How do I obtain encryption permissions for a sensitivity label programmatically?

Rahul Verma 20

Hello,

I used this endpoint to retrieve sensitivity label information for a tenant. It returned the labels alongside their associated label actions. However, I am unsure how to access the permissions enforced by the "encrypt with template" label action. Is there a way to retrieve this information?

Smaran Thoomu 15,685 Reputation points Microsoft Vendor

2024-09-11T19:19:40.24+00:00
Hi @Rahul Verma
Thanks for reaching out to Microsoft Q&A.
To obtain encryption permissions for a sensitivity label programmatically, you can use the Microsoft Graph API. Here are the steps you can follow:

Get the ID of the sensitivity label you want to retrieve encryption permissions for. You can use the endpoint you mentioned in your question to retrieve the sensitivity label ID.

Use the following endpoint to retrieve the label actions for the sensitivity label:

GET https://graph.microsoft.com/v1.0/security/sensitivityLabels/{labelId}/labelActions

Replace {labelId} with the ID of the sensitivity label you want to retrieve label actions for.

Look for the label action with the name "Encrypt with template". This label action enforces encryption permissions for the sensitivity label.

Retrieve the permissions for the "Encrypt with template" label action using the following endpoint:

GET https://graph.microsoft.com/v1.0/security/sensitivityLabels/{labelId}/labelActions/{labelActionId}/permissions

Replace {labelId} with the ID of the sensitivity label and {labelActionId} with the ID of the "Encrypt with template" label action.

This endpoint will return a list of permissions that are enforced by the "Encrypt with template" label action, such as "Read", "Write", "Create", and "Delete".

I hope this helps! Let me know if you have any further questions.To obtain encryption permissions for a sensitivity label programmatically, you can use the Microsoft Graph API. Here are the steps you can follow:

Get the ID of the sensitivity label you want to retrieve encryption permissions for. You can use the endpoint you mentioned in your question to retrieve the sensitivity label ID.

Use the following endpoint to retrieve the label actions for the sensitivity label:

GET https://graph.microsoft.com/v1.0/security/sensitivityLabels/{labelId}/labelActions

Replace {labelId} with the ID of the sensitivity label you want to retrieve label actions for.

Look for the label action with the name "Encrypt with template". This label action enforces encryption permissions for the sensitivity label.

Retrieve the permissions for the "Encrypt with template" label action using the following endpoint:

GET https://graph.microsoft.com/v1.0/security/sensitivityLabels/{labelId}/labelActions/{labelActionId}/permissions

Replace {labelId} with the ID of the sensitivity label and {labelActionId} with the ID of the "Encrypt with template" label action.

This endpoint will return a list of permissions that are enforced by the "Encrypt with template" label action, such as "Read", "Write", "Create", and "Delete".

I hope this helps! Let me know if you have any further questions.
Rahul Verma 20 Reputation points

2024-09-11T21:48:47.48+00:00
Hi @Smaran Thoomu

Thank you for reaching out,

In regards to the end point you have provided

GET https://graph.microsoft.com/v1.0/security/sensitivityLabels/{labelId}/labelActions

I am unable to access or reach it whenever I try to query the endpoint through Graph Explorer I get a Bad Request response,

{ "error": { "code": "BadRequest", "message": "Resource not found for the segment 'sensitivityLabels'.", "innerError": { "date": "", "request-id": "", "client-request-id": "" } } }

Even if I try in C#, there is no property/method that relates to this endpoint,

var result = await graphClient.Security.SensitivityLabels.labelId.labelActions;

The error that results is this:

'SecurityRequestBuilder' does not contain a definition for 'SensitivityLabels' and no accessible extension method 'SensitivityLabels' accepting a first argument of type 'SecurityRequestBuilder' could be found (are you missing a using directive or an assembly reference?)CS1061

I was wondering if there's any documentation to the endpoint you have supplied?

Again thanks for the reply it means a lot!

Accepted answer

Yakun Huang-MSFT 4,565 Reputation points Microsoft Vendor

2024-09-12T02:48:47.59+00:00

Hi @Rahul Verma

After searching, only the following methods are provided for accessing sensitive tags through the Graph API, this functionality is not currently available for access the permissions enforced by the "encrypt with template" label action, you can provide feedback here.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How do I obtain encryption permissions for a sensitivity label programmatically?

0 additional answers

Your answer