Sensitivity Label for Office 365 Group and Microsoft Teams

Microsoft recently added a new feature in sensitivity Label, using this feature we can classify the Office 365 Group, SharePoint Online site, and Microsoft Teams. Previously, we used Classification Label to classify the group or site with text but this sensitivity Label feature not only supports classification by text and it is also supporting privacy, guest access, and unmanaged device access for Office365 Groups, Teams and SharePoint Site.

How to create the sensitivity Label for Office365 Groups, Microsoft Teams and SharePoint Site.

We can create the Sensitivity labels from Office 365 Security and Compliance center. Go to Office 365 security and compliance (https://protection.office.com/) → Classification → Sensitivity labels → Create label → Enable the Site and Group Settings.

Site and Groups Settings

Using this feature, we can control Site, Groups, and Teams with the following option

• Privacy
• External user access
• Unmanaged devices

Privacy

Using this setting, we can set the privacy type Private or public by applying this sensitivity label.

External user access

Using this setting, we can enable or disable guest access for the Groups, Teams, and Sites.

Unmanaged devices

Using this setting, we can manage access for the unregistered device in Azure AD. It has the following option

• Allow full access from Desktop, Mobile app, and the web app
• Allow limited Web access
• Block access

Note: This sensitivity label only controls the above features. It will not impact the store items in the Teams and SharePoint Site.

Enable and sync the Label in Office 365 Groups

Before going to apply the sensitivity label, we need to enable EnableMIPLabels in Set-AzureADDirectorySetting using AzureADPreview PowerShell module, refer the below PowerShell commands to enable sensitivity label in the tenant.

| Import-Module AzureADPreview
Connect-AzureAD
$Setting = Get-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting where -Property
DisplayName -Value “Group.Unified” -EQ).id
$Setting.Values
$Setting[“EnableMIPLabels”] = “True”
Set-AzureADDirectorySetting -Id $Setting.Id -DirectorySetting $Setting |

After enable, the EnableMIPLabels in AzureAD module, we need to sync sensitivity label to office 365 Group using Execute-

AzureAdLabelSync commands, refer the below PowerShell commands.

| $UserCredential . Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri (https://ps.compliance.protection.outlook.com/powershell-liveid/) -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking
Execute-AzureAdLabelSync|

How to apply the Sensitivity label to Office 365 Group, Sites, and Teams

We can apply the sensitivity label when creating the Office 365 Groups, Sharepoint Sites, Microsoft Teams.

Office 365 Groups

Microsoft Teams

Sharepoint Site

How to change the sensitivity label in Office 365 Groups

Currently, there is no end-user setting to change the sensitivity label from Office365 Group settings, Microsoft Teams settings and Sharepoint site settings, but we can change sensitivity label from Azure AD portal → Groups → Select required Groups → Properties → change the label.

User Experience

For example, we created sensitivity label with following settings,

• Privacy – Private
• External user access – Disable
• Unmanaged devices -Block access

Privacy

When we apply that sensitivity label during Team creation, it will automatically select privacy as private.

External user access

In this example, we disabled external access in the sensitivity label, so we got “We couldn’t find any matches”

Unmanaged devices

When we access that sensitivity label applied Teams or site from an unmanaged device, we will get the following error message.