How to Enable Microsoft Information Protection (MIP) Sensitivity Labels for Groups and Sites Using Microsoft Graph PowerShell

by

Introduction

Microsoft Purview Sensitivity Labels provide organizations with the ability to classify and protect content across Microsoft 365 services. One of the powerful capabilities of Sensitivity Labels is applying labels to Microsoft Teams, Microsoft 365 Groups, and SharePoint Online sites through the Groups & Sites option.

However, many administrators discover that the Groups & Sites section is missing when creating or editing a sensitivity label in Microsoft Purview. In most cases, this happens because the tenant-level setting EnableMIPLabels is disabled or the required Group.Unified directory setting does not exist.

In this article, we’ll walk through the complete process of enabling MIP labels for Groups and Sites using Microsoft Graph PowerShell.

Prerequisites

Before you begin, ensure you have:

  • Global Administrator or equivalent permissions
  • Microsoft Graph PowerShell SDK installed
  • Appropriate Microsoft 365 licensing that supports container labeling
  • Access to Microsoft Purview Compliance Portal

Install the required modules:

Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module Microsoft.Graph.Beta -Scope CurrentUser

Connect to Microsoft Graph:

Connect-MgGraph -Scopes "Directory.ReadWrite.All"

Verify the connection:

Get-MgContext

Step 1: Check Existing Directory Settings

First, determine whether the Group.Unified directory setting already exists.

Get-MgBetaDirectorySetting | Format-List Id,DisplayName

Example output:

Id          : 2848c3bd-17bc-4e7c-ab15-c4316ffe9513
DisplayName : Password Rule Settings

If Group.Unified is not listed, you’ll need to create it.

Step 2: Locate the Group.Unified Template

Retrieve the Group.Unified template available in Microsoft Entra ID:

$Template = Get-MgBetaDirectorySettingTemplate |
    Where-Object DisplayName -eq "Group.Unified"

$Template | Format-List Id,DisplayName

Example output:

Id          : 62375ab9-6b52-47ed-826b-58e47e0e304b
DisplayName : Group.Unified

Step 3: Create the Group.Unified Directory Setting

If the Group.Unified setting does not already exist, create it using the template.

$params = @{
    TemplateId = $Template.Id
}

New-MgBetaDirectorySetting -BodyParameter $params

Verify that it was created successfully:

Get-MgBetaDirectorySetting | Format-List Id,DisplayName

Expected output:

Id          : 727e4ec2-7d8a-4879-b7f3-4cf7a2fd2942
DisplayName : Group.Unified

Step 4: Verify the EnableMIPLabels Setting

Retrieve the Group.Unified configuration:

$grpUnifiedSetting = Get-MgBetaDirectorySetting |
    Where-Object DisplayName -eq "Group.Unified"

$grpUnifiedSetting.Values | Format-Table Name,Value

You should see a list of settings similar to:

Name                            Value
----                            -----
EnableMIPLabels                 false
AllowGuestsToAccessGroups       true
EnableGroupCreation             true

If EnableMIPLabels is set to false, continue to the next step.

Step 5: Enable MIP Labels

Update the EnableMIPLabels setting to true.

$grpUnifiedSetting = Get-MgBetaDirectorySetting |
    Where-Object DisplayName -eq "Group.Unified"

$values = $grpUnifiedSetting.Values

($values | Where-Object Name -eq "EnableMIPLabels").Value = "true"

$params = @{
    Values = $values
}

Update-MgBetaDirectorySetting `
    -DirectorySettingId $grpUnifiedSetting.Id `
    -BodyParameter $params

Step 6: Confirm the Configuration

Verify the update:

(Get-MgBetaDirectorySetting -DirectorySettingId $grpUnifiedSetting.Id).Values |
    Where-Object Name -eq "EnableMIPLabels"

Expected result:

Name             Value
----             -----
EnableMIPLabels  true

Troubleshooting: Common Error

One common error administrators encounter is:

Cannot bind argument to parameter 'DirectorySettingId' because it is an empty string.

This typically occurs because the following command returns no results:

$grpUnifiedSetting = Get-MgBetaDirectorySetting |
    Where-Object { $_.Values.Name -eq "EnableMIPLabels" }

If no Group.Unified directory setting exists, the variable will be empty and there will be no DirectorySettingId to update.

The solution is to create the Group.Unified setting first using the template, as described in Step 3.

Verifying in Microsoft Purview

After enabling the setting, allow time for replication across Microsoft 365 services.

Navigate to:

Microsoft Purview Compliance Portal
→ Information Protection
→ Labels
→ Sensitivity Labels

When creating or editing a label, you should now see the Groups & Sites option available.

This enables administrators to apply sensitivity labels to:

  • Microsoft Teams
  • Microsoft 365 Groups
  • SharePoint Online Sites
  • Viva Engage Communities

Final Thoughts

The missing Groups & Sites option is often caused by the absence of the Group.Unified directory setting or the EnableMIPLabels property being disabled. By creating the Group.Unified configuration and enabling MIP labels through Microsoft Graph PowerShell, administrators can unlock container labeling capabilities across Microsoft 365.

This simple tenant-level configuration is an important prerequisite for organizations looking to extend Microsoft Purview Information Protection beyond documents and emails to collaboration workloads such as Teams and SharePoint.

Have you encountered this issue in your environment? Share your experience and troubleshooting tips in the comments below.

!!! THANKS FOR READING !!!

Regards,
HARISH KUMAR

Knowledge is not a finite resource to hoard; it’s a boundless treasure that grows when shared