1. Home
  2. Training Library
  3. Microsoft 365
  4. Microsoft 365 Courses
  5. A Practical Guide to Sensitivity Labels

Enabling Groups and Sites Demo



The course is part of this learning path

Start course

Sensitivity labels are one way that data classification can be applied to files and documents. Aside from labels built into Microsoft 365, you can define custom labels and apply them to documents manually or automatically via rules. In this course, we create a sensitivity label and apply it to a document and then change that document's label. Labels are embedded in documents allowing classification to follow a document from one domain or file system to another. We look at how label embedding is achieved. Finally, we see how to integrate MS365 sensitivity label functionality with Azure AD groups and sites.

Learning Objectives

  • Create a sensitivity label
  • Use a sensitivity label
  • See how sensitivity labels are implemented within an MS365 Office document
  • Learn how to integrate sensitivity label functionality with Azure AD groups and sites

Intended Audience

  • Students who want to take a practical and in-depth look at sensitivity labels, from their creation, application, and how they are implemented within an office document



If you recall, when I set up my sensitivity label, groups and sites were disabled in the scope section. Enabling this option requires synchronizing Microsoft Purview functionality with Azure AD using PowerShell commands. I've opened a PowerShell command window as an administrator, although Microsoft says you don't need to run the commands with elevated privileges. We first need to install the Azure AD Preview module with the install module command. Next, import the newly installed module, and then log into Azure AD with your office account as opposed to a Microsoft or windows login account. 

Once connected with the correct account, run Get-AzureADDirectorySettingTemplate to display setting templates with their ids. We want the id of the group unified template to use to get the template. This two-step process is slightly easier than typing in the GUID of the template. Next, we create a setting entry for the template with CreateDirectorySetting. I'll use a dummy URL for the usage guidelines URL setting, but the following setting, EnableMIPLabels is the important one. This setting tells Azure AD, which manages user groups, to enable Microsoft information protection labels. Finally, we instantiate the setting with the New-AzureADDirectorySetting command. Use setting.values to display all the settings values.  

Let’s head back to labels in the purview portal to see the change. Editing the label under information protection, groups and sites is now enabled under scope, and the checkboxes under groups and sites are also enabled.

About the Author
Learning Paths

Hallam is a software architect with over 20 years experience across a wide range of industries. He began his software career as a  Delphi/Interbase disciple but changed his allegiance to Microsoft with its deep and broad ecosystem. While Hallam has designed and crafted custom software utilizing web, mobile and desktop technologies, good quality reliable data is the key to a successful solution. The challenge of quickly turning data into useful information for digestion by humans and machines has led Hallam to specialize in database design and process automation. Showing customers how leverage new technology to change and improve their business processes is one of the key drivers keeping Hallam coming back to the keyboard.