How to Configure Sensitivity Labels, DLP Policies, and Guest Access in Microsoft Teams

Modern enterprise collaboration platforms represent significant security exposure points where sensitive financial ledgers, intellectual property, and personal identification data can be inadvertently shared across public channels or exposed to external contractors. Microsoft Teams, deeply integrated into Microsoft 365 and Azure Active Directory (Microsoft Entra ID), provides enterprise-grade data protection through Microsoft Purview Information Protection. By deploying container-level Sensitivity Labels, real-time Data Loss Prevention (DLP) inspection policies, and granular Guest Access governance, security administrators can prevent confidential data leaks without stifling cross-organization collaboration.

Microsoft Teams Security and Information Governance Architecture

Securing Microsoft Teams requires applying governance across three distinct operational layers: container privacy (the Team workspace), message payload inspection (chats and channels), and identity boundary controls (guest vs. external federation). The table below outlines these protective layers:

Security Mechanism	Administrative Console	Target Asset / Scope	Enforced Governance Action
Container Sensitivity Labels	Microsoft Purview Portal	Teams, Microsoft 365 Groups, SharePoint Sites.	Locks team privacy (Private/Public), blocks external guests, enforces unmanaged device browser-only access.
Data Loss Prevention (DLP)	Microsoft Purview Portal	1:1 Private Chats, Group Chats, Channel Messages.	Scans message text and shared attachments for credit cards, PII, and financial regex; blocks transmission in real time.
Guest Access Controls	Microsoft Teams Admin Centre	External Azure AD B2B User Accounts.	Controls whether external collaborators can use cameras, screen sharing, edit sent messages, or create channels.
External Access (Federation)	Teams Admin Centre / Entra ID	External Domain Communication.	Allows or blocks 1:1 chat and audio calling with external federated tenants (e.g., Skype for Business / Teams external).

Configuring Container-Level Sensitivity Labels

Rather than relying on team owners to manually set correct privacy settings, container sensitivity labels automatically enforce security baselines upon team creation.

1. Authoring a Team Sensitivity Label in Microsoft Purview

1. Navigate to the Microsoft Purview Portal (purview.microsoft.com) with Compliance Administrator credentials.
2. Go to Information Protection > Sensitivity labels.
3. Click Create a label.
4. Assign a label name and display description (e.g., Confidential - Internal Project).
5. Under Define the scope for this label, select Groups & sites (and deselect Items if purely targeting container policies).

2. Defining Group and Site Protection Policies

Configure the foundational container constraints:

• Privacy of Microsoft 365 group-connected team sites: Select Private (only verified team owners can add members; users cannot convert the team to public).
• External user access: Uncheck Let group owners add people outside your organization to the group to block guest members entirely.
• External sharing from SharePoint sites: Select Only people in your organization to disable anonymous external file links.
• Access from unmanaged devices: Select Block access or Allow limited, web-only access to prevent contractors or personal laptops from downloading local copies of confidential files.
• Commit the label and publish it via a Label Policy targeted to your organization’s user base.

Deploying Data Loss Prevention (DLP) Policies for Teams Chats

DLP policies actively scan text strings and attachments inside Microsoft Teams in real time, preventing employees from posting credit card numbers, National Insurance numbers, or proprietary source code.

Step 1: Create a DLP Policy in Microsoft Purview

1. In the Purview console, navigate to Data loss prevention > Policies and click Create policy.
2. Choose a template category (e.g., Financial > U.K. Financial Data) or choose Custom.
3. Under Locations to apply the policy, toggle Teams chat and channel messages to On (while keeping Exchange or OneDrive disabled if isolating Teams).

Step 2: Define Detection Rules and Enforcement Actions

1. Click Create rule and add sensitive information types (such as Credit Card Number or EU Debit Card Number).
2. Set the condition: Content is shared with people outside my organization (or evaluate all internal traffic).
3. Configure the protective response under Actions:
   • Select Block everyone or Block only people outside your organization.
   • Check Notify users with policy tips: Displays an educational banner explaining why the message was intercepted.
   • Configure User overrides: Optionally allow designated senior staff to override the block by providing a business justification.
4. Save and activate the policy. When a user pastes restricted data, Teams immediately revokes the message, replacing the text with: “This message was blocked. What can I do?”

Configuring Guest Access and External Federation

Enabling collaboration with clients and suppliers requires configuring organizational boundaries in the Teams Admin Centre.

1. Tuning Guest Access Permissions

1. Navigate to the Microsoft Teams Admin Centre (admin.teams.microsoft.com).
2. In the left drawer, expand Users and select Guest access.
3. Ensure Allow guest access in Teams is toggled to On.
4. Establish security limits:
   • Make private calls: Disabled to prevent unmonitored point-to-point voice calling.
   • IP video: Disabled or enabled based on organizational bandwidth and compliance needs.
   • Screen sharing mode: Set to Disabled or Single application to prevent accidental desktop leakage during calls.
   • Edit sent messages / Delete sent messages: Disabled to preserve an immutable audit log of guest interactions.
5. Click Save.

2. Managing External Access (Federation Whitelists)

To communicate with external partner companies via 1:1 chat without inviting them as guest members into your internal teams:

1. Go to Users > External access.
2. Choose your federation model:
   • Allow all external domains: Open federation (high risk of external unsolicited spam).
   • Allow only specific external domains: Closed federation (recommended). Add partner company domains (e.g., partnercorp.co.uk) to whitelist trusted business relationships exclusively.

Auditing and Enforcing Access Reviews via Entra ID

Over time, guest accounts accumulate across teams long after consulting engagements terminate. Deploying Microsoft Entra ID Access Reviews automates hygiene:

1. Open the Microsoft Entra Admin Centre (entra.microsoft.com).
2. Navigate to Identity Governance > Access Reviews.
3. Create a recurring quarterly review requiring Team Owners to attest whether external guests still require active membership.
4. If an owner fails to respond or revokes access, Entra ID autonomously purges the guest account from the team directory.

Troubleshooting Teams Security Governance Bottlenecks

When deploying information protection policies, administrators frequently encounter specific operational questions:

• DLP Message Blocking Latency: Teams performs near-instantaneous client-side evaluation, but complex regular expressions or nested attachment scanning can take 2 to 5 seconds to process. During this window, the sender may see the message momentarily before it is replaced with the red blocked banner. Educate staff that DLP processing occurs asynchronously across cloud transport relays.
• Sensitivity Labels Missing During Team Creation: If newly authored sensitivity labels fail to appear in the Teams desktop client, ensure that the label policy has been published for at least 24 hours. Additionally, verify that Azure AD group classification synchronization is enabled via PowerShell using Execute-AzureADDirectorySetting.
• Guests Unable to View Shared Channels: Standard guest accounts operate in traditional Teams channels. To collaborate across Shared Channels, organizations must configure Azure AD B2B Direct Connect cross-tenant trust rather than standard B2B collaboration guest invitations.