Commands › Exchange Online
New-AutoSensitivityLabelRule
For more information, see Security & Compliance PowerShell. Use the New-AutoSensitivityLabelRule cmdlet to create auto-labeling rules and associate then with auto-labeling policies in your organization.
Quick start script
# New-AutoSensitivityLabelRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-AutoSensitivityLabelRule
$before | Format-List
# 3. Make the change (dry run first)
New-AutoSensitivityLabelRule -Name <String> -Workload <Workload> -Policy <PolicyIdParameter> -WhatIf
New-AutoSensitivityLabelRule -Name <String> -Workload <Workload> -Policy <PolicyIdParameter>
# 4. Verify and diff
$after = Get-AutoSensitivityLabelRule
Compare-Object ($before | Out-String) ($after | Out-String)Syntax
New-AutoSensitivityLabelRule [-Name] <String> -Policy <PolicyIdParameter> -Workload <Workload>
[-AccessScope <AccessScope>]
[-ActivationDate <System.DateTime>]
[-AdvancedRule <String>]
[-AnyOfRecipientAddressContainsWords <MultiValuedProperty>]
[-AnyOfRecipientAddressMatchesPatterns <MultiValuedProperty>]
[-Comment <String>]
[-Confirm]
[-ContentContainsSensitiveInformation <PswsHashtable[]>]
[-ContentExtensionMatchesWords <MultiValuedProperty>]
[-ContentPropertyContainsWords <MultiValuedProperty>]
[-Disabled <Boolean>]
[-DocumentCreatedBy <MultiValuedProperty>]
[-DocumentIsPasswordProtected <Boolean>]
[-DocumentIsUnsupported <Boolean>]
[-DocumentNameMatchesWords <MultiValuedProperty>]
[-DocumentSizeOver <Microsoft.Exchange.Data.ByteQuantifiedSize>]
[-ExceptIfAccessScope <AccessScope>]
[-ExceptIfAnyOfRecipientAddressContainsWords <MultiValuedProperty>]
[-ExceptIfAnyOfRecipientAddressMatchesPatterns <MultiValuedProperty>]
[-ExceptIfContentContainsSensitiveInformation <PswsHashtable[]>]
[-ExceptIfContentExtensionMatchesWords <MultiValuedProperty>]
[-ExceptIfContentPropertyContainsWords <MultiValuedProperty>]
[-ExceptIfDocumentCreatedBy <MultiValuedProperty>]
[-ExceptIfDocumentIsPasswordProtected <Boolean>]
[-ExceptIfDocumentIsUnsupported <Boolean>]
[-ExceptIfDocumentNameMatchesWords <MultiValuedProperty>]
[-ExceptIfDocumentSizeOver <Microsoft.Exchange.Data.ByteQuantifiedSize>]
[-ExceptIfFrom <RecipientIdParameter[]>]
[-ExceptIfFromAddressContainsWords <MultiValuedProperty>]
[-ExceptIfFromAddressMatchesPatterns <MultiValuedProperty>]
[-ExceptIfFromMemberOf <SmtpAddress[]>]
[-ExceptIfHeaderMatchesPatterns <PswsHashtable>]
[-ExceptIfProcessingLimitExceeded <Boolean>]
[-ExceptIfRecipientDomainIs <MultiValuedProperty>]
[-ExceptIfSenderDomainIs <MultiValuedProperty>]
[-ExceptIfSenderIPRanges <MultiValuedProperty>]
[-ExceptIfSentTo <MultiValuedProperty>]
[-ExceptIfSentToMemberOf <RecipientIdParameter[]>]
[-ExceptIfSubjectMatchesPatterns <MultiValuedProperty>]
[-ExpiryDate <System.DateTime>]
[-From <RecipientIdParameter[]>]
[-FromAddressContainsWords <MultiValuedProperty>]
[-FromAddressMatchesPatterns <MultiValuedProperty>]
[-FromMemberOf <SmtpAddress[]>]
[-HeaderMatchesPatterns <PswsHashtable>]
[-ImmutableId <System.Guid>]
[-Priority <System.Int32>]
[-ProcessingLimitExceeded <Boolean>]
[-RecipientDomainIs <MultiValuedProperty>]
[-ReportSeverityLevel <RuleSeverity>]
[-RuleErrorAction <PolicyRuleErrorAction>]
[-SenderDomainIs <MultiValuedProperty>]
[-SenderIPRanges <MultiValuedProperty>]
[-SentTo <MultiValuedProperty>]
[-SentToMemberOf <RecipientIdParameter[]>]
[-SourceType <String>]
[-SubjectMatchesPatterns <MultiValuedProperty>]
[-WhatIf]
[<CommonParameters>]Parameters (61)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -Name | String | yes | The Name parameter specifies a unique name for the auto-labeling policy rule. If the value contains spaces, enclose the value with quotation marks ("). |
| -Workload | Workload | yes | The Workload parameter specifies the workload. Valid values are: |
| -AccessScope | AccessScope | The AccessScope parameter specifies a condition for the auto-labeling policy rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope. Valid values are: | |
| -ActivationDate | DateTime | This parameter is reserved for internal Microsoft use. | |
| -AdvancedRule | String | {{ Fill AdvancedRule Description }} | |
| -AnyOfRecipientAddressContainsWords | MultiValuedProperty | The AnyOfRecipientAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words or phrases... | |
| -AnyOfRecipientAddressMatchesPatterns | MultiValuedProperty | The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions. You can specify... | |
| -Comment | String | The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks ("), for example: "This is an admin note". | |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -ContentContainsSensitiveInformation | PswsHashtable[] | The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive... | |
| -ContentExtensionMatchesWords | MultiValuedProperty | The ContentExtensionMatchesWords parameter specifies a condition for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas. | |
| -ContentPropertyContainsWords | MultiValuedProperty | The ContentPropertyContainsWords parameter specifies a condition for the auto-labeling policy rule that's based on a property match in content. The rule is applied to content that contains the specified property. | |
| -Disabled | Boolean | The Disabled parameter specifies whether the auto-labeling policy rule is enabled or disabled. Valid values are: | |
| -DocumentCreatedBy | MultiValuedProperty | {{ Fill DocumentCreatedBy Description }} | |
| -DocumentIsPasswordProtected | Boolean | The DocumentIsPasswordProtected parameter specifies a condition for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection... | |
| -DocumentIsUnsupported | Boolean | The DocumentIsUnsupported parameter specifies a condition for the auto-labeling policy rule that looks for files that can't be scanned. Valid values are: | |
| -DocumentNameMatchesWords | MultiValuedProperty | The DocumentNameMatchesWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in the name of message attachments. You can specify multiple words or phrases separated by commas. | |
| -DocumentSizeOver | ByteQuantifiedSize | The DocumentSizeOver parameter specifies a condition for the auto-labeling policy rule that looks for messages where any attachment is greater than the specified size. | |
| -ExceptIfAccessScope | AccessScope | The ExceptIfAccessScopeAccessScope parameter specifies an exception for the auto-labeling policy rule that's based on the access scope of the content. The rule isn't applied to content that matches the specified... | |
| -ExceptIfAnyOfRecipientAddressContainsWords | MultiValuedProperty | The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words separated... | |
| -ExceptIfAnyOfRecipientAddressMatchesPatterns | MultiValuedProperty | The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions. You can... | |
| -ExceptIfContentContainsSensitiveInformation | PswsHashtable[] | The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the auto-labeling policy rule that's based on a sensitive information type match in content. The rule isn't applied to content that... | |
| -ExceptIfContentExtensionMatchesWords | MultiValuedProperty | The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas. | |
| -ExceptIfContentPropertyContainsWords | MultiValuedProperty | The ExceptIfContentPropertyContainsWords parameter specifies an exception for the auto-labeling policy rule that's based on a property match in content. The rule is not applied to content that contains the specified property. | |
| -ExceptIfDocumentCreatedBy | MultiValuedProperty | {{ Fill ExceptIfDocumentCreatedBy Description }} | |
| -ExceptIfDocumentIsPasswordProtected | Boolean | The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password... | |
| -ExceptIfDocumentIsUnsupported | Boolean | The ExceptIfDocumentIsUnsupported parameter specifies an exception for the auto-labeling policy rule that looks for files that can't be scanned. Valid values are: | |
| -ExceptIfDocumentNameMatchesWords | MultiValuedProperty | The ExceptIfDocumentNameMatchesWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in the name of message attachments. You can specify multiple words or phrases... | |
| -ExceptIfDocumentSizeOver | ByteQuantifiedSize | The ExceptIfDocumentSizeOver parameter specifies an exception for the auto-labeling policy rule that looks for messages where any attachment is greater than the specified size. | |
| -ExceptIfFrom | RecipientIdParameter[] | The ExceptIfFrom parameter specifies an exception for the auto-labeling policy rule that looks for messages from specific senders. You can use any value that uniquely identifies the sender. For example: | |
| -ExceptIfFromAddressContainsWords | MultiValuedProperty | The ExceptIfFromAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases... | |
| -ExceptIfFromAddressMatchesPatterns | MultiValuedProperty | The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions. You can specify... | |
| -ExceptIfFromMemberOf | SmtpAddress[] | The ExceptIfFromMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent by group members. You identify the group members by their email addresses. | |
| -ExceptIfHeaderMatchesPatterns | PswsHashtable | The HeaderMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions. You can specify multiple text patterns by... | |
| -ExceptIfProcessingLimitExceeded | Boolean | The ExceptIfProcessingLimitExceeded parameter specifies an exception for the auto-labeling policy rule that looks for files where scanning couldn't complete. Valid values are: | |
| -ExceptIfRecipientDomainIs | MultiValuedProperty | The ExceptIfRecipientDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas. | |
| -ExceptIfSenderDomainIs | MultiValuedProperty | The ExceptIfSenderDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains. You can specify multiple values... | |
| -ExceptIfSenderIPRanges | MultiValuedProperty | The ExceptIfSenderIpRanges parameter specifies an exception for the auto-labeling policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges. Valid values are: | |
| -ExceptIfSentTo | MultiValuedProperty | The ExceptIfSentTo parameter specifies an exception for the auto-labeling policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient. For example: | |
| -ExceptIfSentToMemberOf | RecipientIdParameter[] | The ExceptIfSentToMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security... | |
| -ExceptIfSubjectMatchesPatterns | MultiValuedProperty | The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions. You can specify... | |
| -ExpiryDate | DateTime | This parameter is reserved for internal Microsoft use. | |
| -From | RecipientIdParameter[] | This parameter is reserved for internal Microsoft use. | |
| -FromAddressContainsWords | MultiValuedProperty | The FromAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas. | |
| -FromAddressMatchesPatterns | MultiValuedProperty | The FromAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions. You can specify multiple text... | |
| -FromMemberOf | SmtpAddress[] | This parameter is reserved for internal Microsoft use. | |
| -HeaderMatchesPatterns | PswsHashtable | The HeaderMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions. You can specify multiple text patterns by using... | |
| -ImmutableId | Guid | This parameter is reserved for internal Microsoft use. | |
| -Policy | PolicyIdParameter | yes | The Policy parameter specifies the auto-labeling policy that contains the auto-labeling policy rule. You can use any value that uniquely identifies the policy. For example: |
| -Priority | Int32 | This parameter is reserved for internal Microsoft use. | |
| -ProcessingLimitExceeded | Boolean | The ProcessingLimitExceeded parameter specifies a condition for the auto-labeling policy rule that looks for files where scanning couldn't complete. You can use this condition to create rules that work together to... | |
| -RecipientDomainIs | MultiValuedProperty | The RecipientDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas. | |
| -ReportSeverityLevel | RuleSeverity | The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule. Valid values are: | |
| -RuleErrorAction | PolicyRuleErrorAction | The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule. Valid values are: | |
| -SenderDomainIs | MultiValuedProperty | The SenderDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains. You can specify multiple values separated by commas. | |
| -SenderIPRanges | MultiValuedProperty | The SenderIpRanges parameter specifies a condition for the auto-sensitivity policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges. Valid values are: | |
| -SentTo | MultiValuedProperty | The SentTo parameter specifies a condition for the auto-sensitivity policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient. For example: | |
| -SentToMemberOf | RecipientIdParameter[] | The SentToMemberOf parameter specifies a condition for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You... | |
| -SourceType | String | {{ Fill SourceType Description }} | |
| -SubjectMatchesPatterns | MultiValuedProperty | The SubjectMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions. You can specify multiple text... | |
| -WhatIf | SwitchParameter | The WhatIf switch doesn't work in Security & Compliance PowerShell. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.