Label separation control [General Availability]

Label separation control [General Availability]

Label separation control between Files & emails to Site & Groups is Generally Available within the Microsoft 365 Compliance Portal.

Read more about it at: Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites – Microsoft 365 Compliance | Microsoft Docs

Integration

Enabling sensitivity labels for containers means that you can now configure protection settings for groups and sites in the sensitivity labeling wizard. Until you enable this support, the settings are visible in the wizard but you can’t configure them.

• Follow the general instructions to create or edit a sensitivity label and make sure you select Groups & sites for the label’s scope:

Note : When only this scope is selected for the label, the label won’t be displayed in Office apps that support sensitivity labels and can’t be applied to files and emails.

For example, you need to carefully review your label ordering because SharePoint detects when a labeled document is uploaded to a labeled site. In this scenario, an audit event and email is automatically generated when the document has a higher priority sensitivity label than the site’s label. For more information, see the Auditing sensitivity label activities section on this page.

• Then, on the Define protection settings for groups and sites page, select one or both of the available options:
  • Privacy and external user access settings to configure the Privacy and External users access settings.
  • Device access and external sharing settings to configure the Control external sharing from labeled SharePoint sites and Access from unmanaged devices setting.

• If you selected Privacy and external user access settings, now configure the following settings:
  • Privacy: Keep the default of Public if you want anyone in your organization to access the team site or group where this label is applied. Select Private if you want access to be restricted to only approved members in your organization. Select None when you want to protect content in the container by using the sensitivity label, but still let users configure the privacy setting themselves.
  • External user access: Control whether the group owner can add guests to the group.

• If you selected Device access and external sharing setting, now configure the following settings:
  • Control external sharing from labeled SharePoint sites: Currently in preview, select this option to then select either external sharing for anyone, new and existing guests, existing guests, or only people in your organization. For more information about this configuration and settings, see the SharePoint documentation, Turn external sharing on or off for a site.
  • Access from unmanaged devices: This option uses the SharePoint feature that uses Azure AD conditional access to block or limit access to SharePoint and OneDrive content from unmanaged devices. For more information, see Control access from unmanaged devices from the SharePoint documentation. The option you specify for this label setting is the equivalent of running a PowerShell command for a site, as described in steps 3-5 from the Block or limit access to a specific SharePoint site or OneDrive section from the SharePoint instructions.

Sources

https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view=o365-worldwide#how-to-configure-groups-and-site-settings