Sensitivity labels for Teams, groups and sites: privacy, sharing and unmanaged devices

Sensitivity labels can classify a whole team, Microsoft 365 group or SharePoint site, not just a document. A container label sets and locks privacy, decides whether owners can add guests, limits external sharing, and can push unmanaged devices or risky sign-ins through Conditional Access. In this post I'll enable the feature, configure the settings, apply labels to new and existing containers, and cover why labels sometimes aren't offered.

How it works#

A label whose scope includes Groups & sites carries settings that take effect when it's applied to a container. Applying it to a team also labels the Microsoft 365 group and the connected SharePoint site, and shared channels inherit their parent team's label. Files inside don't inherit anything: no encryption or markings. A label scoped only to Groups & sites never appears in Office apps.

Two more settings, the default sharing link type and MembersCanShare, are PowerShell-only. Note that external sharing and authentication context become something site owners can change by switching labels, so leave them out of a label if owners shouldn't control them.

Prerequisites#

• At least one active Microsoft Entra ID P1 license in the tenant.
• The Microsoft Graph PowerShell modules and Security & Compliance PowerShell.
• For the unmanaged devices setting, SharePoint's Conditional Access policy with app-enforced restrictions; without it, the setting has no effect.

Step-by-step#

1. Turn on label support for groups#

Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Module Microsoft.Graph.Beta.Identity.DirectoryManagement -Scope CurrentUser
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
$grpUnifiedSetting = Get-MgBetaDirectorySetting | Where-Object { $_.Values.Name -eq "EnableMIPLabels" }
$grpUnifiedSetting.Values
$params = @{ Values = @( @{ Name = "EnableMIPLabels"; Value = "True" } ) }
Update-MgBetaDirectorySetting -DirectorySettingId $grpUnifiedSetting.Id -BodyParameter $params
(Get-MgBetaDirectorySetting -DirectorySettingId $grpUnifiedSetting.Id).Values

If $grpUnifiedSetting.Values returns nothing, the tenant has no group settings yet; create them first using Microsoft's article on Microsoft Entra cmdlets for configuring group settings. A Request_BadRequest error means settings already exist: run Get-MgBetaDirectorySetting | Format-List, take the ID whose values include EnableMIPLabels, and update that one.

2. Synchronize labels to Microsoft Entra ID#

Connect-IPPSSession
Execute-AzureAdLabelSync

Allow up to 24 hours after synchronization before labels are available to groups.

3. Configure the label#

In the Microsoft Purview portal, open Solutions › Information Protection › Sensitivity labels, create or edit a label and include Groups & sites in its scope. On Define protection settings for groups and sites, choose Privacy and external user access settings, External sharing and Conditional Access settings, and Private teams discoverability and shared channel controls as needed. To stop members sharing the site:

Set-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{MembersCanShare="MemberShareNone"}

For an authentication context, go to Microsoft Entra Conditional Access, select Authentication context under Manage, create a context with Publish to apps selected, then create a Conditional Access policy that targets that context with your grant controls. Only published contexts appear in the label's list.

4. Publish to test users first#

Add the label to a label policy for a few test users. Wait at least an hour for a new label (24 hours if it has shared channel controls) and 24 hours after changing an existing one. Then have a test user create a team, group and site with the label. If nothing errors, publish it widely.

5. Apply labels to new and existing containers#

• New: the Sensitivity list when creating a team in Teams, a group in Outlook on the web, or a site in SharePoint (under advanced settings).
• Existing group: Microsoft Entra admin center, Groups › All groups › group › Properties, as group owner or at least Groups Administrator.
• Existing site: SharePoint admin center, Active sites › site › Policies tab › Sensitivity › Edit.
• Scripted, with SharePoint Online Management Shell 16.0.19418.12000 or later:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -SensitivityLabel "e48058ea-98e8-4940-8db0-ba1310fd955e"

Get label GUIDs with Get-Label | Format-Table Name, Guid. Afterwards, changing the label in SharePoint or Teams needs a group owner (group-connected sites) or a site admin.

Verify#

• Teams shows the label in the upper-right corner of every channel, and visitors to the site see the label and its policies.
• Owners can't change the privacy setting, and guest invitations and sharing links follow the label.
• Add the Sensitivity column under Active sites to review labels across sites.
• With an authentication context, a test sign-in triggers your policy's controls; check the sign-in logs.
• Uploading a document with a higher-priority label than the site's creates a Detected document sensitivity mismatch audit event and an email titled Incompatible sensitivity label detected.

Tips & gotchas#

• No labels offered? Check the P1 license, EnableMIPLabels, the label sync and its 24 hours, the Groups & sites scope, that it's a Microsoft 365 group, and that the user owns it (or is a Groups Administrator) and is in the label's publishing policy. Admin centers list all container labels, except the Microsoft Entra admin center, which filters by publishing policy.
• Changing settings later takes 24 hours, and an external user access change affects new guests, not existing ones. Avoid changes after labels are applied.
• Deleting a published label can break team, group and site creation. Remove it from all label policies, wait an hour, confirm it's gone, then delete it.
• Authentication context limits: unsupported apps are denied, including the Teams web app and SharePoint mobile apps, and it can't be applied to the root site.
• Exchange admin center, Power BI and Dynamics 365 don't support container labels.

Container labels pair well with fixing SharePoint oversharing and SharePoint external sharing settings. To label the files inside, see sensitivity labels in SharePoint and OneDrive.

References#

• Use sensitivity labels to protect collaborative workspaces (Microsoft Learn)
• Assign sensitivity labels to Microsoft 365 groups in Microsoft Entra ID (Microsoft Learn)
• Conditional Access policies and SharePoint (Microsoft Learn)