Skip to content

Commit 286f839

Browse files
SagarSatheSagarSathe
authored
Merge pull request #729 from alexandair/alex-35005
35005 - Add test for sensitivity labels in SharePoint Online assessment
2 parents 0887b00 + 0a35e24 commit 286f839

File tree

3 files changed

+204
-0
lines changed

3 files changed

+204
-0
lines changed

‎code-tests/test-assessments/Test-Assessment.35005.Tests.ps1‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
Describe "Test-Assessment-35005" {
2+
BeforeAll {
3+
$here = $PSScriptRoot
4+
$srcRoot = Join-Path $here "../../src/powershell"
5+
6+
# Mock external module dependencies if they are not present
7+
if (-not (Get-Command Write-PSFMessage -ErrorAction SilentlyContinue)) {
8+
function Write-PSFMessage {}
9+
}
10+
if (-not (Get-Command Get-SPOTenant -ErrorAction SilentlyContinue)) {
11+
function Get-SPOTenant {}
12+
}
13+
14+
# Load the class
15+
$classPath = Join-Path $srcRoot "classes/ZtTest.ps1"
16+
if (-not ("ZtTest" -as [type])) {
17+
. $classPath
18+
}
19+
20+
# Load the SUT
21+
$sut = Join-Path $srcRoot "tests/Test-Assessment.35005.ps1"
22+
. $sut
23+
24+
# Setup output file
25+
$script:outputFile = Join-Path $here "../TestResults/Report-Test-Assessment.35005.md"
26+
$outputDir = Split-Path $script:outputFile
27+
if (-not (Test-Path $outputDir)) { New-Item -ItemType Directory -Path $outputDir | Out-Null }
28+
"# Test Results for 35005`n" | Set-Content $script:outputFile
29+
}
30+
31+
# Mock common module functions
32+
BeforeEach {
33+
Mock Write-PSFMessage {}
34+
Mock Write-ZtProgress {}
35+
}
36+
37+
Context "When querying SharePoint tenant settings fails" {
38+
It "Should return Investigate status" {
39+
Mock Get-SPOTenant { throw "Connection error" }
40+
Mock Add-ZtTestResultDetail {
41+
param($TestId, $Title, $Status, $Result)
42+
"## Scenario: Error querying settings`n`n$Result`n" | Add-Content $script:outputFile
43+
}
44+
45+
Test-Assessment-35005
46+
47+
Should -Invoke Add-ZtTestResultDetail -ParameterFilter {
48+
$Status -eq $false -and $Result -match "Unable to query SharePoint Tenant Settings"
49+
}
50+
}
51+
}
52+
53+
Context "When EnableAIPIntegration is disabled" {
54+
It "Should fail" {
55+
Mock Get-SPOTenant {
56+
return [PSCustomObject]@{
57+
EnableAIPIntegration = $false
58+
}
59+
}
60+
Mock Add-ZtTestResultDetail {
61+
param($TestId, $Title, $Status, $Result)
62+
"## Scenario: EnableAIPIntegration disabled`n`n$Result`n" | Add-Content $script:outputFile
63+
}
64+
65+
Test-Assessment-35005
66+
67+
Should -Invoke Add-ZtTestResultDetail -ParameterFilter {
68+
$Status -eq $false -and
69+
$Result -match "Sensitivity labels are NOT enabled" -and
70+
$Result -match "EnableAIPIntegration: False"
71+
}
72+
}
73+
}
74+
75+
Context "When EnableAIPIntegration is enabled" {
76+
It "Should pass" {
77+
Mock Get-SPOTenant {
78+
return [PSCustomObject]@{
79+
EnableAIPIntegration = $true
80+
}
81+
}
82+
Mock Add-ZtTestResultDetail {
83+
param($TestId, $Title, $Status, $Result)
84+
"## Scenario: EnableAIPIntegration enabled`n`n$Result`n" | Add-Content $script:outputFile
85+
}
86+
87+
Test-Assessment-35005
88+
89+
Should -Invoke Add-ZtTestResultDetail -ParameterFilter {
90+
$Status -eq $true -and
91+
$Result -match "Sensitivity labels are enabled" -and
92+
$Result -match "EnableAIPIntegration: True"
93+
}
94+
}
95+
}
96+
}

‎src/powershell/tests/Test-Assessment.35005.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
SharePoint Online and OneDrive for Business require explicit enablement of sensitivity label integration to allow users to apply Microsoft Information Protection labels to files stored in these services. When `EnableAIPIntegration` is disabled, organizations lose the ability to classify and protect documents at rest in their primary collaboration platform. The content is opaque to SharePoint capabilities and Purview services like eDiscovery is not available.
2+
3+
**Remediation action**
4+
5+
To enable sensitivity labels in SharePoint Online:
6+
1. Connect to SharePoint Online: `Connect-SPOService -Url https://<tenant>-admin.sharepoint.com`
7+
2. Enable sensitivity labels: `Set-SPOTenant -EnableAIPIntegration $true`
8+
3. Wait up to 24 hours for propagation across all sites
9+
4. Verify users can apply labels in Office for the web and desktop apps
10+
11+
- [Enable sensitivity labels for Office files in SharePoint and OneDrive](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files)
12+
- [Sensitivity labels in SharePoint and OneDrive](https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files)
13+
14+
<!--- Results --->
15+
%TestResult%

‎src/powershell/tests/Test-Assessment.35005.ps1‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
<#
2+
.SYNOPSIS
3+
Sensitivity Labels Enabled in SharePoint Online
4+
5+
.DESCRIPTION
6+
SharePoint Online and OneDrive for Business require explicit enablement of sensitivity label integration to allow users to apply Microsoft Information Protection labels to files stored in these services. When EnableAIPIntegration is disabled, organizations lose the ability to classify and protect documents at rest in their primary collaboration platform. The contant is opaque to SharePoint capabilities and Purview services like eDiscovery is not available.
7+
8+
.NOTES
9+
Test ID: 35005
10+
Pillar: Data
11+
Risk Level: High
12+
#>
13+
14+
function Test-Assessment-35005 {
15+
[ZtTest(
16+
Category = 'SharePoint Online',
17+
ImplementationCost = 'Low',
18+
MinimumLicense = ('MIP_P1'),
19+
Pillar = 'Data',
20+
RiskLevel = 'High',
21+
SfiPillar = '',
22+
TenantType = ('Workforce'),
23+
TestId = 35005,
24+
Title = 'Sensitivity Labels Enabled in SharePoint Online',
25+
UserImpact = 'Low'
26+
)]
27+
[CmdletBinding()]
28+
param()
29+
30+
#region Data Collection
31+
Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose
32+
33+
$activity = 'Checking Sensitivity Labels in SharePoint Online'
34+
Write-ZtProgress -Activity $activity -Status 'Getting SharePoint Tenant Settings'
35+
36+
$spoTenant = $null
37+
$errorMsg = $null
38+
39+
try {
40+
# Query: Retrieve SharePoint Online tenant sensitivity label integration status
41+
$spoTenant = Get-SPOTenant -ErrorAction Stop
42+
}
43+
catch {
44+
$errorMsg = $_
45+
Write-PSFMessage "Error querying SharePoint Tenant Settings: $_" -Level Error
46+
}
47+
#endregion Data Collection
48+
49+
#region Assessment Logic
50+
if ($errorMsg) {
51+
$passed = $false
52+
}
53+
else {
54+
if ($null -ne $spoTenant -and $spoTenant.EnableAIPIntegration -eq $true) {
55+
$passed = $true
56+
}
57+
else {
58+
$passed = $false
59+
}
60+
}
61+
#endregion Assessment Logic
62+
63+
#region Report Generation
64+
if ($errorMsg) {
65+
$testResultMarkdown = "### Investigate`n`n"
66+
$testResultMarkdown += "Unable to query SharePoint Tenant Settings due to error: $errorMsg"
67+
}
68+
else {
69+
if ($passed) {
70+
$testResultMarkdown = "✅ Sensitivity labels are enabled in SharePoint Online and OneDrive, allowing users to classify and protect documents stored in these services.`n`n"
71+
}
72+
else {
73+
$testResultMarkdown = "❌ Sensitivity labels are NOT enabled in SharePoint Online and OneDrive. Documents cannot be labeled or protected with encryption/access controls.`n`n"
74+
}
75+
76+
$testResultMarkdown += "### SharePoint Online Configuration Summary`n`n"
77+
$testResultMarkdown += "**Tenant Settings:**`n"
78+
79+
$enableAIPIntegration = if ($spoTenant.EnableAIPIntegration) { "True" } else { "False" }
80+
$testResultMarkdown += "* EnableAIPIntegration: $enableAIPIntegration`n"
81+
82+
$testResultMarkdown += "`n[Manage Information protection in SharePoint Admin Center](https://admin.microsoft.com/sharepoint?page=classicSettings&modern=true)`n"
83+
}
84+
#endregion Report Generation
85+
86+
$params = @{
87+
TestId = '35005'
88+
Title = 'Sensitivity Labels Enabled in SharePoint Online'
89+
Status = $passed
90+
Result = $testResultMarkdown
91+
}
92+
Add-ZtTestResultDetail @params
93+
}

0 commit comments

Comments
 (0)