Commands › Exchange Online

New-AutoSensitivityLabelPolicy

Exchange Online ExchangeOnlineManagement New-*

For more information, see Security & Compliance PowerShell. Use the New-AutoSensitivityLabelPolicy cmdlet to create auto-labeling policies in your organization. Create auto-labeling policy rules using the New-AutoSensitivityLabelRule cmdlet and associate them with the policy to complete the policy creation.

Quick start script

# New-AutoSensitivityLabelPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-AutoSensitivityLabelPolicy
$before | Format-List

# 3. Make the change (dry run first)
New-AutoSensitivityLabelPolicy -Name <String> -ApplySensitivityLabel <String> -WhatIf
New-AutoSensitivityLabelPolicy -Name <String> -ApplySensitivityLabel <String>

# 4. Verify and diff
$after = Get-AutoSensitivityLabelPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-AutoSensitivityLabelPolicy [-Name] <String> -ApplySensitivityLabel <String>
 [-ApplySensitivityLabelOverwriteWorkloads <Workload>]
 [-Comment <String>]
 [-Confirm]
 [-ExceptIfOneDriveSharedBy <RecipientIdParameter[]>]
 [-ExceptIfOneDriveSharedByMemberOf <RecipientIdParameter[]>]
 [-ExchangeAdaptiveScopes <MultiValuedProperty>]
 [-ExchangeAdaptiveScopesException <MultiValuedProperty>]
 [-ExchangeLocation <MultiValuedProperty>]
 [-ExchangeSender <SmtpAddress[]>]
 [-ExchangeSenderException <SmtpAddress[]>]
 [-ExchangeSenderMemberOf <SmtpAddress[]>]
 [-ExchangeSenderMemberOfException <SmtpAddress[]>]
 [-ExternalMailRightsManagementOwner <SmtpAddress>]
 [-Force]
 [-Locations <String>]
 [-Mode <PolicyMode>]
 [-OneDriveAdaptiveScopes <MultiValuedProperty>]
 [-OneDriveAdaptiveScopesException <MultiValuedProperty>]
 [-OneDriveLocation <MultiValuedProperty>]
 [-OneDriveLocationException <MultiValuedProperty>]
 [-OneDriveSharedBy <RecipientIdParameter[]>]
 [-OneDriveSharedByMemberOf <RecipientIdParameter[]>]
 [-OverwriteLabel <Boolean>]
 [-PolicyRBACScopes <MultiValuedProperty>]
 [-PolicyTemplateInfo <PswsHashtable>]
 [-Priority <System.Int32>]
 [-RemoveLabel]
 [-SharePointAdaptiveScopes <MultiValuedProperty>]
 [-SharePointAdaptiveScopesException <MultiValuedProperty>]
 [-SharePointLocation <MultiValuedProperty>]
 [-SharePointLocationException <MultiValuedProperty>]
 [-UnifiedAuditLogEnabled <Boolean>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (35)

Parameter	Type	Required	What it controls
-Name	String	yes	The Name parameter specifies a unique name for the auto-labeling policy. If the value contains spaces, enclose the value with quotation marks (").
-ApplySensitivityLabel	String	yes	The ApplySensitivityLabel parameter specifies the label to use for the auto-labeling policy.
-ApplySensitivityLabelOverwriteWorkloads	Workload		{{ Fill ApplySensitivityLabelOverwriteWorkloads Description }}
-Comment	String		The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks ("), for example: "This is an admin note".
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-ExceptIfOneDriveSharedBy	RecipientIdParameter[]		The ExceptIfOneDriveSharedBy parameter specifies the users to exclude from the policy (the sites of the OneDrive user accounts are included in the policy). You identify the users by UPN (`laura@contoso.onmicrosoft.com`).
-ExceptIfOneDriveSharedByMemberOf	RecipientIdParameter[]		{{ Fill ExceptIfOneDriveSharedByMemberOf Description }}
-ExchangeAdaptiveScopes	MultiValuedProperty		{{ Fill ExchangeAdaptiveScopes Description }}
-ExchangeAdaptiveScopesException	MultiValuedProperty		{{ Fill ExchangeAdaptiveScopesException Description }}
-ExchangeLocation	MultiValuedProperty		The ExchangeLocation parameter specifies whether to include email messages in the policy. The valid value for this parameter is All. If you don't want to include email messages in the policy, don't use this parameter...
-ExchangeSender	SmtpAddress[]		The ExchangeSender parameter specifies the users whose email is included in the policy. You identify the users by email address. You can specify internal or external email addresses.
-ExchangeSenderException	SmtpAddress[]		The ExchangeSenderException parameter specifies the internal users whose email is excluded from the policy. You identify the users by email address.
-ExchangeSenderMemberOf	SmtpAddress[]		The ExchangeSenderMemberOf parameter specifies the distribution groups or mail-enabled security groups to include in the policy (email of the group members is included in the policy). You identify the groups by email address.
-ExchangeSenderMemberOfException	SmtpAddress[]		The ExchangeSenderMemberOfException parameter specifies the distribution groups or mail-enabled security groups to exclude from the policy (email of the group members is excluded from the policy). You identify the...
-ExternalMailRightsManagementOwner	SmtpAddress		The ExternalMailRightsManagementOwner parameter specifies the email address of a user mailbox that's used to encrypt incoming email messages from external senders using RMS.
-Force	SwitchParameter		The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-Locations	String		{{ Fill Locations Description }}
-Mode	PolicyMode		The Mode parameter specifies the action and notification level of the auto-labeling policy. Valid values are:
-OneDriveAdaptiveScopes	MultiValuedProperty		{{ Fill OneDriveAdaptiveScopes Description }}
-OneDriveAdaptiveScopesException	MultiValuedProperty		{{ Fill OneDriveAdaptiveScopesException Description }}
-OneDriveLocation	MultiValuedProperty		The OneDriveLocation parameter specifies the OneDrive sites to include in the policy. You identify the site by its URL value, or you can use the value All to include all sites.
-OneDriveLocationException	MultiValuedProperty		This parameter specifies the OneDrive sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.
-OneDriveSharedBy	RecipientIdParameter[]		The OneDriveSharedBy parameter specifies the users to include in the policy (the sites of the OneDrive user accounts are included in the policy). You identify the users by UPN (`laura@contoso.onmicrosoft.com`).
-OneDriveSharedByMemberOf	RecipientIdParameter[]		{{ Fill OneDriveSharedByMemberOf Description }}
-OverwriteLabel	Boolean		The OverwriteLabel parameter specifies whether to overwrite a manual label. Valid values are:
-PolicyRBACScopes	MultiValuedProperty		The PolicyRBACScopes parameter specifies the administrative units to assign to the policy. A valid value is the Microsoft Entra ObjectID (GUID value) of the administrative unit. You can specify multiple values...
-PolicyTemplateInfo	PswsHashtable		This parameter is reserved for internal Microsoft use.
-Priority	Int32		The Priority parameter specifies the priority of the policy. The highest priority policy takes precedence over lower priority policies if two policies are applicable for a file.
-RemoveLabel	SwitchParameter		{{ Fill RemoveLabel Description }}
-SharePointAdaptiveScopes	MultiValuedProperty		{{ Fill SharePointAdaptiveScopes Description }}
-SharePointAdaptiveScopesException	MultiValuedProperty		{{ Fill SharePointAdaptiveScopesException Description }}
-SharePointLocation	MultiValuedProperty		The SharePointLocation parameter specifies the SharePoint sites to include in the policy. You identify the site by its URL value, or you can use the value All to include all sites.
-SharePointLocationException	MultiValuedProperty		This parameter specifies the SharePoint sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
-UnifiedAuditLogEnabled	Boolean		{{ Fill UnifiedAuditLogEnabled Description }}
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.