SensitivityLabels.Read.All | Graph Permissions

Permission Details

Application Permission

Get labels tenant scope.

Allows the app to get sensitivity labels.

Permission ID: e46a01e9-b2cf-4d89-8424-bcdc6dd445ab

Delegated Permission

Get labels app scope.

Allows the app to get sensitivity labels.

Permission ID: 8b377c27-ea19-4863-a948-8a8588c8f2c3

Properties

Microsoft Graph v1.0 endpoint-derived-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property	Type	Description
`alerts`	`alert collection`
`alerts_v2`	`security.alert collection`	A collection of alerts in Microsoft 365 Defender.
`attackSimulation`	`object`
`cases`	`object`
`dataSecurityAndGovernance`	`object`
`id`	`string`	The unique identifier for an entity. Read-only.
`identities`	`object`	A container for security identities APIs.
`incidents`	`security.incident collection`	A collection of incidents in Microsoft 365 Defender, each of which is a set of correlated alerts and associated metadata that reflects the story of an attack.
`labels`	`object`
`secureScoreControlProfiles`	`secureScoreControlProfile collection`
`secureScores`	`secureScore collection`
`subjectRightsRequests`	`subjectRightsRequest collection`
`threatIntelligence`	`object`
`triggers`	`object`
`triggerTypes`	`object`

JSON Representation

Microsoft Graph v1.0 endpoint-derived-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation

{}

Relationships

Microsoft Graph v1.0 endpoint-derived-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship	Type	Description
`alerts`	`alert collection`	Read-only. Nullable.
`alertsv2`	`security.alert collection`	A collection of alerts in Microsoft 365 Defender.
`data security and compliance`	`tenantDataSecurityAndGovernance`	A container for Microsoft Purview data security and compliance APIs.
`identities`	`security.identityContainer`	A container for security identities APIs.
`incidents`	`security.incident collection`	A collection of incidents in Microsoft 365 Defender, each of which is a set of correlated alerts and associated metadata that reflects the story of an attack.
`alerts_v2`	`security.alert collection`	A collection of alerts in Microsoft 365 Defender.
`secureScoreControlProfiles`	`secureScoreControlProfile collection`	Related secureScoreControlProfiles data exposed by this resource.
`secureScores`	`secureScore collection`	Related secureScores data exposed by this resource.
`subjectRightsRequests`	`subjectRightsRequest collection`	Related subjectRightsRequests data exposed by this resource.
`cloudAppSecurityProfiles`	`cloudAppSecurityProfile collection`	Related cloudAppSecurityProfiles data exposed by this resource.
`domainSecurityProfiles`	`domainSecurityProfile collection`	Related domainSecurityProfiles data exposed by this resource.
`fileSecurityProfiles`	`fileSecurityProfile collection`	Related fileSecurityProfiles data exposed by this resource.
`hostSecurityProfiles`	`hostSecurityProfile collection`	Related hostSecurityProfiles data exposed by this resource.
`incidentTasks`	`security.incidentTask collection`	A collection of tasks associated with security incidents.
`ipSecurityProfiles`	`ipSecurityProfile collection`	Related ipSecurityProfiles data exposed by this resource.
`providerTenantSettings`	`providerTenantSetting collection`	Related providerTenantSettings data exposed by this resource.
`securityActions`	`securityAction collection`	Related securityActions data exposed by this resource.
`tiIndicators`	`tiIndicator collection`	Related tiIndicators data exposed by this resource.
`userSecurityProfiles`	`userSecurityProfile collection`	Related userSecurityProfiles data exposed by this resource.
`zones`	`security.zone collection`	A collection of cloud zones in Microsoft Defender for Cloud that group and manage cloud environments across multiple cloud providers.

Graph Methods

Delegated access App-only access

Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/security/dataSecurityAndGovernance/sensitivityLabels`
GET `/security/dataSecurityAndGovernance/sensitivityLabels/{labelId}`
GET `/security/dataSecurityAndGovernance/sensitivityLabels/{labelId}/rights`

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/security/dataSecurityAndGovernance/sensitivityLabels`
GET `/security/dataSecurityAndGovernance/sensitivityLabels/{labelId}`
GET `/security/dataSecurityAndGovernance/sensitivityLabels/{labelId}/rights`

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgSecurityDataSecurityAndGovernanceSensitivityLabel` /security/dataSecurityAndGovernance/sensitivityLabels List sensitivityLabels
`Get-MgSecurityDataSecurityAndGovernanceSensitivityLabel` /security/dataSecurityAndGovernance/sensitivityLabels/{labelId} Get sensitivityLabel
`Get-MgSecurityDataSecurityAndGovernanceSensitivityLabelRight` /security/dataSecurityAndGovernance/sensitivityLabels/{labelId}/rights Get usageRightsIncluded

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgBetaSecurityDataSecurityAndGovernanceSensitivityLabel` /security/dataSecurityAndGovernance/sensitivityLabels List sensitivityLabels
`Get-MgBetaSecurityDataSecurityAndGovernanceSensitivityLabel` /security/dataSecurityAndGovernance/sensitivityLabels/{labelId} Get sensitivityLabel
`Get-MgBetaSecurityDataSecurityAndGovernanceSensitivityLabelRight` /security/dataSecurityAndGovernance/sensitivityLabels/{labelId}/rights Get usageRightsIncluded

Code Examples

C# / .NET SDK

Get sensitivityLabel

View official example on Microsoft Learn

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.DataSecurityAndGovernance.SensitivityLabels["{sensitivityLabel-id}"].GetAsync((requestConfiguration) =>
{
	requestConfiguration.Headers.Add("Authorization", "Bearer {token}");
	requestConfiguration.Headers.Add("Client-Request-Id", "a0b9c8d7-e6f5-a4b3-c2d1-e0f9a8b7c6d5");
});

JavaScript

Get sensitivityLabel

View official example on Microsoft Learn

const options = {
	authProvider,
};

const client = Client.init(options);

let sensitivityLabel = await client.api('/security/dataSecurityAndGovernance/sensitivityLabels/4e4234dd-377b-42a3-935b-0e42f138fa23')
	.header('Authorization','Bearer {token}')
	.header('Client-Request-Id','a0b9c8d7-e6f5-a4b3-c2d1-e0f9a8b7c6d5')
	.get();

PowerShell

Get sensitivityLabel

View official example on Microsoft Learn

Import-Module Microsoft.Graph.Security

Get-MgSecurityDataSecurityAndGovernanceSensitivityLabel -SensitivityLabelId $sensitivityLabelId

Python

Get sensitivityLabel

View official example on Microsoft Learn

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.security.data_security_and_governance.sensitivity_labels.item.sensitivity_label_item_request_builder import SensitivityLabelItemRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

request_configuration = RequestConfiguration()
request_configuration.headers.add("Authorization", "Bearer {token}")
request_configuration.headers.add("Client-Request-Id", "a0b9c8d7-e6f5-a4b3-c2d1-e0f9a8b7c6d5")

result = await graph_client.security.data_security_and_governance.sensitivity_labels.by_sensitivity_label_id('sensitivityLabel-id').get(request_configuration = request_configuration)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for SensitivityLabels.Read.All

4

Grant Admin Consent

Application permissions always require admin consent.