Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/10-security-and-compliance/feature-security-sensitivity-labels-teams-and-meetings.md
feature-security-sensitivity-labels-teams-and-meetings.mdv1 · history
CurrentApplies to Teams Enterprise, Teams PremiumUpdated 3 weeks agoSource Microsoft Learn ↗

What it does

Purview sensitivity labels applied at two levels in Teams. Container labels sit on the team (and its Microsoft 365 group and SharePoint site) and control privacy, guest access, sharing and device access. Meeting labels sit on the invite and force meeting options: lobby, presenters, recording, chat copy, watermarking and encryption.

Key facts

  • Container labels need the Groups & sites scope and the feature switched on in Entra ID, then Execute-AzureAdLabelSync run from a Connect-IPPSSession session.
  • Container settings: privacy (public, private, or user's choice), guest access, SharePoint external sharing level, unmanaged device access (block or web-only), authentication context, private team discoverability, shared channel controls (internal only, same label only, private team only), and a default label for channel meetings.
  • Container labels don't encrypt the files or messages inside the team. Items don't inherit them.
  • Shared channels inherit the parent team's label and it can't be changed.
  • New labels take at least 1 hour to replicate (24 hours if they use shared channel controls); changes to existing labels take at least 24 hours.
  • Meeting labels need the Files & other data assets, Emails and Meetings scopes together, and the Protect Teams meetings and chat setting.
  • Meeting label settings include lobby bypass, who can present, who can record, automatic recording, video encryption, watermarking of camera and shared content, preventing copy and forward of meeting chat, captions and transcripts, and detecting sensitive content in screen shares.
  • Configuring the meeting options through labels needs Teams Premium; the base labelling entitlement comes from the Purview licence.
  • A label on the calendar invite flows to the meeting, so protection applies before it starts. Channel meetings take the container label's associated meeting label and users can't change it.
  • Not supported: S/MIME and Double Key Encryption on meetings, auto and recommended labelling for meetings, on-premises mailboxes, and group calendar invites in Outlook. Meet Now meetings can't use the recording, watermark or E2EE settings.
  • Copy prevention covers right-click copy, Ctrl+C, forwarding, Share to Outlook and copy link. It doesn't stop screenshots or a phone camera.

When to use / skip

Container labels are worth it for almost any organisation that already has a labelling taxonomy and more than a handful of teams with guests. They're the cleanest way to stop someone creating a public team called "M&A Project Falcon" or adding guests to a team marked Highly Confidential, and they're enforced the same way across Teams, SharePoint and the group.

Meeting labels are a narrower sell. They earn their keep for boards, deal teams and HR casework, where the client wants the same protections every time without trusting the organiser to set meeting options. If the client doesn't have Teams Premium, or has a labelling scheme nobody uses, park meeting labels and fix the basics first.

Configuration decisions

  • Whether to reuse the existing document taxonomy or create container-specific sublabels. Mixing scopes on one label is possible but confuses people.
  • Which labels allow guests, and which allow shared channels with external organisations.
  • Unmanaged device access: block versus web-only. Both depend on Conditional Access and SharePoint app-enforced restrictions being in place.
  • Whether to use authentication context to demand step-up MFA or a compliant device for sensitive teams.
  • Whether labelling is mandatory at team creation and what the default is.
  • For meetings: which labels carry Premium protections, and who has Teams Premium to organise them.
  • Channel meeting defaults per container label.

Gotchas

  • Changing a label's guest setting only affects new guests. Existing guests stay put; you'll have to clean them up separately.
  • Plan for the 24-hour replication window on changes. Edit a label the day before go-live and you'll spend go-live explaining inconsistent behaviour.
  • Container labels look like they protect content. They don't. Clients regularly assume a Highly Confidential team means encrypted files.
  • Authentication context isn't supported everywhere; the Teams web app, Power Automate, Power Apps and third-party apps may not cope.
  • Meeting chat copy protection stops casual copying, not determined leakage. Set expectations accordingly.
  • Organisers without Teams Premium can apply a label, but the Premium-only options in it won't do what the security team expects. Licence the organisers, not just the attendees.

Consultant notes

  • Fix the container labels first; meeting labels depend on them for channel meetings anyway.
  • Test with a small pilot group with labels published only to them, then wait the full replication time before widening.
  • Pair container labels with expiration and naming policies from the governance work so the team lifecycle is one story.
  • Write down which label maps to which Conditional Access or authentication context policy; nobody can work it out later.
  • Show the client a labelled meeting end to end, including what an external attendee sees, before rollout.

Revisit after the next Purview labelling release, or if Microsoft adds auto-labelling for meetings

Was this accurate?
Related
Teams Premium meeting protection: watermarking and end-to-end encryption10-security-and-complianceInformation barriers in Teams10-security-and-complianceTeams panels: room booking, check-in and auto-release06-teams-rooms-and-devicesFacilitator agent in Teams meetings08-copilot-and-ai-in-teamsMeeting Policies, Lobby Bypass and Meeting Options02-meetings-webinars-and-eventsTeams Rooms on Windows vs Android, and Rooms Basic vs Pro13-decision-guides