Mark new files as sensitive by default

According to this article https://docs.microsoft.com/en-us/sharepoint/sensitive-by-default

I run the cmdlet Set-SPOTenant -MarkNewFilesSensitiveByDefault BlockExternalSharing

But it does not work as expected.  

When new files are added to SharePoint or OneDrive in Microsoft 365, they still can share with external users in the first few minutes. After a few minutes the DLP policy scan the files and add policy tips and block icons, then I no longer can share those files with external contacts. Any thought on this issue?

Thanks, Peter