Home » Blog » Manage M365 Groups with Sensitivity Labels

Manage M365 Groups with Sensitivity Labels

M365 Groups and Sensitivity Labels

In Microsoft 365 (M365), sensitivity labels provide a powerful way to classify and protect sensitive information in your organization. They are essential for managing M365 Groups, ensuring data security, and controlling access, and should be part of every governance strategy.

This post will guide you through enabling sensitivity labels for M365 Groups using PowerShell, creating the labels, and exploring options for sharing and external users.

With the Teams Manager app, you can apply sensitivity labels to new groups or teams automatically and consistently. Take a look!

Get control over your Teams with Teams Manager

Enable Sensitivity Label Support in PowerShell

To apply published labels to groups, Microsoft Teams or SharePoint sites, you must first enable the feature in Microsoft Entra ID.

Here is your step-by-step guide on how to enable sensitivity labels.

1. Open the PowerShell app (in current Windows versions, it is installed by default).

2. Copy and paste the following PowerShell commands to install and connect the necessary module.

Install-Module AzureADPreview
Import-Module AzureADPreview

3. Sign in to Microsoft Entra with your admin account at https://entra.microsoft.com/.

4. Use the following Powershell command to show the existing container settings.

$grpUnifiedSetting = (Get-AzureADDirectorySetting | where -Property DisplayName -Value “Group.Unified” -EQ)
$Setting = $grpUnifiedSetting

If there is no result, there are no group settings for your tenant yet and you need to create them in the next 2 steps.

If you get a list of existing group settings, you do not need to create further group settings and can leave out steps 5 and 6 – instead continue with step 7 please.

5. With this command, select the settings template for “Group.Unified“:

$TemplateId = (Get-AzureADDirectorySettingTemplate | where { $_.DisplayName -eq “Group.Unified” }).Id
$Template = Get-AzureADDirectorySettingTemplate | where -Property Id -Value $TemplateId -EQ

6. Create new settings (a new settings object) with this command:

$Setting = $Template.CreateDirectorySetting()

7. Now that there are group settings for your tenant, you can enable the sensitivity label feature with this command:

$Setting[“EnableMIPLabels”] = “True”

8. Depending on whether there were already existing group settings in your tenant, select one of the two following commands to save the changes:

  • Save the changes for new group settings:
New-AzureADDirectorySetting -DirectorySetting $Setting
  • Save the changes for already existing group settings:
Set-AzureADDirectorySetting -Id $grpUnifiedSetting.Id -DirectorySetting $Setting

9. Check if the sensitivity label feature has been enabled correctly with this command. Proof that it worked is the value for EnableMIPLabels being set to “True”.


As a last step, you need to enable the synchronization of sensitivity labels to Entra (Azure AD) in order to use the labels for M365 groups, teams or SharePoint sites from Entra directly.

10. Install and connect the necessary Security & Compliance module with these commands:

Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

11. Sign in to Entra with your admin account.

12. And finally, synchronize your sensitivity labels to Entra (Azure AD) with the following command:


You will now be able to create and use sensitivity labels for teams, Microsoft 365 groups and SharePoint sites in the Microsoft Compliance Center / Microsoft Purview:

Go to https://compliance.microsoft.com/ and click on „Information Protection“. 

Information protection in Microsoft Compliance Center / Purview

Here you will now find the option to create new labels.

Microsoft Compliance Center / Purview: Create a new sensitivity label

In the process of creating new labels, you can apply the label to groups and sites. In the following process, you can also determine sharing options and external access for the M365 group.

Apply label to groups / sites in Microsoft Compliance Center / Purview

Options for Sensitivity Labels

There are a lot of things that could be considered for several options when it comes to Sensitivity Labels. 

The most important three are: 

  • Sharing very limited and only possible inside the organisation and not to guests. 
  • Sharing possible with guests inside of a M365 group 
  • Sharing possible with anyone with the link. – Attention! Please be careful with this setting: This should only be for M365 groups where data is shared that is open to everyone.  – In most cases this option should not be made available at all. 

For more information and tips for troubleshooting common issues, take a look at this article in Microsoft Learn:

Prevent uncontrolled growth in Microsoft Teams with Teams Manager

Apply sensitivity labels automatically

If you want to apply sensitivity labels to teams, groups or sites automatically, Teams Manager is the tool for you. The M365 governance app allows you to create templates and automations to reduce your routine manual work.

Take a look at how Teams Manager can help you:

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Copyright 2021 © Solutions2Share GmbH

Terms and conditions Privacy policy Cookie Policy Imprint

Send this to a friend