Action 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy' by User '<SNIP-PII>'

Anonymous

We have been receiving detections related to User Access Sensitivity Label Policy with actions stating these commands have been executed 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy'. The user.id associated with it is named '<SNIP-PII>'

As what I've understand it appears to be that the user's information that initiated this has been redacted. Am I understanding this correctly? I want some insights would be glad to know about it.

Thank you!

Anonymous

2024-10-07T01:23:03.93+00:00

@Anonymous Thanks for posting in our Q&A.

For this issue, it seems not related to intune. Based on my research, it seems more related to Security & Compliance PowerShell. To get more help, I will add "PowerShell" tag. Hope someone else will share some information.

Thanks for your understanding.

Share via

Action 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy' by User '<SNIP-PII>'

Your answer