Enable Sensitivity Labels For Microsoft 365 Groups & SharePoint Sites Using PowerShell

Yesterday, I was trying to create a Copilot agent for a marketing SharePoint site. The goal was to help employees quickly find files and documents.

But there was a problem:

Even though SharePoint permissions were in place, I wanted additional protection so that users without proper access would not see sensitive content at all. So I decided to use Sensitivity Labels for SharePoint sites and Microsoft 365 Groups.

When I tried to configure the label, I noticed that Groups & Sites labeling was disabled, as shown in the image below.

After researching, I found that this feature is disabled by default in many tenants and must be enabled from the backend.

In this tutorial, I’ll show you how to enable sensitivity labels for Microsoft 365 Groups and SharePoint Sites using PowerShell.

Enable Sensitivity Label for SharePoint Using PowerShell

​Before we start, make sure you’re signed in with a Global Administrator account and have the Directory.ReadWrite.All permissions in Microsoft Graph.

Now follow the steps:

1. Open PowerShell as Administrator, then install the following modules to manage directory settings.

Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module Microsoft.Graph.Beta -Scope CurrentUser

This installs both the stable and beta Graph modules required to manage directory settings.

2. Run the below command to connect to Microsoft Graph.

Connect-MgGraph -Scopes "Directory.ReadWrite.All"

Sign in with your Global Admin account when prompted.

3. Run this PowerShell to see whether a directory setting for enabling sensitivity labels already exists:

$grpUnifiedSetting = Get-MgBetaDirectorySetting | Where-Object { $_.Values.Name -eq "EnableMIPLabels" }
$grpUnifiedSetting.Values

If nothing returns, it means your tenant hasn’t created that setting object yet. You’ll need to create the directory setting first.

4. If the setting object exists, your output shows some values; if it is empty, then run this.

$params = @{
     Values = @(
      @{
           Name  = "EnableMIPLabels"
           Value = "True"
      }
     )
}
Update-MgBetaDirectorySetting -DirectorySettingId $grpUnifiedSetting.Id -BodyParameter $params

This backend change allows labels scoped to Groups & Sites to be applied in your tenant.

5. Run this to verify the setting.

$Setting = Get-MgBetaDirectorySetting -DirectorySettingId $grpUnifiedSetting.Id
$Setting.Values

If you see EnableMIPLabels = True, as shown in the image below, then we successfully enabled.

6. Then open the Microsoft Purview, and try to configure the sensitive label. You’ll see the Groups & sites option was enabled, as shown below.

This way, we can easily enable sensitivity labels for Microsoft 365 Groups and SharePoint sites using PowerShell.

Conclusion

I hope you found this article helpful!

In this article, you saw how to enable sensitivity label support for Microsoft 365 Groups and SharePoint sites using PowerShell. Since this setting is disabled by default in many tenants, enabling it is a key step before applying labels for better security and governance.

One small change, but a big improvement in protecting your SharePoint and group content.

Also, look at some related blog posts below:

• Copy Agent Builder Agent to Copilot Studio
• Set up Manual Authentication in Microsoft Copilot Studio
• Create SharePoint List Item Using Copilot Studio [Step By Step]
• Change Copilot Studio Agent Welcome Message
• Create Multi Agent in Copilot Studio