Sensitivity Lables - Allow a Team (AD-group) to Remove

[Alisea_MI]

Hi, Community!

A developer in our team has applied sensitivity labels on the data sources and she seems to be the only person to be able to remove them. Me, as a global Power BI Admin is not allowed to remove it. It referres me to some admin. 

A question: how can we change this setting to allow the whole developer team to be able to remove the label?

The documentation states: " If you're not able to change a sensitivity label, consider asking the person who originally applied the label to make the change. You can also contact the Microsoft 365/Office security administrator and request the necessary usage rights for the label."

Is it really person-bound? What do we do, when the person leaves?

• Is there any change in the Power BI settings I can change to provide the whole team with the possibility to remove? All the sensitivity lables settings are allowed for the whole organization on our end.
• If it's the Microsoft 365/Office security administrato does it, does anyone know, where / what exactly should be changed there, so that I can request it from the other team?
  
  Many thanx in advance!

[Anonymous · Accepted solution]

Hi @Alisea_MI 

Firstly, it's important to clarify that sensitivity label management can indeed be person-bound to an extent, but there are administrative capabilities that allow for broader management across the organization. To allow your entire developer team the ability to remove sensitivity labels, you would need to ensure that the members of the team are assigned at least one of the following usage rights to the sensitivity label in the Microsoft Purview compliance portal: OWNER, EXPORT, or EDIT and EDITRIGHTSDATA. These rights will enable authorized users to change or remove sensitivity labels applied.

Here's a concise action plan to achieve this:

1. Identify the Sensitivity Labels: Determine which sensitivity labels are applied that your team needs access to change or remove.
2. Assign Usage Rights: In the Microsoft Purview compliance portal, navigate to Classification > Sensitivity labels. Here, you can manage the sensitivity labels and assign the necessary usage rights (OWNER, EXPORT, EDIT, and EDITRIGHTSDATA) to your developer team. This might require creating or modifying an existing label policy to include your developer team as authorized users.

The key action is to adjust the usage rights for the sensitivity labels as mentioned above. This is something your Microsoft 365/Office security administrator can assist with. This cannot be changed in Power BI Settings. 

Reference: Configure usage rights for Azure Information Protection (AIP)

In addition, as a global Power BI Admin, you can use Power BI admin REST APIs to set and remove sensitivity labels on large numbers of Power BI artifacts programatically. See the following documentations. This also requires that you have sufficient usage rights to delete labels. 

Set or remove sensitivity labels programmatically with admin APIs

Admin - InformationProtection RemoveLabelsAsAdmin

Other documentations that may be helpful:

Apply encryption using sensitivity labels

Configure super users for Azure Rights Management - AIP

Remove labels using the Azure Information Protection unified labeling client

Best Regards,
Jing
If this post helps, please Accept it as Solution to help other members find it. Appreciate your Kudos!