Sensitivity Label Coverage of Groups & Sites

The question it answers: Which teams, Microsoft 365 groups and SharePoint sites have no sensitivity label, and which labels are in use?

Container sensitivity labels decide privacy, guest access and unmanaged-device access for a team, group or site - and they are what Copilot and DLP policies key on. Every container without a label is governed by defaults alone. Public groups without a label are listed first.

Note

If no container has a label, labels for groups and sites are probably not enabled in the tenant - see the group settings report (EnableMIPLabels). A site label that shows as an id is not used on any group, so its name is unknown here.

At a glance

Where in the app	SharePoint Online › Sharing & Governance › Label Coverage
Workload	Compliance
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Microsoft 365 E3 / Business Premium (or Azure Information Protection P1) for container labels; labels must be enabled for groups (EnableMIPLabels).
Report id (API and MCP)	sharepoint.governance.label-coverage

Columns

Column	Key	Type
Name	Name	Link
Type	Kind	Status
Privacy	Visibility	Text
Label	Label	Status
Created	Created	Date

Filters

Filter	Key (API)	On when the page opens
Only containers without a label	unlabelled	Yes

What it needs

Licence: Microsoft 365 E3 / Business Premium (or Azure Information Protection P1) for container labels; labels must be enabled for groups (EnableMIPLabels).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Group.Read.All	Microsoft Graph	Read all groups
Sites.FullControl.All	Office 365 SharePoint Online	Have full control of all site collections	application, certificate

Data sources it reads

• GET /v1.0/groups?$filter=groupTypes/any(c:c eq 'Unified')&$select=assignedLabels
• Get-PnPTenantSite -Detailed (SensitivityLabel)

Through the API and MCP

GET /ir-api/v1/reports/sharepoint.governance.label-coverage?size=100
GET /ir-api/v1/reports/sharepoint.governance.label-coverage?filter=unlabelled

An AI assistant reads it with the MCP tool get_report and the id sharepoint.governance.label-coverage. The client needs the Read grant for Compliance. See Using the API.