autoSensitivityLabelRules

Auto-Labeling Rules. Content-match rules that drive auto-labeling decisions. The autoSensitivityLabelRules entity set lives under /exchange/v1.0/autoSensitivityLabelRules in the Governance & protection category.

Fact	Value
Path	/exchange/v1.0/autoSensitivityLabelRules
Category	Governance & protection
Tier	Tier 5, Compliance
Read role	Compliance.IPPS.Read.All (Community)
Write role	Compliance.IPPS.ReadWrite.All (Enterprise)
Backing cmdlets	Get-AutoSensitivityLabelRule, Set-AutoSensitivityLabelRule, New-AutoSensitivityLabelRule, Remove-AutoSensitivityLabelRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/autoSensitivityLabelRules	List auto-sensitivity label rules - content-condition rules attached to an autoSensitivityLabelPolicy. Use ?policy= to scope.	Compliance.IPPS.Read	Community
POST	/exchange/v1.0/autoSensitivityLabelRules	POST /autoSensitivityLabelRules - create a rule. Required: name + policy + workload. Returns 201 + Location.	Compliance.IPPS.ReadWrite	Enterprise
GET	/exchange/v1.0/autoSensitivityLabelRules/{key}	Get a single auto-sensitivity label rule by Identity. Returns 404 if absent.	Compliance.IPPS.Read	Community
PATCH	/exchange/v1.0/autoSensitivityLabelRules/{key}	PATCH /autoSensitivityLabelRules/{key} - partial update. Returns 200 + post-Set rule.	Compliance.IPPS.ReadWrite	Enterprise
DELETE	/exchange/v1.0/autoSensitivityLabelRules/{key}	DELETE /autoSensitivityLabelRules/{key} - remove a rule. Returns 204.	Compliance.IPPS.ReadWrite	Enterprise

GET /exchange/v1.0/autoSensitivityLabelRules

List auto-sensitivity label rules - content-condition rules attached to an autoSensitivityLabelPolicy. Use ?policy= to scope.

Backing cmdlet: Get-AutoSensitivityLabelRule. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
policy	query	string		Scope to a specific auto-sensitivity policy (Name or GUID).
includeExecutionRuleInformation	query	bool (switch)		Include execution-rule information in the returned rule details. Diagnostic; slower. Defaults to false.

List auto-sensitivity label rules

Returns the content-condition rules attached to auto-sensitivity label policies. Use the ?policy= query parameter to scope the result to a single policy by Name or GUID.

GET /exchange/v1.0/autoSensitivityLabelRules HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#autoSensitivityLabelRules",
  "value": []
}

Related: GET /exchange/v1.0/autoSensitivityLabelPolicies, GET /exchange/v1.0/autoSensitivityLabelRules/{key}

POST /exchange/v1.0/autoSensitivityLabelRules

POST /autoSensitivityLabelRules - create a rule. Required: name + policy + workload. Returns 201 + Location.

Backing cmdlet: New-AutoSensitivityLabelRule. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
name	body		yes
policy	body		yes
workload	body		yes
accessScope	body
activationDate	body
advancedRule	body
anyOfRecipientAddressContainsWords	body
anyOfRecipientAddressMatchesPatterns	body
comment	body
contentContainsSensitiveInformation	body
contentExtensionMatchesWords	body
contentPropertyContainsWords	body
disabled	body
documentCreatedBy	body
documentIsPasswordProtected	body
documentIsUnsupported	body
documentNameMatchesWords	body
documentSizeOver	body
exceptIfAccessScope	body
exceptIfAnyOfRecipientAddressContainsWords	body
exceptIfAnyOfRecipientAddressMatchesPatterns	body
exceptIfContentContainsSensitiveInformation	body
exceptIfContentExtensionMatchesWords	body
exceptIfContentPropertyContainsWords	body
exceptIfDocumentCreatedBy	body
exceptIfDocumentIsPasswordProtected	body
exceptIfDocumentIsUnsupported	body
exceptIfDocumentNameMatchesWords	body
exceptIfDocumentSizeOver	body
exceptIfFrom	body
exceptIfFromAddressContainsWords	body
exceptIfFromAddressMatchesPatterns	body
exceptIfFromMemberOf	body
exceptIfHeaderMatchesPatterns	body
exceptIfProcessingLimitExceeded	body
exceptIfRecipientDomainIs	body
exceptIfSenderDomainIs	body
exceptIfSenderIPRanges	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
exceptIfSubjectMatchesPatterns	body
expiryDate	body
from	body
fromAddressContainsWords	body
fromAddressMatchesPatterns	body
fromMemberOf	body
headerMatchesPatterns	body
immutableId	body
priority	body
processingLimitExceeded	body
recipientDomainIs	body
reportSeverityLevel	body
ruleErrorAction	body
senderDomainIs	body
senderIPRanges	body
sentTo	body
sentToMemberOf	body
sourceType	body
subjectMatchesPatterns	body
dryRun	query	bool (switch)

Create rejected - missing required field

New-AutoSensitivityLabelRule requires name, policy, and workload. Omitting any of them returns a 400 BadRequest before the cmdlet is invoked.

POST /exchange/v1.0/autoSensitivityLabelRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "policy": "exonaut-sample-autoSensitivityLabelPolicy",
  "workload": "Exchange"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'name' is required.",
    "target": "name"
  },
  "correlationId": "0HN7K2P9Q3R4S-00000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/autoSensitivityLabelRules

Create an auto-sensitivity label rule

Creates an auto-labeling content rule attached to a parent autoSensitivityLabelPolicy via New-AutoSensitivityLabelRule. Required fields are name, policy, and workload; the rule defines the content conditions that trigger auto-labeling.

POST /exchange/v1.0/autoSensitivityLabelRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-autoSensitivityLabelRules",
  "policy": "exonaut-sample-autoSensitivityLabelPolicy",
  "workload": "Exchange",
  "comment": "Auto-label messages containing financial information.",
  "contentContainsSensitiveInformation": [
    {
      "name": "Credit Card Number",
      "minCount": 1
    }
  ],
  "priority": 0
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/autoSensitivityLabelRules/exonaut-sample-autoSensitivityLabelRules

{
  "Id": "exonaut-sample-autoSensitivityLabelRules",
  "Identity": "exonaut-sample-autoSensitivityLabelRules",
  "name": "exonaut-sample-autoSensitivityLabelRules",
  "policy": "exonaut-sample-autoSensitivityLabelPolicy",
  "workload": "Exchange",
  "comment": "Auto-label messages containing financial information.",
  "priority": 0,
  "disabled": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/autoSensitivityLabelRules

GET /exchange/v1.0/autoSensitivityLabelRules/{key}

Get a single auto-sensitivity label rule by Identity. Returns 404 if absent.

Backing cmdlet: Get-AutoSensitivityLabelRule. Role: Compliance.IPPS.Read (Community).

PATCH /exchange/v1.0/autoSensitivityLabelRules/{key}

PATCH /autoSensitivityLabelRules/{key} - partial update. Returns 200 + post-Set rule.

Backing cmdlet: Set-AutoSensitivityLabelRule. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
accessScope	body
activationDate	body
advancedRule	body
anyOfRecipientAddressContainsWords	body
anyOfRecipientAddressMatchesPatterns	body
comment	body
contentContainsSensitiveInformation	body
contentExtensionMatchesWords	body
contentPropertyContainsWords	body
defaultSpoDocLibraryHasLabel	body
disabled	body
documentCreatedBy	body
documentIsPasswordProtected	body
documentIsUnsupported	body
documentNameMatchesWords	body
documentSizeOver	body
exceptIfAccessScope	body
exceptIfAnyOfRecipientAddressContainsWords	body
exceptIfAnyOfRecipientAddressMatchesPatterns	body
exceptIfContentContainsSensitiveInformation	body
exceptIfContentExtensionMatchesWords	body
exceptIfContentPropertyContainsWords	body
exceptIfDocumentCreatedBy	body
exceptIfDocumentIsPasswordProtected	body
exceptIfDocumentIsUnsupported	body
exceptIfDocumentNameMatchesWords	body
exceptIfDocumentSizeOver	body
exceptIfFrom	body
exceptIfFromAddressContainsWords	body
exceptIfFromAddressMatchesPatterns	body
exceptIfFromMemberOf	body
exceptIfHeaderMatchesPatterns	body
exceptIfProcessingLimitExceeded	body
exceptIfRecipientDomainIs	body
exceptIfSenderDomainIs	body
exceptIfSenderIPRanges	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
exceptIfSubjectMatchesPatterns	body
expiryDate	body
from	body
fromAddressContainsWords	body
fromAddressMatchesPatterns	body
fromMemberOf	body
headerMatchesPatterns	body
priority	body
processingLimitExceeded	body
recipientDomainIs	body
reportSeverityLevel	body
ruleErrorAction	body
senderDomainIs	body
senderIPRanges	body
sentTo	body
sentToMemberOf	body
sourceType	body
subjectMatchesPatterns	body
workload	body
dryRun	query	bool (switch)

Update an auto-sensitivity label rule

Partially updates an auto-sensitivity label rule via Set-AutoSensitivityLabelRule. Send only the SetWritable fields you want to change; the controller returns 200 with the post-Set rule.

PATCH /exchange/v1.0/autoSensitivityLabelRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comment": "Updated: include attachments larger than 1 MB.",
  "priority": 1,
  "disabled": false
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-autoSensitivityLabelRules",
  "Identity": "exonaut-sample-autoSensitivityLabelRules",
  "name": "exonaut-sample-autoSensitivityLabelRules",
  "comment": "Updated: include attachments larger than 1 MB.",
  "priority": 1,
  "disabled": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/autoSensitivityLabelRules

DELETE /exchange/v1.0/autoSensitivityLabelRules/{key}

DELETE /autoSensitivityLabelRules/{key} - remove a rule. Returns 204.

Backing cmdlet: Remove-AutoSensitivityLabelRule. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete an auto-sensitivity label rule

Removes an auto-sensitivity label rule via Remove-AutoSensitivityLabelRule. Returns 204 No Content on success.

DELETE /exchange/v1.0/autoSensitivityLabelRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/autoSensitivityLabelRules

?dryRun=true previews of any write stay on Community.