[Feature Request]: Replace sensitivity label encryption domain with tenant default domain

[martisog]

Please confirm:

• I have searched existing feature requests (open and closed) and found no duplicates.
• **Me or my organization is currently an active sponsor of the product at the $99,- level.

Problem Statement

Creating a Sensitivty label template from existing label that contains permission assignment makes it impossible to publish to other tenants, as it gets assigned to the tenant domain.

I have a script that can change this, but that means i have to log in to powershell for every tenant and run it.
added the script below.
Would be nice if a Standard could set this permission by default when publishing the Labels.

Benefits for MSPs

Less work, better control when publishing

Value or Importance

When publishing labels to several tenants, this would increase our efficiency.

PowerShell Commands (Optional)

$LabelName = "Konfidensielt - Internt"

$Rights = @(
"VIEW"
"VIEWRIGHTSDATA"
"DOCEDIT"
"EDIT"
"PRINT"
"EXTRACT"
"REPLY"
"REPLYALL"
"FORWARD"
"OBJMODEL"
) -join ","

Koble til Exchange Online dersom du ikke allerede er tilkoblet

Connect-ExchangeOnline

Koble til Security & Compliance PowerShell

Connect-IPPSSession

Kontroller at etiketten finnes

$Label = Get-Label -Identity $LabelName -ErrorAction Stop

Hent tenantens standarddomene

$TenantDomain = Get-AcceptedDomain |
Where-Object { $_.Default -eq $true } |
Select-Object -First 1 -ExpandProperty DomainName

$TenantDomain = $TenantDomain.ToString()

if ([string]::IsNullOrWhiteSpace($TenantDomain)) {
throw "Fant ikke tenantens standarddomene via Get-AcceptedDomain."
}

Write-Host "Etikett: $($Label.DisplayName)" -ForegroundColor Cyan
Write-Host "Tilgang gis til: $TenantDomain" -ForegroundColor Cyan

Microsoft forventer formatet:

identity:right1,right2,right3

$RightsDefinition = "${TenantDomain}:$Rights"

Oppdater krypteringen på etiketten

Set-Label -Identity $Label.Guid
-EncryptionEnabled $true -EncryptionProtectionType Template
-EncryptionRightsDefinitions $RightsDefinition -EncryptionContentExpiredOnDateInDaysOrNever "Never"
-EncryptionOfflineAccessDays 30 -Confirm:$false
-ErrorAction Stop

Write-Host "Etiketten ble oppdatert." -ForegroundColor Green

Verifiser encrypt-action direkte fra LabelActions

$UpdatedLabel = Get-Label -Identity $Label.Guid

$EncryptAction = $UpdatedLabel.LabelActions |
ForEach-Object {
try {
$_ | ConvertFrom-Json -ErrorAction Stop
}
catch {
Write-Warning "Kunne ikke tolke en LabelAction som JSON."
}
} |
Where-Object { $_.Type -eq "encrypt" }

if (-not $EncryptAction) {
throw "Fant ingen encrypt-action etter oppdateringen."
}

$RightsSetting = $EncryptAction.Settings |
Where-Object { $_.Key -eq "rightsdefinitions" }

Write-Host "`nRegistrert rightsdefinitions:" -ForegroundColor Green
$RightsSetting.Value