How to Configure Sensitivity Labels, DLP Policies, and Guest Access Restrictions in Microsoft Teams

Architectural Foundation of Microsoft Purview and Container Governance in Teams

Modern enterprise collaboration ecosystems must prevent intellectual property leaks, comply with regulatory frameworks (such as GDPR, HIPAA, and ISO 27001), and restrict external access without obstructing agile internal communication. In Microsoft 365, Microsoft Purview Information Protection orchestrates compliance across Microsoft Teams via two distinct architectural layers: Container-Level Sensitivity Labels and Item-Level Data Loss Prevention (DLP) Policies.

When an organisation deploys container-level sensitivity labels, the label attaches directly to the underlying Microsoft 365 Group and its associated SharePoint team site collection. Rather than relying on individual team owners to manage complex security permissions manually, the sensitivity label programmatically enforces container privacy (Public versus Private), dictates whether external guest accounts can be invited, and triggers Microsoft Entra Conditional Access session controls (such as blocking unmanaged personal devices from downloading confidential files).

Governance Scope	Policy Enforcement Engine	Interception Point	Compliance Control Mechanism
Container Governance	Microsoft 365 Group Architecture	Team creation & guest invitation	Locks team privacy, blocks guests, restricts web downloads
Message-Level DLP	Purview Real-Time Inspection Engine	1:1 chats, group chats, channel posts	Scans text and attachments for sensitive data; blocks messages
File-Level Rights (RMS)	Azure Rights Management Service	SharePoint file storage & sync	Cryptographic AES-256 encryption bound to identity

Enabling Sensitivity Labels for Microsoft Teams via PowerShell

By default, newly provisioned Microsoft 365 tenants support sensitivity labels exclusively on Office documents (Word, Excel, PowerPoint). To extend sensitivity label scoping to Microsoft Teams and Microsoft 365 Groups, administrators must enable the container-level integration feature in Microsoft Entra ID:

# 1. Connect to Microsoft Graph PowerShell using Directory.ReadWrite.All privileges
Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Group.ReadWrite.All"

# 2. Query existing Directory Settings for Microsoft 365 Groups
$Setting = Get-MgBetaDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }

# 3. If setting exists, enable sensitivity label integration flag
if ($Setting) {
    $Values = $Setting.Values
    $Values | Where-Object { $_.Name -eq "EnableMIPLabels" } | ForEach-Object { $_.Value = "True" }
    Update-MgBetaDirectorySetting -DirectorySettingId $Setting.Id -Values $Values
} else {
    # Create template if not already present in tenant
    $Template = Get-MgBetaDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }
    $SettingConfig = @{
        TemplateId = $Template.Id
        Values = @(@{ Name = "EnableMIPLabels"; Value = "True" })
    }
    New-MgBetaDirectorySetting -BodyParameter $SettingConfig
}

# 4. Confirm activation state
(Get-MgBetaDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }).Values | Where-Object { $_.Name -eq "EnableMIPLabels" }

Configuring Container Sensitivity Labels in Microsoft Purview

Once enabled at tenant scope, define security boundaries within the Microsoft Purview compliance portal (compliance.microsoft.com):

Step 1: Define Label Scope and External Access Boundaries

1. Navigate to Information protection > Labels and click Create a label.
2. Name the label (e.g., Highly Confidential - Internal Only).
3. Under Define the scope for this label, check the box labelled Groups & sites (encompassing Teams, Microsoft 365 Groups, and SharePoint sites).
4. Configure group and site protection settings:
   • Privacy: Select Private (only team owners can add members).
   • External user access: Uncheck Let group owners add people outside your organisation to the group (strictly prohibits external guests).
   • External sharing from SharePoint sites: Select Only people in your organisation.
5. Under Conditional Access settings, select Block access from unmanaged devices to mandate managed hybrid-joined or Intune-compliant hardware.
6. Save and publish the label via a Label Policy targeting your global enterprise directory.

Configuring Real-Time Data Loss Prevention (DLP) for Teams Chats

To prevent employees from sharing payment card information, credentials, or national insurance numbers across public channels and private chats, construct a dedicated Teams DLP policy.

Step 1: Create a Teams DLP Policy

1. In the Purview compliance portal, navigate to Data loss prevention > Policies.
2. Click Create policy, select Custom, and click Next.
3. Name the policy: Teams Financial & PII Protection Policy.
4. Under Locations to apply policy:
   • Turn off all locations except Teams chat and channel messages.
5. Click Next to configure policy rules.

Step 2: Define Detection Rules and Enforcement Actions

1. Click Create rule and add sensitive information types (SITs):
   • Credit Card Number (High confidence)
   • U.K. National Insurance Number (NINO)
   • EU Debit Card Number
2. Under Actions:
   • Select Block access to the content.
   • Choose: Block everyone (sender cannot transmit; recipient receives placeholder notification).
3. Under User notifications:
   • Turn on notifications with policy tips: “This message was blocked because it contains sensitive payment or identification numbers.”
   • Enable Allow override only if business justification or false-positive reporting is mandatory.
4. Click Save and turn the policy on immediately.

The User Experience Under Active DLP Enforcement

When an internal employee attempts to dispatch a credit card number in a Teams chat:

• The message displays briefly with a red prohibition sign and an automated replacement banner: “This message was blocked. What can I do?”
• The intended recipient never sees the sensitive text.
• Clicking “What can I do?” reveals the specific policy triggered, the detected sensitive information type, and options to report a false positive if permitted by enterprise policy.

Troubleshooting Teams Security Labels and DLP Faults

Observed Fault	Underlying Root Cause	Diagnostic Verification Method	Remediation Protocol
Sensitivity Labels Missing When Creating New Teams	Label synchronization latency or EnableMIPLabels flag not activated in Entra directory	Run PowerShell check on Group.Unified directory setting	Verify EnableMIPLabels is True; allow 24–48 hours for global Purview policy distribution
Existing External Guests Retain Access After Label Change	Changing a team’s sensitivity label does not automatically evict pre-existing guest accounts	Review team members roster; previously added external guests remain listed	Manually remove external guests from the team roster or run automated guest cleanup PowerShell scripts
Brief Telemetry Delay Before DLP Blocks Message (1–3 Seconds)	Asynchronous message routing; message posted locally before cloud Purview evaluation completes	Message renders on screen for 1 second before flipping to “Blocked” placeholder	Expected architectural behaviour; Purview DLP evaluates messages out-of-band to maintain UI responsiveness
Unmanaged Devices Blocked from Web Teams Entirely	Conditional Access policy configured to “Block access” instead of “Limited web access”	User on personal laptop encounters Entra sign-in error page stating device is unmanaged	Update label settings in Purview to permit Limited, web-only access with file download prevention