Microsoft Purview: Internal Sensitivity Label Configuration — Access and Sharing Issues

Question

Microsoft Purview: Internal Sensitivity Label Configuration — Access and Sharing Issues

Lee Zhen Peng 0

Problem description

I am seeking assistance with configuring a sensitivity label in Microsoft Purview to be used solely for internal purposes and to disable sharing options. The current behavior is causing access issues within my organization when sharing protected documents via Teams, SharePoint, and OneDrive.

Environment

Microsoft Purview, sensitivity labels, in a Microsoft 365 collaboration environment.

What I've already tried

I have reviewed the label configuration and publishing settings, and confirmed the label is applied to relevant content. However, I have not made specific configuration changes or tested different label policies or DLP rules related to sharing restrictions.

Current status

I am looking for guidance on how to properly configure the sensitivity label and associated policies to ensure that only internal users can access the content and that sharing options like "Anyone" are effectively disabled, preventing external sharing and resolving internal access issues.

Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-07T11:10:17.5333333+00:00
Hi @Lee Zhen Peng ,

Thank you for providing the details.

For this requirement, please configure the sensitivity label in two parts:

Allow access only to internal users

Edit the sensitivity label in Microsoft Purview and enable encryption. Under Assign permissions now, add the required users or groups from your organization. Avoid selecting specific individuals unless only those users should access the files.

This ensures that authorized internal users can open the protected documents, even when the documents are shared through Teams, SharePoint, or OneDrive.

Prevent external sharing

Encryption controls who can open the file, but it does not remove the sharing options shown in Teams, SharePoint, or OneDrive.

To block external sharing:

If the label is applied to a Team or SharePoint site, configure the label’s Groups & sites settings and set external sharing to Only people in your organization.

If the requirement is to block external sharing of individual labeled files, create a Microsoft Purview DLP policy for SharePoint and OneDrive that detects the sensitivity label and blocks sharing with people outside the organization.

Please note that applying a label to a Team or SharePoint site does not automatically encrypt every file stored inside it. The site label controls the workspace’s sharing settings, while the file label controls access to the document itself.

I recommend testing the configuration with a small group before publishing it to all users. Confirm that:

Authorized internal users can open and edit the protected files.

External users cannot access the files.

“Anyone” links are unavailable or blocked for the labeled site or content.

FYR:

Apply encryption using sensitivity labels

Use sensitivity labels to protect Teams, groups, and SharePoint sites

Prevent external sharing through Microsoft Purview DLP

Regards,
Maksood

Your answer

Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-07T11:10:17.5333333+00:00

Hi @Lee Zhen Peng ,

Thank you for providing the details.

For this requirement, please configure the sensitivity label in two parts:

Allow access only to internal users

Edit the sensitivity label in Microsoft Purview and enable encryption. Under Assign permissions now, add the required users or groups from your organization. Avoid selecting specific individuals unless only those users should access the files.

This ensures that authorized internal users can open the protected documents, even when the documents are shared through Teams, SharePoint, or OneDrive.

Prevent external sharing

Encryption controls who can open the file, but it does not remove the sharing options shown in Teams, SharePoint, or OneDrive.

To block external sharing:

If the label is applied to a Team or SharePoint site, configure the label’s Groups & sites settings and set external sharing to Only people in your organization.

If the requirement is to block external sharing of individual labeled files, create a Microsoft Purview DLP policy for SharePoint and OneDrive that detects the sensitivity label and blocks sharing with people outside the organization.

Please note that applying a label to a Team or SharePoint site does not automatically encrypt every file stored inside it. The site label controls the workspace’s sharing settings, while the file label controls access to the document itself.

I recommend testing the configuration with a small group before publishing it to all users. Confirm that:

Authorized internal users can open and edit the protected files.

External users cannot access the files.

“Anyone” links are unavailable or blocked for the labeled site or content.

FYR:

Apply encryption using sensitivity labels

Use sensitivity labels to protect Teams, groups, and SharePoint sites

Prevent external sharing through Microsoft Purview DLP

Regards,
Maksood