Blocking the creation of public M365 Groups in Microsoft Teams and SharePoint Online with Sensitivity Labels

Introduction

In a collaborative environment like Microsoft Teams, the ease with which users can create new spaces is both a strength and a potential source of risk. The uncontrolled proliferation of public M365 groups can expose sensitive data, create organisational confusion and make it hard to maintain consistent governance of the tenant.

The most effective solution is not to restrict group creation across the board, but to enforce a controlled privacy setting from the moment a group is created. This article shows how to do that with Sensitivity Labels in Microsoft Purview Information Protection.

Why Sensitivity Labels are the right choice

In Microsoft Teams, creating a team means creating a Microsoft 365 Group. If the goal is to stop public groups from being created while still allowing private teams, the right approach is not to block creation outright, but to govern it.

Sensitivity Labels let administrators define privacy rules that are applied automatically when groups, teams and SharePoint sites are created. The result is granular control that doesn’t get in the way of user productivity, but channels it within the boundaries set by the organisation.

Prerequisites

Before you start, make sure you have:

• A Microsoft 365 licence that supports Sensitivity Labels for Teams, SharePoint and Groups (typically M365 E3 with an add-on, or E5, or equivalent).
• Access to the Microsoft Purview Compliance Portal (https://purview.microsoft.com).
• Administrator permissions to create and publish labels.

Step-by-step procedure

1. Enable Sensitivity Labels for Teams and Groups

First of all, check that the feature is enabled in your tenant.

Go to the Microsoft Purview Compliance Portal → Information Protection → Labels and check that labels are enabled for Teams, Groups and Sites.

If the feature isn’t enabled, you can turn it on via PowerShell by following the official Microsoft guide.

2. Create the Sensitivity Label

Now let’s create the label that will enforce privacy when the group is created. Click Create a label and configure the settings so they are clear to both administrators and end users. This is the configuration I chose:

For the Scope, select Groups & Sites: this automatically includes Teams and M365 Groups.

In the Protection Settings, select Privacy and external user access and set Privacy to Private. In this case I chose to keep guest user access enabled, but you can disable it according to your organisation’s policies.

Save the label.

3. Create and publish a Label Policy

The label you’ve just created isn’t visible to users yet: to make it operational, you need to publish it through a Label Policy.

Go to the Label Policies section in the Purview Portal and create a new policy that includes:

• The label Collaborazione interna – Gruppi privati.
• As the target, you can choose all users or a specific Distribution List.
• Under Default settings for Groups & Sites, set the label as the default and tick Require users to apply a label to their groups or sites — this step is essential to get the desired effect.

Give the policy a name and description, then publish it.

4. How to exclude individual users or groups from the policy

If you want to apply the policy to the whole organisation but leave some users — for example an IT group that handles requests through tickets or internal portals — free to create public groups, you can only do so via PowerShell.

The graphical interface of the Purview Compliance Portal does not support exceptions when the policy is configured with the All target: the feature only exists on the PowerShell side.

Prerequisite — connect to the Security & Compliance module:

Connect-IPPSSession

Exclude individual users:

Set-LabelPolicy -Identity "Nome della tua Policy" `
    -AddExchangeLocationException "utente1@dominio.com", "utente2@dominio.com"

Exclude all members of a Distribution List or group:

[array]$Members = Get-DistributionGroupMember -Identity "Nome del gruppo IT" |
    Where-Object { $_.RecipientTypeDetails -eq "UserMailbox" } |
    Select-Object -ExpandProperty PrimarySmtpAddress

Set-LabelPolicy -Identity "Nome della tua Policy" -AddExchangeLocationException $Members

Check the active exceptions on the policy:

[array]$Exclusions = Get-LabelPolicy -Identity "Nome della tua Policy" |
    Select-Object -ExpandProperty ExchangeLocationException
$Exclusions.Name

Remove an exception:

Set-LabelPolicy -Identity "Nome della tua Policy" `
    -RemoveExchangeLocationException "utente1@dominio.com"

Note: Exceptions don’t take effect immediately. Outlook and Teams clients refresh their cache from the Information Protection Service on their own schedule; you may need to wait before the change is visible to the excluded users.

5. Propagation and verification

Changes aren’t applied instantly: the policy can take up to 24 hours to propagate to all users and services in the tenant.

Once propagation is complete, the behaviour will be as follows:

• When creating a Team, users will see the default label Collaborazione interna – Gruppi privati already selected.
• The option to create a public Team will be disabled (greyed out and not selectable).
• It won’t be possible to remove the label or select “None”, provided the policy is correctly configured with the mandatory label.

Creating a Team in Microsoft Teams:

Creating a Team Site in Microsoft SharePoint Online:

Pitfalls and tips

Mandatory label and policy priority — to stop users getting around the configuration by selecting “None”, make sure the label is marked as mandatory in the policy and that the policy has the highest priority over any other policies active in the tenant.

Licensing — some advanced Sensitivity Labels features (such as content encryption or specific compliance integrations) may require higher-tier licences, such as Microsoft 365 E5, Teams Premium or dedicated compliance add-ons.

Test before rollout — before applying the configuration to the whole organisation, always test it in a pilot environment or with a small group of users. The 24-hour propagation makes correction cycles slow, so it’s better to validate the configuration up front.

Conclusion

Sensitivity Labels are a powerful tool for governing how collaborative spaces are created in Microsoft 365. With the configuration described in this article, you can ensure that all new Teams and SharePoint sites start life with a controlled level of privacy, reducing the risk of accidental data exposure and simplifying compliance management.

All without sacrificing flexibility: thanks to PowerShell exceptions, you can always grant broader privileges to those who genuinely need them.