While working with Microsoft 365 Sensitivity labels, you often realize that the key to using them successfully is the end-user experience. The default user experience for labels is to list them in a long list within the applications. When they select the label to use, they will then see an extensive list, often making it more complicated to choose. Think for a moment if you have twenty sensitivity label published into policies for users.

Go a step further, and what about slight deviation labels? So, for example, you want to have “Highly Restrictive” but need three different versions of that depending on the audience or controls you need to use.

As you can see, both these scenarios using the out-of-the-box approach would result in extensive lists of labels. An example could be the following:

  • Public
  • Internal (Encrypted)
  • Internal (No Encryption)
  • Confidential (Internal)
  • Confidential (External)
  • Highly Restrictive
  • Highly Restrictive (Encrypted)
  • Highly Restrictive (No Encryption)
  • Highly Restrictive (Internal)
  • Highly Restrictive (External)

The question for the end-user is, what label do I choose? The question for us as Administrators is how do I improve the user experience?

Both are valid questions, and though I cannot answer them perfectly, as their answer is a business decision, I can show you how to nest labels to make the structure easier to understand and not display down the page like the list above.

For this to work, we will be using PowerShell. To get started, first install and import the Exchange Online Management PowerShell module.

Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

Next, we need to connect to PowerShell’s Security and Compliance features.

Connect-IPPSSession

Now we will create our first or primary label and call it “Parent Label” then, we will add a secondary or child labels.

$hrname = "HighlyRestrictive"
$hrdescription = "Highly Restrictive Created Using PowerShell"
$hrdisplayname = "Highly Restrictive"
$hrtooltip = "Highly Restrictive Tooltip"

$hrlabel = New-Label `
		-DisplayName $hrdisplayname `
		-Name $hrname `
		-Comment $hrdescription `
		-Tooltip $hrtooltip

Now we can create the “Child” labels; however, they will be separate independent labels to start.

# Create Highly Restrictive (Internal)
$hriname = "HighlyRestrictiveInternal"
$hridescription = "Highly Restrictive Internal Created Using PowerShell"
$hridisplayname = "Highly Restrictive Internal"
$hritooltip = "Highly Restrictive Internal Tooltip"

$hrilabel = New-Label `
		-DisplayName $hridisplayname `
		-Name $hriname `
		-Comment $hridescription `
		-Tooltip $hritooltip


# Create Highly Restrictive (External)
$hrename = "HighlyRestrictiveExternal"
$hredescription = "Highly Restrictive External Created Using PowerShell"
$hredisplayname = "Highly Restrictive External"
$hretooltip = "Highly Restrictive External Tooltip"

$hrelabel = New-Label `
		-DisplayName $hredisplayname `
		-Name $hrename `
		-Comment $hredescription `
		-Tooltip $hretooltip


# Create Highly Restrictive (No Protection)
$hrnpname = "HighlyRestrictiveNoProtection"
$hrnpdescription = "Highly Restrictive No Protection Created Using PowerShell"
$hrnpdisplayname = "Highly Restrictive No Protection Label"
$hrnptooltip = "Highly Restrictive No Protection Tooltip"

$hrnplabel = New-Label `
		-DisplayName $hrnpdisplayname `
		-Name $hrnpname `
		-Comment $hrnpdescription `
		-Tooltip $hrnptooltip

When viewing the labels within the information protection center, you can see them as independent labels.

Our last step is to structure the “Child” or “Sub-labels” underneath our parent.

Our last step is to structure the “Child” or “Sub-labels” underneath our parent. We retrieve the parent labels identifier, then utilize “Set-Label” for each of the child labels and update its property called “ParentId” to the parent label. Luckily, when creating the labels, we populated parent variables for each one so we could reuse these.

$hrilabel | Set-Label -ParentId $hrlabel.ExchangeObjectId
$hrelabel | Set-Label -ParentId $hrlabel.ExchangeObjectId
$hrnplabel | Set-Label -ParentId $hrlabel.ExchangeObjectId

If we now view the labels, you can see they are nested, making it a little easier to view and utilize the labels.

If you needed to add further, you could repeat the process. You can also update any of the labels with controls as needed (notice we did not assign those during creation). To update the controls for a label you can use something like this:

Set-Label `
	-Identity $hrilabel.Id `
	-LabelActions '{
		"Type":"applywatermarking",
		"SubType":null,
		"Settings":[
			{"Key":"fontsize","Value":"10"},
			{"Key":"layout","Value":"Diagonal"},
			{"Key":"fontcolor","Value":"#000000"},
			{"Key":"disabled","Value":"false"},
			{"Key":"text","Value":"Highly Restrictive (Internal)"}
		]}'

As you can see, using this approach, you logically group labels to create a better user experience for those that will classify content.