Microsoft Purview | Information Protection: Sensitivity labels for Microsoft Entra security groups

Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026, allowing administrators to apply and enforce governance policies on these groups. Labels can be assigned via multiple platforms, cannot yet be changed once applied, and require separate tenant configuration from Microsoft 365 groups. Microsoft Purview is introducing sensitivity labels for Microsoft Entra cloud security groups. This capability extends label-based protection currently available for Microsoft 365 groups and SharePoint sites to cloud security groups. With this change, organizations can apply published Microsoft Purview sensitivity labels directly to security groups and automatically enforce membership and guest access policies when groups are created or labeled. This helps administrators apply governance policies consistently across group types, reduce the risk of oversharing, and support controlled self-service group creation. This message is associated with Microsoft 365 Roadmap ID 568217. Rollout schedule General Availability (Worldwide): Beginning in mid-November 2026 and expected to complete in late November 2026 Impact on your organization Who is affected Microsoft Entra administrators Microsoft Purview administrators Organizations that use or plan to use sensitivity labels to govern access to Microsoft Entra security groups Platforms and services Microsoft Purview Microsoft Entra ID Microsoft Entra admin center Azure portal Microsoft Graph PowerShell What will happen Administrators will be able to apply published Microsoft Purview sensitivity labels to cloud security groups during group creation or after a group has been created. Labels can be assigned through the Microsoft Entra admin center, Azure portal, PowerShell, or Microsoft Graph. Existing sensitivity label functionality for Microsoft 365 groups will remain unchanged. Once a sensitivity label is applied to a security group, the label cannot currently be changed or removed. Support for changing assigned labels will be introduced in a future update. Sensitivity labels can be used to enforce organizational membership and guest access policies for security groups. Action required and recommendations No action is required to receive this change. To use sensitivity labels with Microsoft Entra security groups after rollout: Confirm that your organization has eligible licensing, such as Microsoft 365 E3 or Microsoft 365 E5, which includes Microsoft Entra ID P1. In the […]

The post Microsoft Purview | Information Protection: Sensitivity labels for Microsoft Entra security groups appeared first on M365 Admin.