Convert Labels to Sublabels

MS Purview Supports sublabels, or nested sensitivity labels. For the detailed explanation and use cases of the Sublabels, stay tuned for the upcoming article. In this article, I am going to show you how to convert labels to sublabels.

Why would we want to convert labels to sublabels ?

Here is a scenario: You have “Legal” and “R&D” labels; but now, your organization has decided that these should be sublabels of the newly created “Highly Confidential” label.

Once these labels are created, there is no way you can modify them to become sublabels. You can only create a sublabel and assign it to a Parent label when you are creating it. However, there is no option to assign a label to a Parent label.

I am going to show you how to accomplish this with PowerShell.

Install the ExchangeOnlineManagement Module if it's not installed:

Install-Module -Name ExchangeOnlineManagement -Force

Import the ExchangeOnlineManagement Module:

Import-Module ExchangeOnlineManagement -Force

Then connect to MS Purview:

Connect-IPPSSession

Get our sensitivity labels, first the the parent label, which is the “Highly Confidential”. Get the R&D Label. And then Legal Label.

$labelParent = Get-Label | Where-Object { $_.DisplayName -eq “Highly Confidential” }

$label2 = Get-Label | Where-Object { $_.DisplayName -eq “R D” }

$label = Get-Label | Where-Object { $_.DisplayName -eq “Legal” }

Next, extract the ImmutableId of each label – it will be used to tie it all together.

$label.ImmutableId
$label2.ImmutableId
$labelParent.ImmutableId

To assign a label to a parent, use the following command: Set-Label with a ParentId parameter. It will assign the label to a Parent Label.

We run this command for the “R&D” Label and then for “Legal” Label.

Set-Label -Identity "d49de6be-b792-4aeb-a3b3-7395c56e105a" -ParentId "b631ff93-110b-4875-b475-7ec1648e3d31"

Set-Label -Identity " 2379d880-51d8-4138-a7b5-1a5ab8d7dc2f" -ParentId "b631ff93-110b-4875-b475-7ec1648e3d31"

The effect of these commands is immediate – let’s take a look at the results.

I will retrieve all Labels and their following properties: Name, ImmutableId, ParentId

Get-Label | Format-Table Name, ImmutableId, ParentId

As you can see, our “R&D” and “Legal” labels both have a GUID in the ParentId column. This means that they are both sublabels. The ParentId shows that the parent is the 'Highly Confidential' label.

If you now switch to MS Purview (you will need to refresh your browser), you can see that the Highly Confidential label now has an icon that shows that it has nested labels.

Click on it to expand. You will see the “R&D” and the “Legal” Labels nested below. As you can see, the “R&D” and “Legal” Labels are now sublabels and Highly Confidential is a Parent Label.

After the labels were published to SharePoint, we can go to the document properties and take a look at the available Sensitivity Labels:

And here is how sublabels are presented to the end user in Microsoft Word:

If you made a mistake or simply do not want to use sublabels, you can use the following command: Set-Label -Identity and set ParentId to a null value.

Set-Label -Identity "d49de6be-b792-4aeb-a3b3-7395c56e105a" -ParentId $null

Set-Label -Identity "2379d880-51d8-4138-a7b5-1a5ab8d7dc2f" -ParentId $null

Execution of these commands takes effect immediately. If you inspect the available sensitivity labels, you will see that there is no longer ParentId for either of the labels.