Extend sensitivity labels to SharePoint, groups and sites, with default and automatic labelling

Description

On top of published labels (CB-M365-DATA-005):

• sensitivity labels are enabled for Office files in SharePoint and OneDrive (EnableAIPIntegration = True), so that labelled and encrypted files can be searched, co-authored and scanned by DLP;
• labels are enabled for Microsoft 365 groups, Teams and SharePoint sites (directory setting EnableMIPLabels = True), and at least one label defines privacy, external sharing and guest access settings for containers;
• the publishing policy sets a default label for documents and emails, and requires a justification to remove or lower a label;
• at least one auto-labelling policy (service-side, or client-side in the label) applies a label to content that matches the sensitive information types of CB-M365-DATA-001, and is turned on after simulation.

Rationale

Manual labelling alone leaves most content unlabelled. Default labels and automatic labelling give a baseline classification without user effort, container labels carry the classification to Teams and sites where data is shared, and SharePoint integration keeps encrypted files usable by search, eDiscovery and DLP instead of making them opaque.

Impact

Service-side auto-labelling needs Microsoft 365 E5 or E5 Compliance (or the Information Protection and Governance add-on). Container labels change the options shown to users when they create a team or site. Run auto-labelling in simulation and review matches before turning it on.

Audit

1. In SharePoint Online PowerShell (as at least a SharePoint Administrator in read use, or with Global Reader through the SharePoint admin center), run Get-SPOTenant | Select-Object EnableAIPIntegration and check it is True.
2. In Microsoft Graph PowerShell (scope Directory.Read.All), run (Get-MgBetaDirectorySetting | Where-Object DisplayName -eq 'Group.Unified').Values and check that EnableMIPLabels is True.
3. In the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader, browse to Solutions > Information Protection > Sensitivity labels and check that at least one label has the Groups & sites scope configured.
4. Open Publishing policies and check that a default label is set for documents and emails and that Users must provide a justification to remove a label or lower its classification is on. PowerShell: Get-LabelPolicy | Format-List Name,Settings.
5. Browse to Solutions > Information Protection > Auto-labeling policies and check that a policy is On (not in simulation). PowerShell: Get-AutoSensitivityLabelPolicy | Format-List Name,Mode,ApplySensitivityLabel.
6. Fail if any of these elements is missing.

Remediation

1. In SharePoint Online PowerShell as a SharePoint Administrator: Set-SPOTenant -EnableAIPIntegration $true.
2. As a Global Administrator, set EnableMIPLabels to True in the Group.Unified directory setting (Graph PowerShell Update-MgBetaDirectorySetting), then synchronize labels with Execute-AzureAdLabelSync in Security & Compliance PowerShell.
3. In the Microsoft Purview portal as an Information Protection Admin, edit the labels to add the Groups & sites scope with privacy, external user access and sharing settings.
4. Edit the publishing policy: set a default label for documents and emails and require justification for label removal.
5. Create an auto-labeling policy for the sensitive information types of CB-M365-DATA-001 on Exchange, SharePoint and OneDrive, run it in simulation, review, then turn it on.

Rollback

Set the auto-labelling policy back to simulation, remove the default label from the publishing policy, or set EnableAIPIntegration to False.

References

• Enable sensitivity labels for Office files in SharePoint and OneDrive Microsoft, vendor-doc, accessed 2026-10-24
• Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites Microsoft, vendor-doc, accessed 2026-10-24
• Apply a sensitivity label to content automatically Microsoft, vendor-doc, accessed 2026-10-24
• ASD Blueprint for Secure Cloud Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• requires CB-M365-DATA-005 Publish sensitivity labels to all users
• related CB-M365-TENANT-007 Allow public Microsoft 365 groups only when approved
• related CB-M365-POWER-015 Enable sensitivity labels for Fabric and Power BI content

People and lifecycle