Purview sensitivity label

Question

A review of historical SharePoint reporting, SharePoint Change History, and Microsoft Purview audit data identified that site privacy values changing between Private and Public. The available audit events point to Microsoft 365 Group and sensitivity-label processing, but we have not yet determined the specific initiating change or actor.

Answer 1

A sensitivity label scoped to Groups & sites can replace and lock a Microsoft 365 group or SharePoint site’s privacy as Public or Private, so correlate each privacy transition with the preceding label change in both Microsoft Purview and Microsoft Entra audit logs.

Expected label behavior

For a container label configured with:

• Public: anyone in the organization can access the container.
• Private: access is restricted to approved members.
• None: the label does not control privacy.

Applying a label configured as Public or Private replaces the container’s previous privacy value and locks it. The privacy value can then be changed only by first removing the label; after removal, the label’s last privacy setting remains until somebody changes it. For a group-connected Team, the same label is automatically applied to the Microsoft 365 group and connected SharePoint site.^1^

This means that a SharePoint privacy change can be a downstream result of:

1. A label being applied, changed, or removed from the Microsoft 365 group or Team.
2. A site owner or administrator changing the site label.
3. A later service synchronization that enforces the label’s configured privacy.

The audit entry showing the final privacy update might therefore identify a Microsoft service rather than the person who initiated the earlier label change.

Complete the audit correlation

For each Private/Public transition, build a short timeline around the SharePoint Change History timestamp.

1. In Microsoft Purview portal → Audit, search the affected site URL and Microsoft 365 group over a time window covering several minutes before and after the transition.
2. Include these sensitivity-label operations:
   • SiteSensitivityLabelApplied
   • SiteSensitivityLabelChanged
   • SiteSensitivityLabelRemoved
3. Also include group operations, especially:
   • UpdateGroup.
   • Group creation or owner/member changes if they coincide with the event.

Purview documents SiteSensitivityLabelChanged as applying a different label to a site. For group-connected Teams and sites, sensitivity-label activity is audited with Microsoft Entra group management rather than only as a SharePoint site-label event.^2^

4. Select Export results → Download all results.
5. Parse the JSON in the CSV’s AuditData column. The export contains additional properties that might not appear in the Audit UI; Power Query’s JSON transform can split these into filterable columns.^3^
6. For each relevant record, preserve and compare:
   • Timestamp
   • Operation
   • User or service identity
   • Workload and record type
   • Site URL or group/object identifier
   • Old and new label identifiers, when present
   • Modified properties and old/new values, when present
   • Correlation or request identifiers, when present

Do not treat a service identity on the final SharePoint update as the initiating actor without checking the immediately preceding group or label event.

Check Microsoft Entra directly

Open Microsoft Entra admin center → Identity → Monitoring & health → Audit logs, filter to the affected Microsoft 365 group, and inspect group-update events at the same timestamp. Entra audit logs capture changes to groups and can identify who or what initiated a directory operation.^4^

For each matching event, inspect:

• Initiated by: user or application/service principal
• Target resources: the affected group
• Modified properties: old and new values
• Correlation ID
• Activity date and result

Correlate the records in this order:

user/admin label action → Entra group update → SharePoint privacy update

If the Entra record is initiated by a service, continue backward to the earliest related label or group-management event. Some backend write-backs can appear under Microsoft Substrate Management; Microsoft describes these as informational synchronization operations, not necessarily the original human action.^4^

Resolve label IDs and verify configuration

Check the current site label under SharePoint admin center → Active sites → select site → Policies → Sensitivity. Then review that label in Purview and verify its Groups & sites → Privacy setting.^1^

If an audit record exposes only a label GUID, connect to Security & Compliance PowerShell and resolve it:

$labelId = "<label-GUID-from-audit-record>"

Get-Label -Identity $labelId |
    Select-Object Name, Guid, Priority

Microsoft documents Get-Label as the method for mapping sensitivity-label GUIDs to names.^5^

If the relevant Purview or Entra records are no longer retained, the historical reports alone cannot reliably identify the original actor. Preserve the available exports and timestamps, then open a Microsoft support case with the site URL, group object identifier, UTC transition times, label GUIDs, AuditData records, and correlation IDs.

---

References

1. Use sensitivity labels to protect collaborative workspaces (groups and sites)
2. Audit log activities
3. Detailed activity properties in the audit log
4. What are Microsoft Entra audit logs?
5. Configure a default sensitivity label for a SharePoint document library