Sensitivity labels on teams

Two kinds of label — don't conflate them

• Content labels stamp files/emails (encryption, markings). They follow documents into channel storage but do not govern the team.
• Container labels stamp the GROUP/TEAM/SITE itself and enforce structure: privacy (public/private locked), guest membership allowed or not, external sharing level of the backing site, and unmanaged-device access. Same label technology, completely different job.

Why they outrank your settings

When a container label sets "no guests", that binds this team even though tenant guest access is on. The evaluation is: label wins over org default for the labelled container. This inversion is the trap: admins look at tenant-level switches, see "allowed", and can't explain why "Add member" rejects a guest on one team. The answer is Purview, not TAC.

Label policies decide who can apply which labels and whether labelling is mandatory at creation — which turns team creation into a governed decision ("pick Confidential or Internal") instead of an afterthought.

Operational realities

• Changing a label's settings re-applies to every labelled container — a quiet mass-change tool (and a quiet mass-outage tool if you flip guest access off on a label used by 400 project teams).
• Label changes on a team need a labelled-container-aware client — old clients hide the picker.
• Site-level sharing set by label can conflict with SPO-admin manual settings; label reasserts on evaluation. If a site sharing setting keeps "reverting", it's the label.
• Labels don't retro-govern content: applying "no guests" doesn't evict existing guests — audit and remove separately.

What to watch (proofs)

• A team's label and the settings it imposes: Get-UnifiedGroup <team> | fl SensitivityLabel then in Purview the label's group/site settings — read them together; the label GUID→policy mapping is the "why" for every mystery block.
• Guest-block in action: attempt to add a guest to a labelled team; the audit log records the attempt + failure with the label as context.
• Reversion fights: SPO site sharing capability changing without an actor in audit = label re-assertion.
• Coverage report: Purview > Information protection > Label analytics — how much of the estate is labelled at all; unlabeled teams are your ungoverned surface.