Data-35018: Downgrade Justification Required for Sensitivity Labels

src/powershell/tests/Test-Assessment.35018.md

@@ -0,0 +1,23 @@
+When sensitivity label policies do not require users to provide justification when removing or downgrading labels, users can silently reduce the classification level of sensitive content without creating an audit trail explaining why. This creates a compliance and audit risk because organizations lose visibility into intentional label downgrades that may indicate inappropriate access to sensitive data. 
+
+When a user removes a "Confidential" label and replaces it with "Internal" or no label at all, organizations should require explicit justification to create an audit record of this action. Downgrade justification is a lightweight control that increases accountability for label decisions without significantly impacting user workflows. 
+
+When justification is not required, compromised user accounts or departing employees could systematically downgrade labels on sensitive documents to enable data exfiltration, leaving no clear audit trail of the unauthorized changes. Configuring downgrade justification requirements on sensitivity label policies ensures that any intentional reduction in classification level is logged with a user-provided business reason, supporting both compliance audits and insider threat investigations. Downgrade justification should be configured alongside other label controls (mandatory labeling, default labels, and mandatory enforcement) to create a comprehensive data governance framework.
+
+**Remediation action**
+1. Navigate to [Sensitivity label policies](https://purview.microsoft.com/informationprotection/labelpolicies) in Microsoft Purview
+2. Create or update a policy to enable downgrade justification requirement
+3. Enable: "Require users to provide justification to change a label"
+4. Define predefined justification reasons
+5. Set policy scope (global or specific groups)
+6. Verify audit logging is enabled
+7. Test with pilot users
+
+**Learn More:**
+- [Require users to provide justification to change a label](https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps#require-users-to-provide-justification-to-change-a-label)
+- [Create and publish sensitivity labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels)
+- [Plan your sensitivity label solution](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels#plan-for-sensitivity-labels)
+- [Search the audit log](https://learn.microsoft.com/en-us/purview/audit-log-search)
+
+<!--- Results --->
+%TestResult%

src/powershell/tests/Test-Assessment.35018.ps1

@@ -0,0 +1,182 @@
+<#
+.SYNOPSIS
+    Downgrade Justification Required for Sensitivity Labels
+
+.DESCRIPTION
+    Sensitivity label policies should require users to provide justification when removing or downgrading labels. When downgrade justification is not required, users can silently reduce the classification level of sensitive content without creating an audit trail, creating compliance and audit risks.
+
+.NOTES
+    Test ID: 35018
+    Pillar: Data
+    Risk Level: Medium
+#>
+
+function Test-Assessment-35018 {
+    [ZtTest(
+        Category = 'Information Protection',
+        ImplementationCost = 'Low',
+        MinimumLicense = ('Microsoft 365 E3'),
+        Pillar = 'Data',
+        RiskLevel = 'Medium',
+        SfiPillar = 'Protect tenants and production systems',
+        TenantType = ('Workforce'),
+        TestId = 35018,
+        Title = 'Downgrade Justification Required for Sensitivity Labels',
+        UserImpact = 'Medium'
+    )]
+    [CmdletBinding()]
+    param()
+
+    #region Data Collection
+    Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose
+
+    $enabledPolicies = @()
+    $errorMsg = $null
+
+    try {
+        $enabledPolicies = Get-LabelPolicy -ErrorAction Stop | Where-Object { $_.Enabled -eq $true }
+    }
+    catch {
+        $errorMsg = $_
+        Write-PSFMessage "Error querying label policies: $_" -Level Error
+    }
+    #endregion Data Collection
+
+    #region Assessment Logic
+    $policyResults = @()
+    $policiesWithDowngradeJustification = @()
+    $xmlParseErrors = @()
+    $passed = $false
+    $customStatus = $null
+
+    if ($errorMsg) {
+        $customStatus = 'Investigate'
+        $testResultMarkdown = "⚠️ Unable to determine downgrade justification status due to error: $errorMsg`n`n"
+    }
+    else {
+        foreach ($policy in $enabledPolicies) {
+
+            $requireDowngradeJustification = $false
+
+            if (-not [string]::IsNullOrWhiteSpace($policy.PolicySettingsBlob)) {
+                try {
+                    $xmlSettings = [xml]$policy.PolicySettingsBlob
+
+                    if ($xmlSettings.settings -and $xmlSettings.settings.setting) {
+                        foreach ($setting in $xmlSettings.settings.setting) {
+
+                            if (-not $setting.key -or -not $setting.value) { continue }
+
+                            if ($setting.key.ToLower() -eq 'requiredowngradejustification') {
+                                $requireDowngradeJustification = ($setting.value.ToLower() -eq 'true')
+                            }
+                        }
+                    }
+                }
+                catch {
+                    $xmlParseErrors += [PSCustomObject]@{
+                        PolicyName = $policy.Name
+                        Error      = $_.Exception.Message
+                    }
+                }
+            }
+
+            # Determine scope
+            $isGlobal =
+                ($policy.ExchangeLocation -match '^All$') -or
+                ($policy.ModernGroupLocation -match '^All$') -or
+                ($policy.SharePointLocation -match '^All$') -or
+                ($policy.OneDriveLocation -match '^All$') -or
+                ($policy.SkypeLocation -match '^All$') -or
+                ($policy.PublicFolderLocation -match '^All$')
+
+            # Determine workloads
+            $workloads = @()
+            if ($policy.ExchangeLocation)       { $workloads += 'Exchange' }
+            if ($policy.SharePointLocation)     { $workloads += 'SharePoint' }
+            if ($policy.OneDriveLocation)       { $workloads += 'OneDrive' }
+            if ($policy.ModernGroupLocation)    { $workloads += 'M365 Groups' }
+            if ($policy.PowerBILocation)        { $workloads += 'Power BI' }
+
+            $policyResult = [PSCustomObject]@{
+                PolicyName                    = $policy.Name
+                PolicyGuid                    = $policy.Guid
+                Enabled                       = $policy.Enabled
+                RequireDowngradeJustification = $requireDowngradeJustification
+                Scope                         = if ($isGlobal) { 'Global' } else { 'Scoped' }
+                LabelsCount                   = $policy.Labels.Count
+                Workloads                     = ($workloads -join ', ')
+            }
+
+            $policyResults += $policyResult
+
+            if ($requireDowngradeJustification) {
+                $policiesWithDowngradeJustification += $policyResult
+            }
+        }
+
+        if ($policiesWithDowngradeJustification.Count -gt 0) {
+            $passed = $true
+            $testResultMarkdown = "✅ Downgrade justification is enforced in at least one enabled sensitivity label policy.`n`n%TestResult%"
+        }
+        else {
+            $passed = $false
+            $testResultMarkdown = "❌ No enabled sensitivity label policies require downgrade justification.`n`n%TestResult%"
+        }
+    }
+    #endregion Assessment Logic
+
+    #region Report Generation
+    $mdInfo = "`n`n### Downgrade Justification Configuration`n"
+
+    if ($policyResults.Count -gt 0) {
+        $mdInfo += "| Policy name | Downgrade justification | Scope | Labels | Workloads |`n"
+        $mdInfo += "| :--- | :--- | :--- | :--- | :--- |`n"
+
+        foreach ($policy in $policyResults) {
+            $policyName = Get-SafeMarkdown -Text $policy.PolicyName
+            $policyUrl  = "https://purview.microsoft.com/informationprotection/labelpolicies/$($policy.PolicyGuid)"
+            $icon = if ($policy.RequireDowngradeJustification) { '✅' } else { '❌' }
+
+            $mdInfo += "| [$policyName]($policyUrl) | $icon | $($policy.Scope) | $($policy.LabelsCount) | $($policy.Workloads) |`n"
+        }
+
+        $percentage = if ($policyResults.Count -gt 0) {
+            [Math]::Round(($policiesWithDowngradeJustification.Count / $policyResults.Count) * 100, 2)
+        }
+        else { 0 }
+
+        $mdInfo += "`n### Summary`n"
+        $mdInfo += "| Metric | Count |`n"
+        $mdInfo += "| :--- | :--- |`n"
+        $mdInfo += "| Total enabled label policies | $($policyResults.Count) |`n"
+        $mdInfo += "| Policies requiring downgrade justification | $($policiesWithDowngradeJustification.Count) |`n"
+        $mdInfo += "| Policies NOT requiring downgrade justification | $($policyResults.Count - $policiesWithDowngradeJustification.Count) |`n"
+        $mdInfo += "| Percentage with downgrade justification | $percentage% |"
+    }
+
+    if ($xmlParseErrors.Count -gt 0) {
+        $mdInfo += "`n`n### ⚠️ XML Parsing Errors`n"
+        $mdInfo += "| Policy name | Error |`n"
+        $mdInfo += "| :--- | :--- |`n"
+        foreach ($err in $xmlParseErrors) {
+            $mdInfo += "| $(Get-SafeMarkdown $err.PolicyName) | $(Get-SafeMarkdown $err.Error) |`n"
+        }
+    }
+
+    $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
+    #endregion Report Generation
+
+    $params = @{
+        TestId = '35018'
+        Title  = 'Downgrade Justification Required for Sensitivity Labels'
+        Status = $passed
+        Result = $testResultMarkdown
+    }
+
+    if ($null -ne $customStatus) {
+        $params.CustomStatus = $customStatus
+    }
+
+    Add-ZtTestResultDetail @params
+}