Enable tracking who changes a label or removes protection
It could be great knowing who changes a label to correct this or who violates the internal classification policy.
Reporting of label changes is being built in the Windows Defender ATP client. Preview coming soon.
unless ATP becomes free or we get uplifted to M365 E5 from o365 E5/EMS e5 - we are embedded with our existing NG malware service.
this needs to occur in the native AIP logging.
Not really nice, that this requires another technology (Windows Defender ATP client) to be implemented. Would be much more usefull and reliable if it would come out of the AIP Environment itself.
I would have expected that you use the information out of the Activity Logs (there you can find the information that a label was changed already) to inform the Doc Owner.
Has this feature been enabled?
Kenneth Rosenkrantz commented
Every single customer of mine that evaluates AIP asks about this feature.