How to apply sensitivity labels to Teams, groups and sites

What this check looks at

Checks that Microsoft 365 groups, and so their Teams and SharePoint sites, carry a sensitivity label that sets their privacy and external sharing.

Sensitivity labels can apply to containers as well as files. A label with the Groups & sites scope, applied to a Microsoft 365 group, sets the team’s or site’s privacy (public or private), whether guests can be added, the SharePoint external sharing level for the site, and access from unmanaged devices. The settings are enforced, so an owner cannot quietly make a Confidential team public. Container labels are off until an administrator sets EnableMIPLabels in the Group.Unified directory setting and synchronises labels to Microsoft Entra ID.

The check reads the label on each Microsoft 365 group. It fails when no group carries a label, warns when some do not (with the share unlabelled and how many of those are public), passes when every group is labelled, and reports not checked when labels could not be read for any group.

Without container labels, a team’s privacy and sharing are whatever the owner chose on the day, and can be changed at any time without anyone noticing. Nothing tells DLP, search, Copilot or a reviewer which teams hold confidential material, so a board team is treated the same as the social club.

Why it matters

A label on a team or site is what keeps its privacy and sharing settings from drifting, and tells Copilot, DLP and search what the content is. Unlabelled sites are treated as ordinary, whatever is in them.

A typical case: a Legal team was created as Private with sharing limited to existing guests. Two years later a new owner switches it to Public to let a colleague in, and opens the site to Anyone links for an outside barrister. A Confidential container label would have refused both changes, and the case files would never have been reachable by everyone with the link.

Labelling teams is also what lets later controls work: DLP and Copilot policies that treat Confidential content differently, and access reviews that start with the sensitive teams.

ISO 27001 controls A.5.12 (classification) and A.5.13 (labelling of information), the NCSC Cyber Assessment Framework’s B3.a and the DSPT’s standard on personal confidential data all expect information to be classified and handled by its classification. Container labels are included with Microsoft 365 Business Premium and E3.

How to fix it

Where: Microsoft Purview portal → Information protection → Sensitivity labels

Before you start

• Enable sensitivity labels for groups and sites in Entra ID first (a group setting), then create container labels.

Step by step

1. 1Turn on labels for groups and sites in Entra ID. In Graph PowerShell, Install-Module Microsoft.Graph.Beta, Connect-MgGraph -Scopes Directory.ReadWrite.All, then $s = Get-MgBetaDirectorySetting | Where-Object DisplayName -eq "Group.Unified" and Update-MgBetaDirectorySetting -DirectorySettingId $s.Id -BodyParameter @{ Values = @(@{ Name = "EnableMIPLabels"; Value = "True" }) }. If no Group.Unified setting exists yet, create it from the Group.Unified template first, as Microsoft Learn’s group settings article describes.
2. 2Synchronise labels to Entra ID. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Run Execute-AzureADLabelSync so the labels can be used on groups.
3. 3Give your labels group and site settings. In the Microsoft Purview portal, go to Solutions > Information Protection > Sensitivity labels. Edit each label (or create new ones) and tick the Groups & sites scope. Under the group and site settings, turn on "Privacy and external user access" and "External sharing and Conditional Access": for Confidential, set Private, no guest access, and sharing to existing guests or only people in your organisation. Save each label.
4. 4Publish the labels and require one on new teams. In Information Protection > Publishing policies, edit the policy that publishes these labels to everyone (or create one). In its settings for groups and sites, require users to apply a label to their groups and sites and choose a default. Save. Allow up to 24 hours before the labels appear when creating a team.
5. 5Label the existing teams, starting with the sensitive ones. In the Microsoft 365 admin centre, go to Teams & groups > Active teams & groups, select a group, open Settings and choose its sensitivity label. For many groups, use Exchange Online PowerShell: get the label’s GUID with Get-Label | Select-Object DisplayName, Guid (in Security & Compliance PowerShell), then Set-UnifiedGroup -Identity "<group>" -SensitivityLabelId <label guid>. Start with the public and confidential groups in the evidence.
6. 6Confirm the change. In Exchange Online PowerShell, Get-UnifiedGroup -ResultSize Unlimited | Where-Object { -not $_.SensitivityLabel } | Select-Object DisplayName lists the groups still without a label, which should be empty or only the ones you are still working through. Creating a new team in Teams now asks for a label.

What users will notice

Team owners pick a label when creating a team; the label can set privacy and guest access.

How to confirm it worked

Teams and SharePoint sites show a sensitivity label, starting with those holding confidential material.

Frameworks and controls

This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Use sensitivity labels with Teams, groups and sites (Microsoft Learn)

Related checks

• How to find Teams and groups with no owner
• How to find public Teams and groups open to everyone
• How to create sensitivity labels for documents and email
• How to set a Microsoft 365 group expiration policy

The full Microsoft 365 security checklist, worst first