What and why
Microsoft Purview is introducing sensitivity labels for Microsoft Entra cloud security groups. This capability extends label-based protection currently available for Microsoft 365 groups and SharePoint sites to cloud security groups.
With this change, organizations can apply published Microsoft Purview sensitivity labels directly to security groups and automatically enforce membership and guest access policies when groups are created or labeled. This helps administrators apply governance policies consistently across group types, reduce the risk of oversharing, and support controlled self-service group creation.
This message is associated with Microsoft 365 Roadmap ID 568217.
Rollout schedule
- General Availability (Worldwide): Beginning in mid-November 2026 and expected to complete in late November 2026
Impact on your organization
Who is affected
- Microsoft Entra administrators
- Microsoft Purview administrators
- Organizations that use or plan to use sensitivity labels to govern access to Microsoft Entra security groups
Platforms and services
- Microsoft Purview
- Microsoft Entra ID
- Microsoft Entra admin center
- Azure portal
- Microsoft Graph
- PowerShell
What will happen
- Administrators will be able to apply published Microsoft Purview sensitivity labels to cloud security groups during group creation or after a group has been created.
- Labels can be assigned through the Microsoft Entra admin center, Azure portal, PowerShell, or Microsoft Graph.
- Existing sensitivity label functionality for Microsoft 365 groups will remain unchanged.
- Once a sensitivity label is applied to a security group, the label cannot currently be changed or removed. Support for changing assigned labels will be introduced in a future update.
- Sensitivity labels can be used to enforce organizational membership and guest access policies for security groups.
Action required and recommendations
No action is required to receive this change.
- To use sensitivity labels with Microsoft Entra security groups after rollout:
- Confirm that your organization has eligible licensing, such as Microsoft 365 E3 or Microsoft 365 E5, which includes Microsoft Entra ID P1.
- In the Microsoft Purview portal, publish the sensitivity labels you want to use with the Groups & Sites scope enabled.
- Allow up to 24 hours for labels to synchronize and become available in Microsoft Entra ID.
- Enable sensitivity label support for cloud security groups in your tenant settings.
- If sensitivity labels are already enabled for Microsoft 365 groups, note that cloud security groups require a separate configuration setting and must be enabled independently.
Consider reviewing your existing sensitivity label policies and governance processes before enabling this feature, particularly because assigned labels cannot currently be changed or removed from security groups.
Learn more
Compliance considerations
| Question | Answer |
| Does the change modify or add to Purview-related capabilities? | Yes. This update extends Microsoft Purview sensitivity labels to Microsoft Entra security groups, adding a new governance and protection capability for this group type. |
| Does the change include an admin control? | Yes. Administrators must enable sensitivity label support for cloud security groups and manage label publication and assignment through Microsoft Purview and Microsoft Entra administrative controls. |
| Does the change alter how admins manage or demonstrate compliance activities? | Yes. Administrators can use sensitivity labels on cloud security groups to apply and enforce access governance policies, expanding the scope of compliance controls available within Microsoft Purview. |