Container labels are configured for collaborative workspaces

Overview

Container labels extend sensitivity labels beyond individual items to entire collaboration workspaces like Microsoft Teams, Microsoft 365 Groups, SharePoint sites, Viva Engage communities, and Loop workspaces. These labels can control workspace-level settings such as external sharing, guest access, device restrictions, and privacy.

Without container labels, users might be able to create Teams with external guest access even when handling confidential information. This action creates data exfiltration risks where properly labeled documents exist in improperly secured workspaces. Container labels can help to ensure that workspace security matches the sensitivity of stored content, for example, prevent documents labeled as “Highly Confidential” from residing in Teams sites that permit external sharing.

Remediation

• Use sensitivity labels to protect collaborative workspaces (groups and sites)

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	High
Pillar	Data, AI
Category	Sensitivity Labels Configuration
Product	Purview
Feature	Information protection
Area	Data protection
ATT&CK	T1213.002 Sharepoint
Licence	RMS_S_PREMIUM2, Microsoft 365 E5
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.