# Container labels are configured for collaborative workspaces
Container labels extend sensitivity labels beyond individual items to entire collaboration workspaces like Microsoft Teams, Microsoft 365 Groups…
Source: https://maester.dev/docs/tests/ZTA.35012
## Overview
Container labels extend sensitivity labels beyond individual items to entire collaboration workspaces like Microsoft Teams, Microsoft 365 Groups, SharePoint sites, Viva Engage communities, and Loop workspaces. These labels can control workspace-level settings such as external sharing, guest access, device restrictions, and privacy.
Without container labels, users might be able to create Teams with external guest access even when handling confidential information. This action creates data exfiltration risks where properly labeled documents exist in improperly secured workspaces. Container labels can help to ensure that workspace security matches the sensitivity of stored content, for example, prevent documents labeled as "Highly Confidential" from residing in Teams sites that permit external sharing.
## Remediation
- [Use sensitivity labels to protect collaborative workspaces (groups and sites)](https://learn.microsoft.com/purview/sensitivity-labels-teams-groups-sites?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | High |
| Pillar | Data, AI |
| Category | Sensitivity Labels Configuration |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Information protection |
| Area | Data protection |
| ATT&CK | [T1213.002](/docs/tests?mitre=T1213.002) Sharepoint |
| Licence | RMS_S_PREMIUM2, Microsoft 365 E5 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.