Microsoft Purview | Information Protection: Sensitivity labels for Microsoft Entra security groups

[What and why]

Microsoft Purview is introducing sensitivity labels for Microsoft Entra cloud security groups. This capability extends label-based protection currently available for Microsoft 365 groups and SharePoint sites to cloud security groups.

With this change, organizations can apply published Microsoft Purview sensitivity labels directly to security groups and automatically enforce membership and guest access policies when groups are created or labeled. This helps administrators apply governance policies consistently across group types, reduce the risk of oversharing, and support controlled self-service group creation.

This message is associated with Microsoft 365 Roadmap ID 568217.

[Rollout schedule]

• General Availability (Worldwide): Beginning in mid-November 2026 and expected to complete in late November 2026

[Impact on your organization]

Who is affected

• Microsoft Entra administrators
• Microsoft Purview administrators
• Organizations that use or plan to use sensitivity labels to govern access to Microsoft Entra security groups

Platforms and services

• Microsoft Purview
• Microsoft Entra ID
• Microsoft Entra admin center
• Azure portal
• Microsoft Graph
• PowerShell

What will happen

• Administrators will be able to apply published Microsoft Purview sensitivity labels to cloud security groups during group creation or after a group has been created.
• Labels can be assigned through the Microsoft Entra admin center, Azure portal, PowerShell, or Microsoft Graph.
• Existing sensitivity label functionality for Microsoft 365 groups will remain unchanged.
• Once a sensitivity label is applied to a security group, the label cannot currently be changed or removed. Support for changing assigned labels will be introduced in a future update.
• Sensitivity labels can be used to enforce organizational membership and guest access policies for security groups.

[Action required and recommendations]

No action is required to receive this change.

• To use sensitivity labels with Microsoft Entra security groups after rollout:
• Confirm that your organization has eligible licensing, such as Microsoft 365 E3 or Microsoft 365 E5, which includes Microsoft Entra ID P1.
• In the Microsoft Purview portal, publish the sensitivity labels you want to use with the Groups & Sites scope enabled.
• Allow up to 24 hours for labels to synchronize and become available in Microsoft Entra ID.
• Enable sensitivity label support for cloud security groups in your tenant settings.
• If sensitivity labels are already enabled for Microsoft 365 groups, note that cloud security groups require a separate configuration setting and must be enabled independently.

Consider reviewing your existing sensitivity label policies and governance processes before enabling this feature, particularly because assigned labels cannot currently be changed or removed from security groups.

Learn more

• Assign sensitivity labels to Microsoft Entra security groups | Microsoft Entra ID | Microsoft Learn
• Learn about sensitivity labels | Microsoft Purview | Microsoft Learn
• Use sensitivity labels to protect collaborative workspaces (groups and sites) | Microsoft Purview | Microsoft Learn

[Compliance considerations]