabelSetting
{
Key = 'siteandgroupmandatory'
Value = 'false'
}
MSFT_SCLabelSetting
{
Key = 'teamworkmandatory'
Value = 'false'
}
MSFT_SCLabelSetting
{
Key = 'siteandgroupdefaultlabelid'
Value = 'bf964080-fc69-40c3-b6eb-daad6736c8b7'
}
);
Comment = "**normally filled with text**";
Credential = $Credscredential;
Ensure = "Present";
ExchangeLocation = "All";
Labels = @("Label-01","Label-03D","Label-03","Label-02","Label-03A","Label-03B","Label-03C");
Name = "RWO-V Sensitivity Labels";
}
SCProtectionAlert 4474f1e1-cdeb-4d36-a9a5-ea9836cb722a
{
AggregationType = "None";
Category = "DataLossPrevention";
Comment = "";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "DLP-Copy hoog geclassificeerde data naar USB (High)";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("DlpRuleGenerateAlertMatch");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert fa9881df-dd24-4b39-a84a-fd60746d2ab4
{
AggregationType = "None";
Category = "AccessGovernance";
Comment = "";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Privilege Escalation - Office 365";
NotificationEnabled = $True;
NotifyUser = @("Monitoring@$OrganizationName");
NotifyUserOnFilterMatch = $False;
Operation = @("Add member to role.");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 14f720e3-658b-4ae1-b681-284cd7bcc9c6
{
AggregationType = "None";
Category = "AccessGovernance";
Comment = "";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Privilege Escalation -eDiscovery";
NotificationEnabled = $True;
NotifyUser = @("Monitoring@$OrganizationName");
NotifyUserOnFilterMatch = $False;
Operation = @("CaseAdminUpdated");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 57a8a81a-3f71-41fa-ad9e-9c5d103aad23
{
AggregationType = "None";
Category = "DataLossPrevention";
Comment = "";
Credential = $Credscredential;
Disabled = $True;
Ensure = "Present";
Name = "DLP-Delen hoog geclassificeerde data";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("DlpRuleGenerateAlertMatch");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert 4cd3420d-a2cd-4f72-bb2f-dedfcbe89d68
{
AggregationType = "None";
Category = "DataLossPrevention";
Comment = "";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "DLP-Copy hoog geclassificeerde data naar USB";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("DlpRuleGenerateAlertMatch");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert 90324816-3b93-46ff-ad56-407913e7684c
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "AutoLabel policy simulation has been completed. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "MIP AutoLabel simulation completed";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("MipAutoLabelSimulationCompletion");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert 5626d7c6-1a70-435e-ad8d-18df32838d59
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "User has been detected as sending suspicious messages outside the organization and will be restricted if this activity continues. -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "-not (Activity.User.Tags -like 'hve')";
Name = "Suspicious email sending patterns detected";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("CompromisedWarningAccount");
Severity = "Medium";
ThreatType = "Activity";
}
SCProtectionAlert b43379e1-dc72-42d4-995b-a2d541f05028
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Malicious emails were delivered and later removed -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.IsMailZAPSuccessful -eq 1) -and (Mail.IsGenericZapped -eq 1) -and (Mail.TenantPolicyFinalVerdictSource -ne 'PhishEdu') -and (Mail.TenantPolicyFinalVerdictSource -ne 'SecOps') -and (Mail.TenantPolicyFinalVerdictSource -ne 'ThirdPartyFiltering')";
Name = "Email messages removed after delivery";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Malicious";
}
SCProtectionAlert 8dd92240-d223-4041-a0a9-543a3ad7a89b
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Emails messages from a campaign were delivered and later removed -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsCampaignZapped -eq 1 -and (Mail.TenantPolicyFinalVerdictSource -ne 'PhishEdu') -and (Mail.TenantPolicyFinalVerdictSource -ne 'SecOps') -and (Mail.TenantPolicyFinalVerdictSource -ne 'ThirdPartyFiltering')";
Name = "Email messages from a campaign removed after delivery";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Malicious";
}
SCProtectionAlert 7422f1fc-3809-449b-a9dc-9285cf372358
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered because an admin triggered investigation of a user -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Activity.AirItemType -eq 'User'";
Name = "Admin triggered user compromise investigation";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("AirManualInvestigation");
Severity = "Medium";
ThreatType = "Activity";
}
SCProtectionAlert 5af4711a-8f4f-4dc0-9171-1594b9588ff4
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "We have detected that one of your users has recently clicked through on a link that was found to be malicious. -V1.0.0.3";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Click.IsSystemBlockOverriden -eq 1) -or (Click.IsTenantBlockOverriden -eq 1)";
Name = "A user clicked through to a potentially malicious URL";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "High";
ThreatType = "MaliciousUrlClick";
}
SCProtectionAlert f4e0d381-bacf-4d70-ac74-1fa4b1846079
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Connector has been restricted from sending messages due to potential compromise activity. -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Suspicious connector activity";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("ConnectorAbuse");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 45f07a92-66eb-428c-9054-d0700f1be2b5
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "New sensitive information was uploaded and is ready to be protected. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Successful exact data match upload";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("UploadDataCompleted");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert a92a4cea-42e1-4a3f-b981-0e7ad28b19c1
{
AggregationType = "None";
Category = "AccessGovernance";
Comment = "This alert is triggered when someone in your organization becomes an Exchange admin or gets new Exchange admin permissions -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Elevation of Exchange admin privilege";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("GrantAdminPermission");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert 5c9e9a9c-89ab-4866-91fe-2fd29c0b70df
{
AggregationType = "CustomAggregation";
Category = "MailFlow";
Comment = "This alert is triggered when a reply-all storm is detected and at least one reply-all to the mail thread has been blocked. See the Reply-all Storm Protection mail flow report for more information. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Message.Verdict -eq 'Block'";
Name = "Reply-all storm detected";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "High";
ThreatType = "MailFlow";
Threshold = 1;
}
SCProtectionAlert dda0c0f2-91d3-482c-b38e-e2ca6a170e70
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Emails with malware that were delivered and later removed -V1.0.0.8";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Mail.IsSystemZappedMalware -eq 1 -and (-not (Mail.Recipients.Tags -like 'hve')) -and (-not (Mail.Sender.Tags -like 'hve')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering')) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))";
Name = "Email messages containing malware removed after delivery";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Malware";
}
SCProtectionAlert 4447c220-1cae-4b88-b276-b867e9f68e84
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Emails with malicious URL that were delivered and later removed -V1.0.0.3";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByURLs -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering')) -and (Mail.IsCampaignZapped -ne 1)";
Name = "Email messages containing malicious URL removed after delivery";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Malicious";
}
SCProtectionAlert 76088e52-545c-4a22-9d0a-720cf91ca2c4
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Microsoft Forms identified repeated phishing attempts by a user in your tenant. This user is now blocked from sharing forms and collecting responses. -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "User restricted from sharing forms and collecting responses";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("UserRestrictedByDistributingForms");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert b55279c7-732c-45f5-8efd-03f255164896
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "We have detected that one of your HVE users has recently clicked on a link that was found to be malicious -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "HVE A potentially malicious URL click was detected";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "High";
ThreatType = "MaliciousUrlClick";
}
SCProtectionAlert c0652506-b936-4951-b98b-2aa49fe4b173
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Activity.SubmissionType -eq 'Phish') -or (Activity.SubmissionType -eq 'Malware')";
Name = "Email reported by user as malware or phish";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("UserSubmission");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert 1fc12e2d-0f3f-4bf8-b6ae-6c2006097dd4
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Retention auto-labeling policy simulation has been completed. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Retention Auto-labeling Policy Simulation Completed";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("RetentionAutoLabelSimulationCompletion");
Severity = "Low";
ThreatType = "Activity";
}
SCProtectionAlert de055c22-d4a0-460b-bbbd-b9883c102b93
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered because an admin triggered manual investigation of an Email from explorer -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Activity.AirItemType -eq 'Email'";
Name = "Admin triggered manual investigation of email";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("AirManualInvestigation");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert 04ffb112-0389-4a26-a0b6-2a36d24174d4
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "The alert is triggered when users start content searches or eDiscovery searches or when search results are downloaded or exported -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "eDiscovery search started or exported";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("eDiscoverySearchStartedOrExported");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert 3fbfb7e2-fdba-456d-93e2-e10f7e623a37
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "A user has requested to release an email from quarantine. -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "User requested to release a quarantined message";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("QuarantineRequestReleaseMessage");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert 00f258c6-916f-48b5-bfae-6f3b1e77d03a
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Emails with malicious file that were delivered and later removed -V1.0.0.3";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByFiles -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering')) -and (Mail.IsCampaignZapped -ne 1)";
Name = "Email messages containing malicious file removed after delivery";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Malicious";
}
SCProtectionAlert 1e21850d-0285-4b77-8d4b-2427c369ead2
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Microsoft Threat Intelligence Center detected an attempt to compromise accounts from your tenant. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Activity.Operation -eq 'MSTICNationStateNotification'";
Name = "Potential Nation-State Activity";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("MSTICNationStateNotification");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 7858b4c2-9f83-41b2-90c0-eb2520148d6c
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered once the admin submission result is generated or updated. -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Admin Submission Result Completed";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("AdminSubmission");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert 2c08f008-3655-448d-82d1-b5baf97895da
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "User has exceeded their email sending limit and the action defined within the Outbound Spam policy has been applied. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Email sending limit exceeded";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("EmailSendingLimitExceeded");
Severity = "Medium";
ThreatType = "Activity";
}
SCProtectionAlert 64a9c4f4-0907-476f-972b-0c5b8223a518
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered when an admin takes remediation action on the selected entity -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Activity.AirAdminActionType -eq 'MailAction' -or Activity.AirAdminActionType -eq 'BlockUrlAction' -or Activity.AirAdminActionType -eq 'BlockSenderAction')";
Name = "Remediation action taken by admin on emails or URL or sender";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("AirAdminActionInvestigation");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert 8c32b49a-f323-4b30-aacc-fecdbae19a8b
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Creation of forwarding/redirect rule";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("MailRedirect");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert ce0e6906-1706-4258-a15b-da1c579aa772
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "User has been restricted from sending messages outside the organization due to potential compromised activity. -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "-not (Activity.User.Tags -like 'hve')";
Name = "User restricted from sending email";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("CompromisedAccount");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert d1b14fc3-e816-459f-beef-c3325bbdafa9
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Messages containing a malicious entity were delivered, and we could not remove them after delivery. Manual action is required. Please remove the malicious messages for the affected users. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.IsMailZAPFailed -eq 1) -and ((((Mail.IsSystemZappedByFiles -eq 1) -or (Mail.IsSystemZappedByURLs -eq 1)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering')) -and (Mail.IsCampaignZapped -ne 1)) -or (((Mail.IsGenericZapped -eq 1) -or(Mail.IsCampaignZapped -eq 1)) -and (Mail.TenantPolicyFinalVerdictSource -ne 'PhishEdu') -and (Mail.TenantPolicyFinalVerdictSource -ne 'SecOps') -and (Mail.TenantPolicyFinalVerdictSource -ne 'ThirdPartyFiltering')))";
Name = "Messages containing malicious entity not removed after delivery";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Medium";
ThreatType = "Malicious";
}
SCProtectionAlert 0c55ddd6-8b3e-45ff-a16e-874e157b4d63
{
AggregationType = "AnomalousAggregation";
AlertBy = @("Tenant");
Category = "DataGovernance";
Comment = "This alert is triggered when the volume of external file sharing activities in your organization becomes unusual -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Unusual volume of external file sharing";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("ExternalFileSharing");
Severity = "Medium";
ThreatType = "Activity";
}
SCProtectionAlert ff0087f8-06b0-4f0e-9e98-9b34dedb7093
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Microsoft Forms detected a potential phishing attempt from a form and blocked it from distribution and response collection. -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Form blocked due to potential phishing attempt";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("AutoBlockedForm");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert b1f671f9-2aa2-48b6-9315-3b91121c615d
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert fires when message containing phish was delivered due to an ETR override. -V1.0.0.4";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.DeliveryStatus -eq 'Delivered') -and (Mail.Direction -eq 'Inbound') -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq 'High') -and (Mail.FinalVerdictSource -eq 'Tenant') -and (Mail.TenantPolicyFinalVerdict -eq 'Allow') -and (Mail.TenantPolicyFinalVerdictSource -eq 'ETR' -or Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering') -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps'))";
Name = "Phish delivered due to an ETR override";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Phish";
}
SCProtectionAlert e20c3582-0a7d-4ab9-a1ed-6aa2b2314afd
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert fires when message containing malware was not zapped because ZAP is disabled. -V1.0.0.6";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Mail.TimeTravelResult -eq 'AdminPolicy_ZapDisabled' -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering'))";
Name = "Malware not zapped because ZAP is disabled";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Medium";
ThreatType = "Malware";
}
SCProtectionAlert ef1aa25a-4580-4d14-b4e2-1a20b84baf86
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert is triggered once suspicious email forwarding is detected. -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Suspicious Email Forwarding Activity";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("SuspiciousForwarding");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 6246aed5-85ca-4be3-9349-d65dd22e5eca
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Emails with phish URLs that were delivered and later removed -V1.0.0.8";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "Mail.IsSystemZappedPhish -eq 1 -and (-not (Mail.Recipients.Tags -like 'hve')) -and (-not (Mail.Sender.Tags -like 'hve')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering')) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))";
Name = "Email messages containing phish URLs removed after delivery";
NotificationEnabled = $False;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Phish";
}
SCProtectionAlert b36919ef-6985-4e13-8334-5195f648dc26
{
AggregationType = "CustomAggregation";
Category = "MailFlow";
Comment = "When Office 365 can't deliver a message to your on-premises or partner servers via a connector, the message is queued in Office 365. This alert is triggered when the number of queued messages exceeds the policy threshold and have been queued for more than an hour. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "MessagesQueued.QueuedType -eq 'ConnectorBasedMessagesQueued'";
Name = "Messages have been delayed";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "High";
ThreatType = "MailFlow";
Threshold = 2000;
}
SCProtectionAlert 6f2d11b8-9641-425b-a643-6fccafdb167f
{
AggregationType = "None";
Category = "ComplianceManager";
Comment = "This default policy will generate an alert for events that happen within 60 minutes of alert creation -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Compliance Manager Default Alert Policy";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("ComplianceManagerActionScoreChange");
Severity = "Medium";
ThreatType = "Activity";
TimeWindow = 60;
}
SCProtectionAlert a8f9ac89-c335-4c6d-8ce7-0f6c9dda22e2
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "The majority of traffic related to unprovisioned domains from this tenant has been detected as suspicious and the tenant has been restricted from sending email with unregistered domains. Investigate any potentially compromised user/admins, new connectors, or open relays and contact support to unblock your tenant. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Tenant restricted from sending unprovisioned email";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("CompromisedUnprovisionedTenantAccount");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 41b06eb8-2f95-42d5-942c-ca401f090d2b
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "The majority of traffic from this tenant has been detected as suspicious and has resulted in a ban on sending ability for the tenant. Ensure that any compromises or open relays have been resolved, and then contact support through your regular channel. -V1.0.0.1";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Tenant restricted from sending email";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("CompromisedTenantAccount");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert b1b71f8f-54f3-4f2d-8e73-b19f84401ff5
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert fires when message containing phish was delivered due to an IP allow policy. -V1.0.0.3";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.DeliveryStatus -eq 'Delivered') -and (Mail.Direction -eq 'Inbound') -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq 'High') -and (Mail.FinalVerdictSource -eq 'Tenant') -and (Mail.TenantPolicyFinalVerdict -eq 'Allow') -and (Mail.TenantPolicyFinalVerdictSource -eq 'ConnPolicy') -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering'))";
Name = "Phish delivered due to an IP allow policy";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Informational";
ThreatType = "Phish";
}
SCProtectionAlert f72dbfe5-b016-49a0-8842-a08e4c442ec3
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "This alert fires when message containing phish was not zapped because ZAP is disabled -V1.0.0.4";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Mail.TimeTravelResult -eq 'AdminPolicy_ZapDisabled') -and (Mail.PhishConfidence -eq 'High') -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'PhishEdu')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'SecOps')) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq 'ThirdPartyFiltering'))";
Name = "Phish not zapped because ZAP is disabled";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "Medium";
ThreatType = "Phish";
}
SCProtectionAlert ffdca074-422d-49de-b75f-f2ccbfc85c3f
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "New sensitive information failed to upload. Try again later. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Failed exact data match upload";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("UploadDataFailed");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert f04eb3fd-4115-46ff-9631-58aaa47fc902
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "A form created in Microsoft Forms from within your organization has been identified as phishing through Report Abuse and confirmed as phishing. -V1.0.0.2";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Form flagged and confirmed as phishing";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("OSTTakenDownForm");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert 7c44dd26-63e5-474d-b897-397d082739cf
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "A Tenant Allow/Block List entry will be removed due to expiration. -V1.0.0.0";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Tenant Allow/Block List entry is about to expire";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("TenantAllowBlockListItemExpiry");
Severity = "Informational";
ThreatType = "Activity";
}
SCProtectionAlert 3f09854a-45ed-4def-a78b-9f591db3a60f
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "Suspicious sending patterns have been observed in your tenant, which may lead to your tenant being blocked from sending emails. Investigate any potentially compromised user and admin accounts, new connectors, or open relays to avoid tenant exceed threshold blocks. -V1.0.0.5";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Name = "Suspicious tenant sending patterns observed";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Operation = @("TenantExceedsThresholdEarlyAlert");
Severity = "High";
ThreatType = "Activity";
}
SCProtectionAlert f0bf32c9-0c9b-4721-a82e-f97a61e983d3
{
AggregationType = "None";
Category = "ThreatManagement";
Comment = "We have detected that one of your users has recently clicked on a link that was found to be malicious. -V1.0.0.5";
Credential = $Credscredential;
Disabled = $False;
Ensure = "Present";
Filter = "(Click.IsLookBack -eq 1)";
Name = "A potentially malicious URL click was detected";
NotificationEnabled = $True;
NotifyUser = @("TenantAdmins");
NotifyUserOnFilterMatch = $False;
Severity = "High";
ThreatType = "MaliciousUrlClick";
}
SCRetentionCompliancePolicy 49f8b89b-dd6a-44b9-b496-d01903c7e540
{
Comment = "Voor alle email wordt direct een label gezet";
Credential = $Credscredential;
DynamicScopeLocation = @();
Enabled = $True;
Ensure = "Present";
ExchangeLocation = @();
ExchangeLocationException = @();
ModernGroupLocation = @();
ModernGroupLocationException = @();
Name = "Email - direct - 10 weken label zetten";
OneDriveLocation = @();
OneDriveLocationException = @();
PublicFolderLocation = @();
RestrictiveRetention = $False;
SharePointLocation = @();
SharePointLocationException = @();
SkypeLocation = @();
SkypeLocationException = @();
}
SCRetentionCompliancePolicy b603e2b4-35c2-4809-9bf9-0ea228481f11
{
Comment = "File retention OneDrive and SharePoint";
Credential = $Credscredential;
DynamicScopeLocation = @();
Enabled = $True;
Ensure = "Present";
ExchangeLocation = @();
ExchangeLocationException = @();
ModernGroupLocation = @("All");
ModernGroupLocationException = @();
Name = "File retention OneDrive and SharePoint";
OneDriveLocation = @("All");
OneDriveLocationException = @();
PublicFolderLocation = @();
RestrictiveRetention = $False;
SharePointLocation = @("All");
SharePointLocationException = @();
SkypeLocation = @();
SkypeLocationException = @();
}
SCRetentionCompliancePolicy 05b280fe-a412-4f50-af8a-02f125e52891
{
Comment = "Retentie policy email";
Credential = $Credscredential;
DynamicScopeLocation = @();
Enabled = $True;
Ensure = "Present";
ExchangeLocation = @("All");
ExchangeLocationException = @();
ModernGroupLocation = @();
ModernGroupLocationException = @();
Name = "Email retentie Exchange Online";
OneDriveLocation = @();
OneDriveLocationException = @();
PublicFolderLocation = @();
RestrictiveRetention = $False;
SharePointLocation = @();
SharePointLocationException = @();
SkypeLocation = @();
SkypeLocationException = @();
}
SCRetentionCompliancePolicy 1e45de8f-3670-48a1-9905-91fdcb503e25
{
Comment = "Teams chat 10 jaar retentie
";
Credential = $Credscredential;
Enabled = $True;
Ensure = "Present";
Name = "Teams channel messages + chats - Users";
RestrictiveRetention = $False;
TeamsChannelLocation = @("All");
TeamsChannelLocationException = @();
TeamsChatLocation = @("All");
TeamsChatLocationException = @();
}
SCRetentionCompliancePolicy 175c5292-d79f-4c00-8407-5608fc42052e
{
Comment = "Email van sleutel functionarissen worden permanent bewaard.
";
Credential = $Credscredential;
DynamicScopeLocation = @();
Enabled = $True;
Ensure = "Present";
ExchangeLocation = @();
ExchangeLocationException = @();
ModernGroupLocation = @();
ModernGroupLocationException = @();
Name = "Email - direct - sleutelfunctionarissen";
OneDriveLocation = @();
OneDriveLocationException = @();
PublicFolderLocation = @();
RestrictiveRetention = $False;
SharePointLocation = @();
SharePointLocationException = @();
SkypeLocation = @();
SkypeLocationException = @();
}
SCRetentionComplianceRule 2ca8c73f-8b8f-441d-b221-9a3761a58bee
{
Comment = "";
ContentMatchQuery = "received>=1-1-2022 and sent>=1-1-2022";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctaptr-f3d7dc34-562d-44ca-bd79-54c59f06440d";
Policy = "Email - direct - 10 weken label zetten";
RetentionComplianceAction = "Delete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 7e3224e9-f003-4486-8eb5-6f8f06e198a1
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-8cc57b6e-440d-4fc0-897a-cbdc8f0d66f3";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "KeepAndDelete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 67f8b2fb-2863-4041-aab3-701edd97859c
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-733f2e3a-573b-412c-9939-7c998a4f663f";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "Delete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 71ee3e8b-a2c1-4264-a899-531a97fe2130
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-13c413a3-7813-4304-b2c3-8a0b001ba595";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "Delete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule f34ad0b2-1d09-414f-b997-cbfae95a346b
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-e94409cc-d050-4c97-9784-be7ced38f24d";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "KeepAndDelete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 31fb91e1-41ed-413f-bcf5-6fa8836626fd
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-7b571f8d-04eb-4d92-a4d7-d604f55e8bb8";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "KeepAndDelete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 187d181c-5186-4d89-9004-af0dbde90823
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-b5d1236d-62f8-4153-9505-3ab17fbf8399";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "KeepAndDelete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 345e72cd-1b9c-4940-b658-0b0c8711edd6
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-5d685223-2200-4d70-a29b-dc2d2dd73202";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "KeepAndDelete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 0d00076e-deb3-4693-9b65-bae9c935b535
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-81e0665f-6771-4708-b301-df48c7d890da";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "Delete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule cb383e93-97af-4eca-929b-af0d5b1f3488
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-59cb0c08-86a2-4a9d-97e8-1348d2374639";
Policy = "File retention OneDrive and SharePoint";
RetentionComplianceAction = "Delete";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 06c84ff6-56d2-4ec2-a40b-12e02caaedce
{
Comment = "";
ContentMatchQuery = "";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctptr-85016c6b-8158-4d3f-a092-66d8eed8af04";
Policy = "Email retentie Exchange Online";
RetentionComplianceAction = "Keep";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule f083cfde-58ba-4d81-9573-cb3d7c9df94b
{
Comment = "";
Credential = $Credscredential;
Ensure = "Present";
ExpirationDateOption = "CreationAgeInDays";
Name = "Teams channel messages + chats - Users";
Policy = "Teams channel messages + chats - Users";
RetentionComplianceAction = "KeepAndDelete";
RetentionDuration = "3650";
RetentionDurationDisplayHint = "Days";
}
SCRetentionComplianceRule 1ba584c1-84da-4269-be9c-7902fe20fdd0
{
Comment = "";
ContentMatchQuery = "received>=1-1-2022 and Sent>=1-1-2022";
Credential = $Credscredential;
Ensure = "Present";
ExcludedItemClasses = @();
Name = "ctaptr-52942576-77da-4098-a844-553e3b224483";
Policy = "Email - direct - sleutelfunctionarissen";
RetentionComplianceAction = "Keep";
RetentionDurationDisplayHint = "Days";
}
SCRetentionEventType 76e9ebda-1e56-4a3d-a880-9b1ad19e2161
{
Comment = "Processes related to hiring, performance and termination of an employee.";
Credential = $Credscredential;
Ensure = "Present";
Name = "Employee activity";
}
SCRetentionEventType 0946476e-e826-47e1-ba7d-ff043d428840
{
Comment = "Expiration or termination of various executed contracts and agreements such as business contracts, leases, license agreements and contingent staff agreements.";
Credential = $Credscredential;
Ensure = "Present";
Name = "Expiration or termination of contracts and agreements";
}
SCRetentionEventType 22ea42c5-cd27-4a72-a748-a537c5f84121
{
Comment = "Processes related to last manufacturing date of products.";
Credential = $Credscredential;
Ensure = "Present";
Name = "Product lifetime";
}
SCSensitivityLabel 66bcf655-e15b-4d07-8250-6b9269c695c3
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = 'Deze gegevens zijn openbaar of mogen openbaar gemaakt worden.'
}
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#3A96DD'
}
);
Comment = "Deze gegevens zijn openbaar of mogen openbaar gemaakt worden.";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "Openbaar";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Openbaar'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Deze gegevens zijn openbaar of mogen openbaar gemaakt worden.'
}
)
}
);
Name = "Label-01";
Priority = 0;
Tooltip = "Deze gegevens zijn openbaar of mogen openbaar gemaakt worden.";
}
SCSensitivityLabel 216aadd2-93fd-476a-8e38-91164bb73a55
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = 'Niet openbare gegevens zonder expliciete rubricering – standaard label'
}
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#EAA300'
}
);
Comment = "Niet openbare gegevens zonder expliciete rubricering – standaard label";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "Niet openbaar";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Niet openbaar'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Niet openbare gegevens zonder expliciete rubricering – standaard label'
}
)
}
);
Name = "Label-02";
Priority = 1;
Tooltip = "Niet openbare gegevens zonder expliciete rubricering – standaard label";
}
SCSensitivityLabel 70628ed6-c5d9-45d3-bdb3-6e655b1c78c0
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = '**normally filled with text**'
}
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#A4262C'
}
);
Comment = "**normally filled with text**";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "Departementaal vertrouwelijk";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = '**normally filled with text**'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = '**normally filled with text**'
}
)
}
);
Name = "Label-03";
Priority = 2;
Tooltip = "**normally filled with text**";
}
SCSensitivityLabel c61b0c1f-0ed9-4553-a25a-7de26961b993
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'parentid'
Value = '59b0f1de-26f2-48db-955a-ddf08c932a33'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = 'Gegevens die indien kennisname door niet geautoriseerden schade kan toebrengen aan de belangen van één of meerdere ministeries.'
}
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#A4262C'
}
);
Comment = "Gegevens die indien kennisname door niet geautoriseerden schade kan toebrengen aan de belangen van één of meerdere ministeries.
Geen aanvullende restricties.";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "Geen restricties";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Geen restricties'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Gegevens die indien kennisname door niet geautoriseerden schade kan toebrengen aan de belangen van één of meerdere ministeries.'
}
)
}
);
Name = "Label-03A";
ParentId = "Label-03";
Priority = 3;
Tooltip = "Gegevens die indien kennisname door niet geautoriseerden schade kan toebrengen aan de belangen van één of meerdere ministeries.";
}
SCSensitivityLabel 7871aeeb-b21a-4922-8d7d-e26f063a3cbb
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'parentid'
Value = '59b0f1de-26f2-48db-955a-ddf08c932a33'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = 'Gegevens die indien kennisname door niet geautoriseerden schade kan toebrengen aan de belangen van één of meerdere ministeries.
Deelbaar binnen JenV.
Document wordt versleuteld.'
}
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#A4262C'
}
);
Comment = "**normally filled with text**";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "JenV intern";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'JenV intern'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = '**normally filled with text**'
}
)
}
);
Name = "Label-03B";
ParentId = "Label-03";
Priority = 4;
Tooltip = "**normally filled with text**";
}
SCSensitivityLabel 14c7ebe7-6257-4e9d-b00c-f08c77376355
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'parentid'
Value = '59b0f1de-26f2-48db-955a-ddf08c932a33'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = '**normally filled with text**'
}
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#A4262C'
}
);
Comment = "**normally filled with text**";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "Organisatie intern";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Organisatie intern'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = '**normally filled with text**'
}
)
}
);
Name = "Label-03C";
ParentId = "Label-03";
Priority = 5;
Tooltip = "**normally filled with text**";
}
SCSensitivityLabel 3a9b4b03-749f-4486-ac3a-94360d4e2f71
{
AdvancedSettings = @(
MSFT_SCLabelSetting
{
Key = 'color'
Value = '#A4262C'
}
MSFT_SCLabelSetting
{
Key = 'parentid'
Value = '59b0f1de-26f2-48db-955a-ddf08c932a33'
}
MSFT_SCLabelSetting
{
Key = 'contenttype'
Value = 'File Email Site UnifiedGroup'
}
MSFT_SCLabelSetting
{
Key = 'tooltip'
Value = '**normally filled with text**'
}
MSFT_SCLabelSetting
{
Key = 'isparent'
Value = 'False'
}
);
Comment = "**normally filled with text**";
Credential = $Credscredential;
Disabled = $False;
DisplayName = "Gelimiteerd tot groep";
Ensure = "Present";
LocaleSettings = @(
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'displayName'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = 'Gelimiteerd tot groep'
}
)
}
MSFT_SCLabelLocaleSettings
{
LocaleKey = 'tooltip'
LabelSettings = @(
MSFT_SCLabelSetting
{
Key = 'default'
Value = '**normally filled with text**'
}
)
}
);
Name = "Label-03D";
ParentId = "Label-03";
Priority = 6;
Tooltip = "**normally filled with text**";
}
}
}
SC-RWO-V1 -ConfigurationData .\ConfigurationData.psd1 -Credential $Credential |
|
Found the root cause of this issue. Working on a fix. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Details of the scenario you tried and the problem that is occurring
After compiling the labels and label policies the configuration fails if you want to import it without an adjustment.
When exporting it takes the GUID from the labelpolicy and keeps that, something that will be different when using in another or empty tenant
Verbose logs showing the problem
Suggested solution to the issue
converting the guid to name during export and to guid on import
The DSC configuration that is used to reproduce the issue (as detailed as possible)
The operating system the target node is running
OsName : Microsoft Windows 10 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture : 64 bits
WindowsVersion : 2009
WindowsBuildLabEx : 19041.1.amd64fre.vb_release.191206-1406
OsLanguage : nl-NL
OsMuiLanguages : {nl-NL}
Version of the DSC module that was used ('dev' if using current dev branch)
1.23.118.1
The text was updated successfully, but these errors were encountered: