How to Configure Sensitivity Labels and Container Encryption in Microsoft Teams

As organizations rely on Microsoft Teams for project collaboration, creating dozens of cross-functional channels, sensitive financial forecasts and unreleased product roadmaps risk being accidentally exposed to external guest users. While document-level encryption protects individual files, modern governance requires securing the entire collaborative workspace. Through Microsoft Purview Sensitivity Labels, administrators can apply Container-Level Encryption directly to Teams, SharePoint sites, and Microsoft 365 Groups, enforcing uniform privacy boundaries automatically.

Understanding Container Sensitivity Labels vs File Labels

Microsoft Purview distinguishes between document protections and container governance:

• File-Level Labels: Encrypt individual Office documents (Word, Excel, PowerPoint) and PDFs, restricting permissions (view, edit, print) based on user identity.
• Container-Level Labels: Govern the entire workspace environment (the Team, its associated SharePoint document library, and connected group mailboxes). Policies dictate team privacy (Public vs Private), external guest access, unmanaged device conditional access, and sharing link controls.

Enabling Sensitivity Labels for Microsoft 365 Containers

Before container labels appear in Microsoft Teams Admin Center, administrators must enable Azure Active Directory (Microsoft Entra ID) group labeling via PowerShell:

# Connect to Azure AD / Entra ID PowerShell
Connect-AzureAD

# Retrieve directory setting template for groups
$settingTemplate = Get-AzureADDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }
$setting = $settingTemplate.CreateDirectorySetting()

# Enable sensitivity label classification
$setting["EnableMIPLabels"] = "True"
New-AzureADDirectorySetting -DirectorySetting $setting

Once activated, Microsoft Purview synchronizes sensitivity labels with Microsoft Teams and Microsoft 365 Groups.

Configuring Container Protection Rules in Microsoft Purview

To define label behavior across Microsoft Teams:

1. Sign into the Microsoft Purview Compliance Portal (compliance.microsoft.com) using compliance administrator credentials.
2. In the left sidebar, navigate to Information protection > Labels.
3. Click Create a label.
4. Define basic information:
   • Name: E.g., Confidential – Internal Project.
   • Display Name: Confidential Internal Only.
   • Description: Explain security requirements to end users.
5. In the Define the scope for this label page, ensure Groups & sites is selected (alongside Items if you wish to apply document protection simultaneously).
6. In the Groups and sites settings page, configure governance parameters:
   • Privacy: Force the Team to Private (only approved members can access).
   • External user access: Uncheck Let group owners add people outside the organization as guests to permanently block external guests from joining.
   • External sharing from SharePoint: Set to Only people in your organization.
   • Conditional Access: Restrict access from unmanaged or non-compliant mobile devices to web-only view with download blocking.
7. Complete the wizard and publish the label using a Label Policy targeting all organizational users.

Applying Sensitivity Labels to Teams

Once published, team owners and administrators can classify collaborative spaces:

• Creating a New Team: During team creation in the Microsoft Teams client, the wizard prompts users to select a Sensitivity Label. Choosing “Confidential Internal Only” automatically locks team privacy to Private and disables guest invitations.
• Classifying an Existing Team: Right-click the team name, select Edit team, and choose the updated sensitivity badge from the dropdown.

Auditing Label Compliance Across the Organization

Administrators can track classified teams in the Microsoft Teams Admin Center (admin.teams.microsoft.com). Under Teams > Manage teams, review the Sensitivity label column to confirm that all operational teams maintain compliant security classifications.