Data-35017: Default label configured for sensitivity labels

[aahmed-spec]

No description provided.

[Copilot]

Pull request overview

This pull request adds a new assessment test (Test-Assessment-35017) that validates whether sensitivity label policies have default labels configured for various Microsoft 365 workloads. The test checks for default label configuration across documents/emails, Outlook, Power BI, and SharePoint/Microsoft 365 Groups, helping organizations ensure consistent baseline data classification.

Changes:

• Adds Test-Assessment.35017.ps1 with logic to assess default label configuration across multiple workloads
• Adds Test-Assessment.35017.md with remediation guidance for configuring default sensitivity labels
• Introduces Get-LabelPolicySettings.ps1 as a shared helper function for parsing sensitivity label policy XML settings, designed for reuse across multiple tests (35016, 35017, etc.)

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/powershell/tests/Test-Assessment.35017.ps1	Main test function that retrieves enabled label policies, validates default label IDs, determines policy scope, and generates detailed reports with pass/fail status
src/powershell/tests/Test-Assessment.35017.md	Documentation explaining the importance of default labels, remediation steps, and Microsoft Learn reference links
src/powershell/private/tests-shared/Get-LabelPolicySettings.ps1	Shared helper function that parses PolicySettingsBlob XML to extract default label settings and mandatory labeling configurations for multiple workloads

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alexandair]

@aahmed-spec Please, address my feedback.

[alexandair]

This helper function is an overkill. We don't need the whole function for checking if the label ID is valid GUID.
This is enough:

        $guid = [System.Guid]::Empty
        return [System.Guid]::TryParse($VALUEWEARECHECKING, [ref]$guid)

That code already cover cases when value is $null or empty string:

PS> $labelid = $null
PS>         $guid = [System.Guid]::Empty
PS>         return [System.Guid]::TryParse($LabelId, [ref]$guid)
False

PS> $labelid = ''
PS>         $guid = [System.Guid]::Empty
PS>         return [System.Guid]::TryParse($LabelId, [ref]$guid)
False

[aahmed-spec]

@alexandair I have made the changes, let me know if it looks good.