6.3 Apply Sensitivity Labels to Containers

6.3 Apply Sensitivity Labels to Containers

Quick Answer: A container sensitivity label on a Team, Microsoft 365 group, or SharePoint site controls privacy, external user access, external sharing, unmanaged-device access, and related collaboration settings. It does not encrypt the files inside. Power BI is on the SC-401 container skill, but Power BI labels are item labels whose encryption applies when data leaves the service, not Groups & sites container settings.

What a container label is—and what it is not

In addition to labeling documents and emails, you can protect collaborative workspaces with sensitivity labels. Microsoft currently documents container-style protection for Microsoft Teams sites, Microsoft 365 groups, SharePoint sites, Viva Engage communities, and Loop workspaces. When you apply a supported label to the container, the service applies the sensitivity category and the protection settings you configured for groups and sites.

The exam-critical negative: items in the container do not inherit the container label. A Confidential team site does not stamp Confidential encryption, headers, footers, or watermarks onto every Word file in the library. File-level protection still requires an item sensitivity label applied to the document or email. So that users can label Office files in those libraries, enable sensitivity labels for Office files in SharePoint and OneDrive (a separate tenant opt-in). Container labels also do not display alternate language strings; users see the original language for the name and description.

That split is why organizations sometimes publish separate labels scoped only to Groups & sites. Those labels never appear in Word or Outlook, which reduces picker clutter, but you must keep label order coherent: SharePoint raises a Detected document sensitivity mismatch audit event and email when a user uploads a file whose item label has a higher priority than the site’s container label. If you separate container labels from file labels, put container labels before file-scoped labels in the ordered list so that mismatch logic stays intuitive.

Enable labels for containers, then synchronize

Until you enable the feature, group and site settings are visible in the label wizard but you cannot configure them.

1. In Microsoft Entra ID, enable the ability to assign sensitivity labels to Microsoft 365 groups (follow the Entra documentation for Assign sensitivity labels to Microsoft 365 groups).
2. Connect to Security & Compliance PowerShell.
3. Run Execute-AzureAdLabelSync so the sensitivity labels can be used with Microsoft 365 groups.

This is a one-time enablement. After it succeeds, edit a sensitivity label, set the scope to include Groups & sites, and configure protection settings for groups and sites.

Settings a container label can enforce

On Define protection settings for groups and sites, you choose which bundles to configure:

• Privacy and external user access
• External sharing and Conditional Access
• Private teams discoverability and shared channel controls
• Apply a label to channel meetings (only when you are editing a label whose scope already includes meetings)

Privacy can be Public (anyone in the organization can access the container), Private (approved members only), or None (the label still classifies the container but users keep control of the privacy toggle). Public or Private sets and locks privacy when the label is applied. The label replaces any previous privacy value. Users cannot change privacy until the sensitivity label is removed; after removal, the privacy value from the label remains until someone changes it.

External user access controls whether the owner can add guests, similar to guest access for Microsoft 365 groups.

Control external sharing from labeled SharePoint sites maps to the familiar SharePoint sharing ladder: anyone, new and existing guests, existing guests, or only people in your organization.

Use Microsoft Entra Conditional Access to protect labeled SharePoint sites has two sub-options. Unmanaged devices uses SharePoint’s app-enforced restrictions to block or limit access from devices that are not managed. If you never configured the dependent Conditional Access policy for SharePoint, the label setting has no effect. The label also has no effect if it is less restrictive than the tenant-wide unmanaged-device setting. Example: if the tenant allows only limited web-only access, a label that allows full access does nothing; choose limited access (same) or block (more restrictive). Authentication context lets you require extra conditions such as MFA or terms of use when users access the labeled site. Contexts must already be created and published in Conditional Access. Not all apps support authentication contexts; unsupported apps get access denied or a failed prompt. Microsoft documents support for Office for the web, Teams for Windows and macOS (not the Teams web app), Planner, specified Microsoft 365 Apps versions, Outlook mobile/desktop minimums, and OneDrive sync (OneDrive only, not other sites; Android sync not yet supported). Power Apps, Power Automate, and third-party apps may break after you attach a context—test them.

Private teams discoverability can hide a private team that has the label even from users who are otherwise allowed to discover private teams. Teams shared channels can restrict which other teams may be invited (Internal only, Same label only, Private team only). These options depend on the privacy and guest settings on the previous page; incompatible combinations show a validation error. Only Private team only can remove previously invited teams; none of the options change invitations to individual users.

If a team already has shared channels, those channels inherit the parent team’s sensitivity label settings, and that label cannot be removed or replaced with a different label on the channel.

PowerShell advanced settings can also set the default sharing link type for the site and MembersCanShare (MemberShareAll, MemberShareFileAndFolder, MemberShareNone) to match SharePoint’s “who can share” radio buttons. Example: Set-Label -Identity <guid> -AdvancedSettings @{MembersCanShare="MemberShareNone"}.

Be careful with settings that extend configuration to site owners. External sharing options and authentication context, once published on a label, let a site owner change those behaviors by applying or changing the site’s sensitivity label. Do not configure those options if you want them reserved for administrators.

How users and admins apply the label

Publish the container-capable label in a label policy assigned to the people who should see it. Then apply it:

• New Team: users pick Sensitivity when they create the team. Privacy may change to match the label. Guest add may be blocked. After creation, the label appears in the upper-right of channels. The service applies the same label to the Microsoft 365 group and the connected SharePoint team site.
• Outlook on the web: Sensitivity is available when creating a Microsoft 365 group.
• SharePoint: admins and users pick a label under Advanced settings when creating a modern team site or communication site. Browsing the site shows the label name and policies (for example Confidential + Private).
• Microsoft Entra: assign, change, or remove a label on a Microsoft 365 group in the Azure portal.
• SharePoint admin center > Active sites: add the Sensitivity column, open the site, Policies, edit Sensitivity. Unlike user apps, the admin center lists all container labels in the tenant, not only labels published to the signed-in admin.
• Bulk sites: SharePoint Online Management Shell 16.0.19418.12000 or later. Capture the label GUID with Get-Label, then Set-SPOTenant with -SensitivityLabel to stamp many sites (including OneDrive sites) or Set-SPOSite for a specific site.

After a label is applied, changing it in SharePoint or Teams requires Microsoft 365 group Owners on a group-connected site, or a SharePoint site admin on a site that is not group-connected.

User apps and services that support groups-and-sites labels include SharePoint, Teams, Outlook (web, Windows, macOS, iOS, Android), Forms, Stream, Planner, Loop, and Viva Engage, plus the SharePoint, Teams, Microsoft 365, and Purview admin centers. Microsoft currently documents that Power BI, Dynamics 365, Project, the My Apps portal, and the Exchange admin center do not support sensitivity labels configured for sites and group settings. The Microsoft Entra admin center does filter labels according to publishing policies, unlike most other admin centers, which show all tenant container labels.

Power BI on the SC-401 container bullet

The official skill says to apply a sensitivity label to containers such as Teams, Microsoft 365 Groups, Microsoft Power BI, and SharePoint. In the product, Power BI / Fabric does not consume the Groups & sites container settings described above. Power BI uses the same published sensitivity labels as item labels on semantic models, reports, dashboards, dataflows, and .pbix files.

A Fabric admin must enable sensitivity labels in the tenant. Users who apply labels need a Power BI Pro or Premium Per User license (Free can label only in My workspace), membership in the security group allowed to apply labels, and Edit permission on the artifact. Labels are created in the Microsoft Purview portal and must be published to the relevant users. Parent labels cannot be applied; if an item somehow has a parent label, apply an appropriate sublabel.

In the Power BI service, labeling does not change who can open the report. Access is still workspace and item permissions (and row-level security). Encryption settings on the label are not applied to in-service access. They are applied when data leaves on a supported export path: export to Excel, PDF, and PowerPoint (Export as image only; live-data storytelling does not apply the label), Analyze in Excel, live-connection PivotTables for Microsoft 365 E3 and above, and download to .pbix. Unsupported paths such as .csv do not get the label or encryption; a Power BI admin can block those paths. If a downloaded report and its semantic model have different labels, the more restrictive label is applied to the .pbix. Export fails if the label cannot be applied.

In Power BI Desktop, encryption does restrict who can open a labeled .pbix. Publishing or uploading a labeled .pbix applies the label to the report and semantic model created in the service (with a prompt if replacing existing labeled assets). New reports and dashboards can inherit the parent semantic model’s label; if inheritance cannot be applied, Power BI still creates the item. Downstream inheritance and inheritance from supported data sources (Azure Synapse Analytics and Azure SQL Database) can continue the label along the data path. Publishing-policy default and mandatory label settings exist specifically for Power BI content. Applying a label on export does not add content markings in the exported file; Office desktop apps that use the unified labeling client may add markings later when the file is opened.

Treat Power BI as “apply the published item label to the Fabric artifact,” not as “apply a Teams-style container label to the workspace.” Confusing those two models is a common wrong answer.

Changing, deleting, and waiting

Do not casually change site and group settings on a label after it is already applied. If you do, wait at least 24 hours for replication to every container that has the label. Changing External users access applies to new users, not existing guests—guests already in the site keep access. Hidden membership and roleEnabled group properties are not updated by that change.

To delete a container-capable label that is still in policies, first remove it from every label policy, wait at least one hour, confirm that creating a team, group, or site no longer shows the label, and only then delete. Deleting a still-published container label can cause creation failures for new teams, groups, and sites.

When you delete a label that was applied to containers, the label is removed and its settings stop being enforced. Microsoft documents about 48–72 hours for SharePoint sites, often faster for Teams and Microsoft 365 Groups. Until deletion completes, users might be unable to open content the label previously protected.