Question

A financial services company uses sensitivity labels for both documents and containers. The compliance team wants to apply a single label that, when selected on a new Microsoft Teams team, automatically sets the underlying SharePoint site's external sharing to 'Existing guests only', blocks access from unmanaged devices, and enforces private team privacy. The same label, when applied to a Word document, must also encrypt the file with a specific permission set. The architect must design the label configuration to meet all these requirements. Which approach should be used?

Accepted Answer

Create one sensitivity label that has both item-level (encryption/content marking) scopes and 'Groups & sites' scope enabled, configuring privacy, external sharing, and unmanaged device settings in the container protection section and encryption in the item section

Answer

Create a DLP policy targeting Teams sites for the container controls and a separate sensitivity label scoped only to files for the encryption requirement

Answer

Use a Conditional Access policy to enforce the unmanaged device and external sharing restrictions, and a sensitivity label scoped to items only for encryption

Answer

Create two separate sensitivity labels—one scoped to Groups & sites and one scoped to files—and require users to apply both to Teams that contain sensitive documents