How to Use Sensitivity Labels in the Microsoft Teams Admin Center

If you are looking to protect and regulate access to sensitive organizational content created during collaboration within Microsoft Teams, admins can use sensitivity labels in the Microsoft Teams Admin Center to do so. After configuring sensitivity labels—with their associate policies—in the Microsoft compliance center, users can then select sensitivity labels based on their needs when creating new teams in Microsoft Teams.

Instructions for using sensitivity labels

Users can apply sensitivity labels when they create or edit a team in the Microsoft Teams admin center. Sensitivity labels are also visible in team properties, and in the Classification column on the Manage teams page of the Microsoft Teams admin center.

Click on the following link to view instructions from Microsoft 365 documentation on how to create and configure sensitivity labels for Teams:

Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites

Scenarios for sensitivity labels

Users can use sensitivity labels with Microsoft Teams in their organization to set the privacy level for teams and for controlling guest access to teams.

Set the privacy level for teams

Create and configure a sensitivity label that, when applied during team creation, allows users to create teams with a specific privacy (public or private) setting.

For example, if an admin creates and publishes a sensitivity label named “Confidential” with a label privacy option configured as “Private”, any team that’s created with this label in the future will also be a private team. Therefore, when a user creates a new team and selects the Confidential label, the only privacy option that’s available to the user is Private—other privacy options, such as Public and Org-wide, will not be available options for the user to select.

Similarly, if an admin creates and publishes a sensitivity label named “General” with a label privacy option configured as “Public”. When a user creates a new team, they can only create public or org-wide teams when they select this label.

When the team is created, the sensitivity label is visible in the upper-right corner of Channels in the team.

Note: If you are using hierarchical parent-child labels such as “Confidential\Finance”, then only the parent label will be shown in the channel header.

A team owner can change the sensitivity label and the privacy setting of the team at any time by going to the team, and then click Edit team.

Want to easily manage, govern, and secure your Microsoft Teams environment with Team Captain? Click here to find out how to start a free 14-day trial!

Control guest access to teams

Users can also use sensitivity labels to control guest access to their teams. Teams created with a label that doesn’t allow guest access are only available to users in their organization. People outside the organization can’t be added to the team.

Be aware of these limitations

• Parent label names aren’t displayed for sublabels

Teams supports sublabels, but doesn’t display the name of the parent label. For example, Confidential \ All Employees displays as All Employees.

• Sensitivity labels aren’t supported by Teams Graph APIs, PowerShell cmdlets, and templates

Users won’t be able to specify sensitivity labels while creating teams directly through Teams Graph APIs, Teams PowerShell cmdlets, and Teams templates. However, Modern Groups Graph APIs and PowerShell cmdlets do allow the creation of groups with labels. So, users can first create Groups with labels using Groups Graph APIs or PowerShell cmdlets, and then convert these Groups into Teams.

• Support for private channels

Private channels that are created in a team automatically inherit the sensitivity label that was applied on a team. Additionally, the same label is automatically applied on the SharePoint site collection for the private channel.

However, if a user directly changes the sensitivity label on a SharePoint site for a private channel, that label change isn’t reflected in the Teams client. In this scenario, users continue to see the original sensitivity label applied on the team in the private channel header.

Sensitivity labels are also not currently supported in class teams for clients using Teams Education SKUs.

More Information

The content for this post is available on the Microsoft documentation site for Teams compliance: https://docs.microsoft.com/en-us/microsoftteams/sensitivity-labels#control-guest-access-to-teams.

If you are looking to simplify and automate the manual approach to governing and managing your company’s Microsoft Teams environment, learn more about Team Captain by MessageOps and start a 14-day free trial of this easy-to-use Microsoft Teams governance platform. Contact MessageOps at 877-788-1617 or get started here.