Help for flow with SPO site sensitivity label

[thetechguru]

Hello All,

Could someone please help in creating a flow as per below requirement:

We have site that has a sensitivity label assigned to it. So, the document created there has the same sensitivity level.

However, if someone tries to upload a document without any sensitivity label, the document should either go to his personal library, or give him an error or send an alert to admin

Any ideas would be helpful

@sharepoint  @OFFICE365 @securit

[abm]

Hi @thetechguru 

When does the sensitivity label assign to it. This is after the upload or before as  a meta data in a list?

Could you post a screenshot of this?

Thanks

[thetechguru]

@abmthank you for your response.

I am talking about the document which are not labelled and are uploaded to site that already has a label assigned..

[abm]

Hi @thetechguru 

Sorry still its not clear to me. Could you please share some screenshots?

[thetechguru]

no problem,

let me put this as:

if we have a SPO site that has been labeled with a sensitivity label: "Confidential" and the end user has a document that is labeled as: Normal.

If that user is trying to upload the "Normal" labeled document to the "Confidential" labeled SPO site, we want to send a notification to the end user and to the admin that there has been a Label mismatch hence restricting the upload of the document

@abm @v-bacao-msft 

[abm]

Hi @thetechguru 

Thanks for your reply. Could you please post a screen shot of your SharePoint list library or document library? 

Thanks

[thetechguru]

attached @abm 

[thetechguru]

so @abm  as you see users have added the normal labled document in confidential SPO site library, I am looking for a way to use Power Automate to set up an alert mechanism if that happens.

[abm]

Hi @thetechguru 

Thanks for your reply. Really helpful. 

Did you tried using the below action?

Next you could add an IF condition to check it's normal or confidential? You could then send an alert email or move to another document library. To find the personal document library you may need to look the createdby value from the file created properties.

Sharepoint Power Automate steps allows dynamic URL mappings (if you looking to move the file to construct personal document folders)

Thanks

[thetechguru]

thanks @abm  I haven't tried that though. but as I understand, for every separate site, we will have to create a separate flow?

[thetechguru]

@abm 

check this https://aka.ms/MIPC/Webinars/SPOLabelPerSite

watch it from 35:00 - 37:10

[abm]

Hi @thetechguru 

How many sites you got? If you relying on a trigger where a new record is created then you don't have any other options. If you change your trigger as scheduled then declare all the sites in an array. Iterate each site set the url dynamically and workout what files are added without label via Get items filter query. 

Thanks

[thetechguru]

@abmI am trying to create a flow that will match the sensitivity of the site to the document that is created /uploaded/modified in the library.

Under step 1 I have mentioned to check the sensitivity if not equal to CONFIDENTIAL. then take action to Move the file

to the current site but in a different library as STEP 2 and send an email to the site owner/GA/creator/modifier of the file as STEP 3

Now, I am not sure

1. Why I am getting that highlighted error: "Your flow was updated but is currently suspended since it uses a..."

I was able to run the flow earlier successfully though.

2. Right now I have mentioned manually the labeling "CONFIDENTIAL" in the flow, but can I make it dynamic? as in instead of creating different flows for different sites, can I put some identifier that will identify the sensitivity of the site under step 1?

if yes, could you please guide me how?

[abm]

Hi @thetechguru 

Thanks for your reply. Looks like you have got DLP (Data Loss Prevention Policies) implemented.

Have a look at below link

https://admin.flow.microsoft.com/environments

Thanks

[thetechguru]

is there any other way without disabling the DLPs?

and as mentioned in second point, would there be any way to assign something dynamic for the site? so that the admin does not have to create flow for every separate site?

@abm 

[abm]

Hi @thetechguru 

There are no workaround for DLP. 

Yes you can set the Dynamic value as SharePoint site. The only issue is it won't show the dynamic properties so that means you need to map all values as expressions. Generally in these situations what I do is first map a site then look the peed code under the settings option to identify the syntax of the dynamic mappings. Later remove the site and map with dynamic value.

Thanks

[thetechguru]

@abm 

sorry, but that was heavy... lol

I am not familiar with flows, would it be possible for you to show what you mentioned above if you get some time

[abm]

Hi @thetechguru 

Please check your email.

Thanks