What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
FreeIntermediateRead-onlyLow
Export SharePoint site sensitivity labels
Exports the Microsoft Purview sensitivity label currently assigned to each selected SharePoint Online site, including explicit unlabeled and error states.
Generated locally in your browser · Runs in your PowerShell environment · Review before running
What this PowerShell script does
Exports the Microsoft Purview sensitivity label currently assigned to each selected SharePoint Online site, including explicit unlabeled and error states.
Requirements
- Scope - Choose tenant-wide discovery or a controlled CSV list of SharePoint site URLs.
- SharePoint admin URL - Required for tenant-wide discovery, for example https://contoso-admin.sharepoint.com.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Environment
- Module: PnP.PowerShell
- Runtime: 7.4+
- Authentication: Interactive PnP login with your own Entra app/client ID or configured default
- Permissions: AllSites.Read · SharePoint Administrator (tenant scope)
- Risk: Low
Review before you runThe generated script is read-only, but authentication and access requirements still apply in your tenant.
OPS / WORKSPACE
Ready to generate
Configure Export SharePoint site sensitivity labels in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this report when you need to see which SharePoint sites have a Microsoft Purview sensitivity label assigned. Sites with no returned label are marked explicitly, while access/API failures remain errors rather than being misclassified as unlabeled.
Important limitations
- Reports the site-level sensitivity label, not file-level labels.
- Does not enumerate available tenant labels or validate label publishing policy.
- A site that cannot be accessed is reported as an error rather than treated as unlabeled.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a default client ID configured for PnP.PowerShell. Opselith does not connect to SharePoint or execute the script on your behalf.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required scope, authentication and output values.
- Generate the script, review its permissions and commands, then run it in your own PowerShell environment.
OPS / SCRIPT DETAILS
Script details
Exports the Microsoft Purview sensitivity label currently assigned to each selected SharePoint Online site, including explicit unlabeled and error states. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read · SharePoint Administrator (tenant scope)
Risk: Low
Execution impact: Read-only. Reads the Microsoft Purview sensitivity label assigned to each selected SharePoint site and does not assign, remove or modify labels.
Parameters
- Scope - Choose tenant-wide discovery or a controlled CSV list of SharePoint site URLs.
- SharePoint admin URL - Required for tenant-wide discovery, for example https://contoso-admin.sharepoint.com.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Output
Output: CSV report with SiteUrl, LabelId, LabelName, LabelState, Status and Error.
This template is available in the free library and is generated locally in your browser.
Example use
Exports the Microsoft Purview sensitivity label currently assigned to each selected SharePoint Online site, including explicit unlabeled and error states.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell and your own Entra app/client ID. Choose tenant-wide discovery or a SiteUrl CSV. Tenant discovery requires the SharePoint admin URL and SharePoint Administrator access.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Uses Get-PnPSiteSensitivityLabel only; no Set-PnPSiteSensitivityLabel
- Unlabeled sites are explicit rather than omitted
- Per-site failures are isolated and reported
- Exact cmdlet permission metadata remains a pre-release Get-PnPCommandPermission gate
Was this useful?One click. No email.