Graph sensitivity labels seem frozen

Question

Graph sensitivity labels seem frozen

Luca Mitas 0

Since around 20 August, Microsoft Graph has served a frozen snapshot of my tenant's sensitivity labels and has not reflected a single change since, in any direction.

Labels created and published after that date never appear (404 on a single GET, and 400 labelNotFound on assignSensitivityLabel), a label I deleted in Purview is still returned as 200 seventeen hours later, and an edit to a label inside the snapshot never lands either.

Purview and Security & Compliance PowerShell show the correct state throughout (25 labels), while

/beta/security/informationProtection/sensitivityLabels returns 13,

and the GA

/v1.0/security/dataSecurityAndGovernance/sensitivityLabels returns 14, so there is no endpoint I can fall back to.

Propagation in this tenant was measured at about 55 minutes on 20 August, and the missing labels are now eight days old.

I have ruled out permissions, publication, policy sync status, label properties (a visible and an invisible label sit in the same policy and are identical property-for-property, differing only in creation date), creation route (portal-created labels are equally invisible), and identity: an app registered before the freeze, an app registered after it, and a delegated user token all receive the byte-identical stale snapshot, so this is tenant-wide rather than a per-principal cache.

Execute-AzureAdLabelSync completed cleanly and changed nothing.

Is there any tenant-side action that forces Graph to re-read the label store, is this a known failure mode, and does it self-heal? I have request IDs and exact timestamps available.

Thanks!

0 comments

1 answer

Your answer

Answer 1

The Graph API only works with labels that are published, and as the publishing process itself might take some time, it might explain the behavior you are seeing. While waiting over a week should be sufficient, it's not uncommon for policies to get stuck and need some nudging on the backend from support.

Make sure all the labels you are interested in are part of a policy, and double-check said policy status via PowerShell (do note the DistributionStatus property only shows the actual status when querying policies individually). You can also try the diagnostics in the Purview portal (https://purview.microsoft.com/informationprotection/diagnostics).

Generally speaking, if you are performing admin operations against labels, you should use the portal or PowerShell for programmatic access. The API is not up to par on that. That said, if the changes are correctly reflected in PowerShell, they will reflect in clients as well.