Yes i was using 7.4. I tested the new script “Checking Groups for Label Changes”

“”Fetching Microsoft Groups”” thats all it says now doesn’t give result like previous did.

Thanks

So it seems like PowerShell doesn’t like the guid typing in the comparison, which works well with PowerShell 5.1. I changed the code and everything works for PowerShell 7.4.

What version of PowerShell are you using?

InvalidArgument: /M365/detect change.ps1:5:8
Line |
5 | If ([guid]$Group.SensitivityLabel.Guid -ne [guid]$Group.CustomAttr …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot convert null to type “System.Guid”.
InvalidArgument: /M365/detect change.ps1:5:8
Line |
5 | If ([guid]$Group.SensitivityLabel.Guid -ne [guid]$Group.CustomAttr …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot convert null to type “System.Guid”.
InvalidArgument: /M365/detect change.ps1:5:8
Line |
5 | If ([guid]$Group.SensitivityLabel.Guid -ne [guid]$Group.CustomAttr …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot convert null to type “System.Guid”.

Any idea why we keep getting this guid error

It’s not possible to stop group owners changing the sensitivity label. Owners have full control over their team/group.

The code to revert a label is in the article.

Thanks for this post. We have realised that it is not possible to restrict team owner from changing the sensitivity label. Please correct me if am wrong on that.

Also how do I apply this if restricting is not possible.

Check and revert. This is the hard-line approach. The original label is the label and group owners aren’t allowed to change it, so the original label is reapplied.

I don’t. But it’s PowerShell and you can use the Get-SPOSite cmdlet to get the sensitivity label data and check if it changes.

It takes time for the synchronization of a label change (made in Teams or OWA) to reach SharePoint Online. I believe the expected period is up to 24 hours. During that time, SPO will display an incorrect label. If this is important, go and change the label in the SPO admin center.

Have you had a thought about misclassification from the Team creation and the underlying SharePoint site? When a Team is created with a container label the SharePoint site is also applied with the same label. But changing the classification of the Team the SharePoint site doesn’t follow.

If you created the Team with say an external label to allow guests etc then change it to an Internal label. The guest would still have full access to the underlying SharePoint site as long as they are not removed from the Unified Group.
If removed from the group they would lose the access but the SharePoint site is still open to guests.

I find it strange that when you change a classification on the Team the underpinning Site doesn’t follow.

What are your thoughts on this?

Many Thanks

Lance