topic How to remove Sensitivity Label - What permission/role do i need to be able to use the API in Developer

How to remove Sensitivity Label - What permission/role do i need to be able to use the API

StevenVF — Fri, 11 Aug 2023 03:10:55 GMT

Hi, Hoping someone knows the answer.

I have a dataset/report in the service that has a sensitiviy label set, they person who created the dataset has since left and now when trying to open it you recieve the following message:

I have read https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-sensitivity-label-troubleshooting

this says in my circumstance you can remove the sensitivity label using the admin API.

I currenlty have the Faric Administrator role so i am able is use said API, however it returns the following (i've hashed the ids out):
{
"reports": [
{
"id": "###############",
"status": "InsufficientUsageRights"
}
],
"datasets": [
{
"id": "###############",
"status": "InsufficientUsageRights"
}
]
}

My question is what rights do i need to have to be able to remove the labels and where do you grant this? I'm assuming is some sort of office 365 role?

Any help would be greatly appreciated.

Re: How to remove Sensitivity Label - What permission/role do i need to be able to use the API

Anonymous — Tue, 15 Aug 2023 08:20:46 GMT

Hi StevenVF ,

According to the error message, it seems that you didn't have the sufficient privilege to remove the sensitive label. As the following official documentation referred, the following permissions are necessary when you call REST API Admin - InformationProtection RemoveLabelsAsAdmin. Please check and confirm you have these permissions...

Can't set or remove sensitivity labels using Power BI REST admin APIs

Users must have administrator rights (such as Microsoft 365 global administrator or Fabric administrator) to call these APIs.

The admin user (and the delegated user, if provided) must have sufficient usage rights to set or remove labels.

In addition, if no user has even these usage rights, nobody will be able to change or remove the label from the item, and access to the item is potentially endangered. To avoid this situation, the Power BI admin can enable the Allow workspace admins to override automatically applied sensitivity labels (preview) tenant setting. This makes it possible for workspace admins to override automatically applied sensitivity labels without regard to label change enforcement rules. To enable this setting, go to: Admin portal > Tenant settings > Information protection.

Relaxations to accommodate automatic labeling scenarios

Best Regards

Re: How to remove Sensitivity Label - What permission/role do i need to be able to use the API

StevenVF — Thu, 17 Aug 2023 02:39:28 GMT

Thanks for the reply

Yes, that is correct, i do not have the sufficient privilege to remove the sensitive label. My question is what specific right do i need to have to be able to do this. I had looked at the usage rights page you linked but was unsure what i need to ask my office 365 global admin to apply to my user.

I see this one has the right to remove protection, so i assume it's what i would need to have?

Common name: Full Control

Encoding in policy: OWNER

Grants all rights to the document and all available actions can be performed.

Includes the ability to remove protection and reprotect a document.

Note that this usage right is not the same as the Rights Management owner.

Office custom rights: As the Full Control custom option.

Name in the Azure classic portal: Full Control

Name in the Microsoft Purview compliance portal and Azure portal: Full Control (OWNER)

Name in AD RMS templates: Full Control

API constant or value:
MSIPC: IPC_GENERIC_ALL L"OWNER"
MIP SDK: OWNER

Also, my tenant settings seem to be slightly different to what you posted, i did look at this and tried it prior to this post but it did not allow be to change anything. Mine states automatically applied labels by Fabric, your just says protection labels:

Not sure why they are different.