Forum Discussion
How to Monitor Changes to Sensitivity Labels Used for Container Management
Sensitivity labels are an effective way to manage containers like Teams, Microsoft 365 Groups, and SharePoint sites. Microsoft doesn’t provide any way to track changes made to labels assigned to ...
Use sensitivity labels to block guest access and apply the labels to the groups you want to keep guest-free. Then no one except an administrator can add a new member to those groups.
That was my original plan after reading your articles - but can't group owners change sensitivity labels?
- And the thing is, if a group owner keeps on changing the label assigned to a group with the intention of adding guests to a team that discusses confidential information, isn't that an opportunity for HR to flex their muscles and acquaint said owner with the wonders of a disciplinary process?
- That's absolutely an opportunity - But at that point the data could have already been exposed to someone who shouldn't have seen it. It sounds like there isn't really an airtight method at this point in time. I know we can get into data protection and those other options, but it seems like protecting the container and making it so it can't be changed by anyone but an admin is something that could be added to the out of the box functionality.
1. User creates Team
2. Team gets default sensitivity label prohibiting guest access that the owner cannot change
3. User requests review and approval for Team to be opened up for guest access- Yep, that would be nice.
- They can, but it's easy to detect and reverse the changes... Just like people who try and add new members to the site used by a private channel via SharePoint, only to find that Teams overwrites the changes they made a few hours later....