Sensitivity labels can now be assigned to meetings as part of Teams Premium. This provides the ability to limit access to the meeting invite and responses in Outlook and Teams as well as the meeting and chat in Teams as well as enforce meeting options for the meeting. Sensitivity Labels will be best used in conjunction with meeting templates for the majority of users, whilst advanced users may wish to manually set the label on the meeting with or without meeting templates. More on meeting templates to follow.
The Sensitivity Label is visible on the meeting in Teams, though not currently in the position shown in the documentation, but rather under the … menu on the meeting edit screen.
In the official documentation, and presumably coming soon this should be showing next to the join button
If the label includes item encryption the meeting invite is encrypted. This encryption works in the same way as email encryption. Meaning that recipients using a mail client which can decrypt the message (such as Outlook) will be able to see the message whilst those using other clients will need to use Outlook on the Web or the encryption portal to access the invite.
There are some practical limitations to consider as well. They key ones:
- Sensitivity labels cannot be applied to instant meetings (Meet Now), Webinars or Live Events
- Automatic labelling is not supported
- Mobile clients cannot decrypt the meeting invite in calendar applications including Outlook mobile and as such a link to the encrypted content will be displayed
- Copy chat restriction is currently not supported for external users, nor in all browsers when using Teams for Web. In this case external users means anonymous users and external users who are NOT guests in your organisation.
- If the label is changed during a meeting, the changes will not apply unless the meeting ends & restarts
- Labelling meeting using the graph API is not supported
As these limitations are very likely to change as the product evolves, please do review these here for up to date information.
Create a Meeting Sensitivity Label
Sensitivity labels are created from the Microsoft Purview Compliance Portal (https://compliance.microsoft.com/) under Information Protection > Labels. General instructions on creating sensitivity labels is available in the documentation on Microsoft Learn.
To create a label for a meeting, choose Create a Label
Enter an appropriate a Name and Display name. The reason for two names is so that the display name can be reused when an updated label is required with different settings (a new version of a label) but to the users it should look the same. For example Name = SensitiveMeetingV1 and Display name = Sensitive Meeting. Add appropriate description for users and include version detail in description for admins. Finally (optional) pick a label colour. Click Next on each screen to advance to the next.
For a meeting label choose a scope of Items and Include meetings. Click Next to advance to the next screen
In protection settings encryption is used to control who can access the meeting invite, content marking is used to put header/footer into the meeting invite and Protect Teams meeting and chats is used to configure the meeting options and protection for meeting chat.
Encrypting the meeting controls access to the meeting invite, meeting details and join link, which can help ensure your meeting join information is not shared further than those invited by the organizer of the meeting. Encryption and content marking settings are the same as for all other item sensitivity labels, so here we will focus on the new settings, those for meetings and chats. Click Next to advance to the next screen
These controls set the meeting options on meetings with the sensitivity label assigned to the values set in this screen and prevent the organizer from altering those settings. After the walk through of creating the label this article discusses these options in more detail. Click Next to advance to the next screen
Auto labelling is not supported for meeting labels, so leave this option off. Click Next to advance to the next screen
As groups were not selected in the scope at the start, the group options are greyed out. Click Next to advance to the next screen
Options for schematized data assets were not selected in the scope at the start, the group options are greyed out. Click Next to advance to the next screen
Review the summary of chosen settings. You can return to any step and edit the settings if they do not look right using the Edit link on each section or click Create label if all settings are correct to create and save your label.
Once the label has been created it needs to be published to be available to users. Publishing a label is no different for a meeting label as other labels. Assuming your organization already uses sensitivity labels and you wish to add this label to an existing policy this is covered later in this article. To learn about label policies and publishing sensitivity labels see the documentation on Microsoft Learn.
Meeting Options Controls for Meetings & Chats in a Sensitivity Label
At the top of the screen is a link to learn more about these options, which points to Change participant settings for a Teams meeting – Microsoft Support. The controls which can be set within the label are as follows.
The first setting is to set the meeting lobby controls for the meeting.
When selecting people who can bypass the lobby to Everyone in my org, trusted orgs and guests, you can also choose to allow dial in users to bypass the lobby
The label can also be used to set who can present in the meeting.
By default anyone from the same organization as the meeting organizer with presenter rights in a meeting can start the recording. The recording will then be stored in the OneDrive of the user who starts the recording with the meeting organizer having owner rights and ability to change permissions, expiry date and video settings. This can lead to confusion, so it can be preferable to limit recording to the meeting organizer and appointed co-organizers.
Automatic recording of meetings is helpful in some situations, such as when the organizer cannot join at the start of the meeting, or when it is important that no-one forgets to start the recording.
Of note on this control is that the wording changes when the toggle is switched. With the setting off the wording reads Don’t record automatically and with the setting off it reads Record automatically.
End-to-end encryption can be enforced from the sensitivity label. This toggle, as with the automatic recording toggle, changes wording as it is set. When off it reads Don’t apply end-to-end encryption.
When enables the setting reads Apply end-to-end encryption. Remember end-to-end encryption disables recording of the meeting and as such encryption must be off to set recording options in a sensitivity label and if recording is set to automatic within the label then encryption cannot be switched on.
Water mark settings also change their wording within the controls from Don’t apply … to Apply…
As in direct meeting option controls the sensitivity label can be used to limit availability of meeting chat. The chat can be set to be disabled for the meeting, available only during the meeting or Always which means from the time the meeting is created.
A control which is only available via the sensitivity label currently and not directly in meeting options is to prevent the copying of the meeting chat. Please note that this restriction is currently not supported for external users, nor in all browsers when using Teams for Web and it is recommended you read the learn who gets blocked link for more information: Prevent copying chat to the clipboard label setting
Publish a New Label Using an Existing Policy
To add your new label to an existing policy choose Label policies in the Information Protection page within the Microsoft Purview Compliance Portal. Select the label policy to be edited and choose Edit policy
To add a new label move to the Labels to publish page and choose Edit below list of labels
Search for and select the new label then click Add
Verify the list of labels is correct and click Next
Assuming you do not need to make any further changes to the policy at this point other than for meetings click Next until you reach the Default settings for meetings and calendar events, choose the default label to be applied or leave blank. If not all users in your organization will have Teams Premium and E5 licences it is likely to cause confusion setting a default as users without the licenses will not be able to see the sensitivity label assigned not change it, and therefore I would recommend not setting a default.
Review the settings and click Submit if all are correct.
Wait for confirmation that the policy has been updated before navigating away from the page.
Add Sensitivity Label for Channel Meetings
You will first need to create AND SAVE a label that applies to a meeting before choosing that label as a default for channel meetings.
If (and that’s a big if), you want create one sensitivity label to apply to items (incl meetings), groups and channel meetings, you would need to create the label with the scope set to items incl meetings plus groups. Once created you will then edit that same label and set the label itself as the default for channel meetings in a Team with the label applied.
Too muddled? Then just make it simple and don’t set multiple scopes within the same label.
For example to use sensitivity labels to restrict files, meetings, groups, teams and sites to internal use only, I would:
- Create a label called Internal scoped to Items (excl meetings) and applying only encryption, with encryption limiting access to internal users. This label could also include marking with a watermark/header/footer, as required.
- Create a label called Internal Meeting scoped to Items (incl meetings) with encryption enforced and limited to internal users plus meeting options with lobby bypass limited to only People in my organisation, along with any other meeting options you wished to apply. This will limit access to the meeting invite to internal users only and ensure anyone else who is given meeting join codes is sent to the meeting lobby.
- Create a label called Internal Team scoped to Groups & sites with controls on Privacy and external user access settings which sets the group to a Private group and does not allow external users; External sharing and Conditional Access settings which sets sharing to Only people in your organization; and pick the Internal Meeting label as the default for channel meetings.
- Publish the 3 labels to required users
Apply a Meeting Sensitivity Label to an Individual Meeting
To manually assign a sensitivity label to an individual meeting, open the meeting options before the meeting starts and choose a sensitivity label, then Save the changes.
Whilst you can change the sensitivity label from meeting options within the meeting the changes do not apply until the meeting ends. So if you need to change the label during meeting the organizer should make the change and then end the meeting, which will remove everyone from the meeting. When people rejoin the meeting, the updated meeting options will apply.
Licensing
Only the meeting organiser needs the Teams Premium licence applied to be able to set a sensitivity label on a meeting. However they also need to be assigned a Microsoft 365 E5/A5/G5 or Office 365 E5/A5 license.
Platforms
Applying, changing and viewing a sensitivity label on a meeting is supported in Teams for web, Windows and MacOS. You can also manage and view the label applied to a meeting from Outlook for web, Windows and MacOS. However note at time of writing no Outlook for Mac versions have been released with this support, see Requirements for details of supported version numbers.
Admin and Set up
To ensure the feature is available for users to apply via meeting options the labels need to be created and published by a Compliance Administrator. There is not additional set up for the Teams Administrator.
Further Reading
IT Pro:
- Configure Teams meetings with three tiers of protection
- Use sensitivity labels to protect calendar items, Teams meetings, and chat
- Use Teams meeting templates, sensitivity labels, and admin policies together for sensitive meetings
- Licensing Guidance for Sensitivity Labels
End User: Sensitivity labels for Teams meetings – Microsoft Support
About the Author
I primarily provide training or consultancy services within the fields of Microsoft365, Office365, SharePoint, Teams and Project incl Project Server and have a lot of experience incorporating business processes into systems training particularly in the Project Management arena.
Reference
Fennah, S., 2023, Sensitivity Labels in Teams Meetings, Available at: https://www.sharepointeurope.com/your-guide-to-microsoft-teams/ [Accessed on 16 March 2023]
