Data-35016: Mandatory labeling enabled for sensitivity labels

[sandeepjha000]

Data-35016: adding test

[Copilot]

Pull request overview

This pull request adds a new security assessment test (ID: 35016) to verify that mandatory labeling is enabled for sensitivity labels across Microsoft 365 workloads (Outlook, Teams, SharePoint/Groups, and Power BI). The test retrieves enabled label policies, parses their settings to check for mandatory labeling flags across different workloads, and generates a comprehensive report showing the current configuration status.

Key changes:

• New PowerShell test script that queries label policies and evaluates mandatory labeling settings
• Documentation explaining the security rationale and remediation steps
• Support for checking mandatory labeling across four workloads with override detection

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/powershell/tests/Test-Assessment.35016.ps1	Implements the assessment logic to check sensitivity label policies for mandatory labeling configuration, including data collection, policy parsing, and markdown report generation
src/powershell/tests/Test-Assessment.35016.md	Provides comprehensive documentation explaining security risks of not having mandatory labeling and detailed remediation steps for each workload

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alexandair]

@sandeepjha000
I've added a commit to refactor test code to use XML parsing instead of regex. Could you test, please?

[sandeepjha000]

@sandeepjha000 I've added a commit to refactor test code to use XML parsing instead of regex. Could you test, please?

@alexandair - I am able to get the same test results. Thanks