Microsoft Purview: Internal Sensitivity Label Configuration — Access and Sharing Issues

Lee Zhen Peng 0 Reputation points
2026-10-07T02:48:14.4266667+00:00

Problem description

I am seeking assistance with configuring a sensitivity label in Microsoft Purview to be used solely for internal purposes and to disable sharing options. The current behavior is causing access issues within my organization when sharing protected documents via Teams, SharePoint, and OneDrive.

Environment

Microsoft Purview, sensitivity labels, in a Microsoft 365 collaboration environment.

What I've already tried

I have reviewed the label configuration and publishing settings, and confirmed the label is applied to relevant content. However, I have not made specific configuration changes or tested different label policies or DLP rules related to sharing restrictions.

Current status

I am looking for guidance on how to properly configure the sensitivity label and associated policies to ensure that only internal users can access the content and that sharing options like "Anyone" are effectively disabled, preventing external sharing and resolving internal access issues.

Microsoft Security | Microsoft Purview

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Said A 1,136 Reputation points
    2026-10-12T13:54:21.01+00:00

    Hello,

    I agree with the comment provided by @Maksood Ahmed , a combination of encryption and DLP should acheive your intended results.

    A few additional points to keep in mind during testing and deployment:

    • If users access documents through Office desktop applications, verify that they are signed in with their organizational accounts. Otherwise, they may encounter unexpected access-denied errors.
    • When using group-based permissions in the encryption settings, ensure that group membership is up to date, as stale memberships can lead to unintended access issues. (In your case, it's better to not use group based encryption but rather just keep it configured to the domain.)

    Regards,

    Said

    Was this answer helpful?

    0 comments
  2. Maksood Ahmed 195 Reputation points Microsoft External Staff Moderator
    2026-10-07T11:10:17.5333333+00:00

    Hi @Lee Zhen Peng ,

    Thank you for providing the details.

    For this requirement, please configure the sensitivity label in two parts:

    1. Allow access only to internal users

    Edit the sensitivity label in Microsoft Purview and enable encryption. Under Assign permissions now, add the required users or groups from your organization. Avoid selecting specific individuals unless only those users should access the files.

    This ensures that authorized internal users can open the protected documents, even when the documents are shared through Teams, SharePoint, or OneDrive.

    1. Prevent external sharing

    Encryption controls who can open the file, but it does not remove the sharing options shown in Teams, SharePoint, or OneDrive.

    To block external sharing:

    • If the label is applied to a Team or SharePoint site, configure the label’s Groups & sites settings and set external sharing to Only people in your organization.
    • If the requirement is to block external sharing of individual labeled files, create a Microsoft Purview DLP policy for SharePoint and OneDrive that detects the sensitivity label and blocks sharing with people outside the organization.

    Please note that applying a label to a Team or SharePoint site does not automatically encrypt every file stored inside it. The site label controls the workspace’s sharing settings, while the file label controls access to the document itself.

    I recommend testing the configuration with a small group before publishing it to all users. Confirm that:

    • Authorized internal users can open and edit the protected files.
    • External users cannot access the files.
    • “Anyone” links are unavailable or blocked for the labeled site or content.

    FYR:

    Apply encryption using sensitivity labels

    Use sensitivity labels to protect Teams, groups, and SharePoint sites

    Prevent external sharing through Microsoft Purview DLP

    Regards,
    Maksood

    Was this answer helpful?

    0 comments