Table of Contents
PowerShell is the Only Way to Create Policy Exclusions
In most cases, organizations want to publish sensitivity labels to all users. This makes sense because it means that everyone has access to the same set of sensitivity labels to protect content. The Microsoft Purview compliance portal makes the task easier by supporting the special All destination as a target for a sensitivity label policy, meaning that the policy includes all mailboxes. Alternatively, you can choose to publish labels to selected groups or individual users (Figure 1).
No GUI for Policy Exclusions
You might notice that the GUI for sensitivity label policy publication doesn’t support the exclusion of specific users (mailboxes) when a policy uses the special All destination. In other words, stop a few mailboxes from seeing the labels in applications like OWA and OneDrive for Business. For instance, you might want to publish organization-wide sensitivity labels to all mailboxes except those belonging to a certain department, possibly because no business reason exists for the personnel in that department to apply sensitivity labels to documents or messages.
It’s worth noting at this point that publication allows people to apply sensitivity labels to items. A user doesn’t need to be a target location in a label publishing policy to access content protected by sensitivity labels published by the policy. Any Microsoft 365 account can read content if the label protecting the content grants them the right to do so.
It’s curious that Purview doesn’t include the GUI to allow administrators to apply exclusions to sensitivity label policy. The equivalent GUI for retention label publishing policies includes exclusions, and although retention labels and sensitivity labels serve different purposes, managing their deployment is broadly similar.
Using PowerShell to Add Exclusions to a Sensitivity Label Policy
What’s also curious is that the PowerShell Set-LabelPolicy cmdlet can set exclusions for sensitivity label policies. For example, after connecting to the compliance endpoint, this command excludes the mailboxes of Terry Hegarty and Kim Akers from receiving the labels published in the specified policy:
Set-LabelPolicy -Identity "General Sensitivity Policy" -AddExchangeLocationException "Terry.Hegarty@Office365itpros.com", "Kim.Akers@office365itpros.com"
Get-LabelPolicy -Identity "General Sensitivity Policy" | Select-Object ExchangeLocationException
ExchangeLocationException
-------------------------
{Kim Akers, Terry Hegarty}
Adding a mailbox to a label publishing policy in this manner does not overwrite the set of excluded mailboxes. The exclusion of a mailbox from a label publishing policy doesn’t take effect immediately. Outlook clients must refresh their cache of information from the Information Protection service. When that happens, users won’t be able to apply the labels to new emails.
To remove an excluded mailbox, run Set-LabelPolicy and pass the mailbox name in the RemoveExchangeLocationException parameter.
Set-LabelPolicy -Identity "General Sensitivity Policy" -RemoveExchangeLocationException Kim.Akers
Processing Multiple Exclusions for Sensitivity Label Policies
Running the Set-LabelPolicy cmdlet to add more than a few excluded mailboxes can become tiresome. In these circumstances, it’s better to find the set of mailboxes using Get-ExoMailbox or another method (like reading the members of a distribution list) and pipe the set of mailboxes to Set-LabelPolicy.
For example, let’s assume that you want to exclude all the members of a department and that they’re all part of a distribution list. Finding the members of a distribution list is a well-trodden path and the Get-DistributionGroupMember cmdlet is what we need to use in this case. Adding all members of a distribution list is simple. First, extract the primary SMTP addresses for the members and store them in an array. Then, pass the array to Set-LabelPolicy. For example, this code extracts the user mailboxes from the membership of a distribution list and uses the array to create exclusions.
[array]$Members = Get-DistributionGroupMember -Identity "Planning Department" | Where-Object {$_.RecipientTypeDetails -eq "UserMailbox"} | Select-Object -ExpandProperty PrimarySmtpAddress
Set-LabelPolicy -Identity "General Sensitivity Policy" -AddExchangeLocationException $Members
Microsoft 365 Groups only support user mailboxes in their memberships, so you don’t have to filter the members from those groups.
Some formatting is necessary to make a long list of excluded mailboxes easy to read. Here’s what I normally do:
[array]$Exclusions = Get-LabelPolicy -Identity "General Sensitivity Policy" | Select-Object -ExpandProperty ExchangeLocationException $Exclusions.Name Andy.Ruth@office365itpros.com Kim.Akers@office365itpros.com Brian.Weakliam@office365itpros.com James.A.Abrahams@office365itpros.com Marc.Vigneau@office365itpros.com Terry.Hegarty@office365itpros.com Jane.Sixsmith@office365itpros.com Lotte.Vettler@office365itpros.com
It’s possible that Microsoft might update the compliance portal GUI to support the addition of exclusions for sensitivity label policies. In the interim, you can do it with PowerShell.
Learn about protecting Exchange Online and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.
Hi, I’m testing the exclusions, but if the label policy scope is set to “all” the exclision doesnt work, have you try this?
if the policy is set to All, then it means all, does it not?
Reading the MS Article on that PS command and it doesn’t appear to provide a way to report on mailboxes in the exclusion for auditing purposes (and other reasons). Do you know of a way?
is there a way to report on excluded mailboxes? The MS article on that PS command doesn’t appear to be possible.
Use the code that’s in the article: [array]$Exclusions = Get-LabelPolicy -Identity “General Sensitivity Policy” | Select-Object -ExpandProperty ExchangeLocationException
Loop through each policy, check if there are any exclusions, and if so, report them.