With the new sensitivity labels, the management of the configuration changes a little bit. A lot of configuration options are not available in the Security Center. Right now, the AIP blade in the Azure Portal is the place where settings can be configured or viewed like:

  • Color of the labels
  • Label IDs
  • Color of the visual markings (header, footer and watermark)

To configure the labels by PowerShell Microsoft provided the documention: Set-Label and the others. As an example a Get-Label from my test tenant:

As you can see there is a lot configured at “LabelActions” parameter. But the documentation listed nothing about this parameter. After some googling I found this very good blog: https://blog.oholics.net/scripted-provisioning-of-office-365-unified-labels/ which describes in very detail how to configure your AIP settings complete with PowerShell.

If you have a label, the following commands will overwrite the LabelActions settings. Or you create a new label without any visual marking and add them by the commands.


Set-Label -Identity "Colored" -LabelActions 

You see the different settings you can configure:

  • fontSize
  • layout (Diagonal or Horizontal)
  • fontcolor (Hexcode)
  • text
  • disabled (true or false)

For the watermark the block start with ““Type”:”applywatermarking”,”SubType”:null,”Settings”:[” as there is no SubType like it is by the header and footer configuration. The square brackets contains then the other settings.

Header and Footer

For the header and footer the strcuture is nearly the same:

Set-Label -Identity "Colored" -LabelActions 

Here we have “applycontentmarking” and then we define with the subtype if we configure the footer or the header. For the header and footer we have more options:

  • margin
  • placement (not sure what this setting does)
  • alignment (left, middle, right)

If you choose a color which is not included in the default list of the SCC, the field will be blank: