Introduction
The pace of Microsoft 365 updates shows no signs of slowing down, and several recent developments deserve particular attention from an administration perspective. Five changes stand out this month: three in Microsoft Purview, one in Microsoft Entra ID, and one in SharePoint. All have a direct impact on data security, license management, or brand governance.
Purview: sensitivity labels enabled by default on groups and sites
In Microsoft Purview (purview.microsoft.com), the access control feature for groups and sites when creating a sensitivity label was historically grayed out. You had to enable specific PowerShell commands to unlock it — a step often forgotten, thus a potential security gap.
This setting is now active by default. Concretely, when creating a label (Information Protection menu > Create > Label), the "Groups & sites" option is directly accessible. It applies to:
- Security groups
- SharePoint sites
- Microsoft 365 groups (and therefore associated Teams)
For each label, the administrator can now configure:
- Access control and privacy (private/public)
- Content marking (watermark, footer, header)
- Dynamic watermarking, customizable by criteria (for example different color depending on the year)
- Double Key Encryption (DKE), reserved for organizations that already have on-premises rights management infrastructure (such as Active Directory Rights Management Services)
- External sharing restrictions, including for Teams Premium meetings
DKE Prerequisites
Double Key Encryption only works if your organization already has an on-premises encryption key. It combines this local key with the Azure key, preventing Microsoft from accessing the decrypted content alone.
The real added value: these labels now combine with Data Loss Prevention (DLP) policies via auto-labeling. A rule can, for example, detect sensitive US information (bank data, credit cards) and automatically apply the label as well as the associated DLP policy, without user intervention. Without auto-labeling, you must rely on manual labeling — which means user training and procedure changes, thus more operational burden for compliance teams.
Once the label is applied to a Microsoft 365 group (visible in Teams > Settings > Sensitivity), control is exercised both at the group level and at the individual content level in SharePoint.
Before any AI agent deployment
These information protection and DLP controls are a prerequisite before any large-scale AI agent or Copilot deployment. Without them, the risk of data leakage through uncontrolled AI usage increases significantly.
Entra ID: the "Licensing Coverage" report for Conditional Access
In the Conditional Access blade of Microsoft Entra ID, a new section named Licensing Coverage is appearing. Objective: to answer a recurring question from administrators — do I have enough licenses to apply this conditional access policy based on a device, location, or application?
This report displays:
- The number of licenses held, broken down by tier (Entra ID P1, P2, Entra Suite, etc.)
- Direct links to associated articles on learn.microsoft.com for each feature
- Direct access to purchase or trial missing licenses
Where to manage your licenses?
This positioning in Entra ID rather than in the Microsoft 365 admin center may be surprising: license assignment remains managed from admin.microsoft.com. Consider this report as a diagnostic tool, not as a management console.
This feature limits the risk of discovering, after the fact, that a conditional access policy relies on a feature not covered by the licenses in place — a frequent scenario during compliance audits.
DLP: granular control by service in Purview
In Microsoft Purview > Data Loss Prevention > Policies, creating a new policy now offers a much finer level of customization by location. Previously, the temptation was great to check all locations (SharePoint, OneDrive, devices, etc.) and keep the default settings. Each location now has its own set of rules.
| Location | Main novelty | Use case |
|---|---|---|
| SharePoint / OneDrive | Blocking/allowing by domain or SMTP address, distinction between anonymous access vs authenticated external | Block sharing to untrusted domains while allowing identified partners |
| Devices (Intune) | Rules by document condition and action (audit, restriction, blocking) on Edge and outside browser | Restrict copy-paste or printing on managed devices |
| FTP/SFTP transfers | New monitorable channel, with blocking conditional on network (corporate/VPN) | Prevent exfiltration of confidential files via unencrypted file transfers |
For SharePoint and OneDrive, the "restrict or encrypt content" action now makes it possible to create true allowlists and blocklists by domain or email address, with an "is" or "is not" operator. A welcome level of granularity for organizations that collaborate with external partners on certain sites while locking down others.
On the device side, rules apply to both activities in the Edge browser and general device activities (copy-paste, printing, etc.), with either an audit mode or strict blocking mode.
The real novelty of the month remains native support for FTP and SFTP as a channel monitored by DLP. It becomes possible to audit or block confidential file transfers based on network origin (corporate network, VPN), a frequent blind spot for DLP policies previously focused on cloud and email.
Common pitfall
Clicking too quickly through "Next" when creating a DLP policy applies default settings to all selected locations, including those not relevant to your use case. Take the time to customize each location individually.
SharePoint: a Brand Center to centralize brand resources
Last point: the new Brand Center, accessible from the Microsoft 365 admin center (Settings > Organizational settings). It addresses a simple need — centralize logos, brand guidelines, and templates to prevent each team from recreating their own visuals when creating sites, pages, or documents.
Creating a Brand Center automatically generates:
- A dedicated SharePoint subsite serving as a resource catalog
- An associated mobile application for quick access to resources from a smartphone
This site functions as an internal content delivery network (CDN) for all the organization's brand elements. Dedicated documentation is available on learn.microsoft.com for complete deployment.
Key takeaways
- Information Protection: access control on groups and sites is active by default, without prior PowerShell configuration — review your existing labels to take advantage of this activation.
- DKE requires pre-existing on-premises rights management infrastructure.
- Licensing Coverage in Entra ID validates the license coverage of a conditional access policy before deployment, without replacing the Microsoft 365 admin center for actual license management.
- DLP now offers control by domain/SMTP address on SharePoint and OneDrive, and natively monitors FTP/SFTP transfers.
- SharePoint's Brand Center centralizes logos and brand guidelines in a dedicated site, with an associated mobile application.
Next concrete step: audit your existing sensitivity labels to check if access control on groups and sites was previously disabled due to lack of PowerShell activation, and test the Licensing Coverage report before your next conditional access policy deployment.
