Restrict a site to compliant devices An administrator connects a sensitivity label on a SharePoint site to a Conditional Access policy through an authentication context. The label points to the context, and the policy requires a compliant device. An employee opens the Board site from a managed PC and gets in, and is blocked from a private PC. The sign-in log shows the policy that was applied. W S c1 SENSITIVITY LABELS · SITES AND TEAMS Restrict a site to compliant devices Ada Admin Eli Employee Windows PowerShell # Entra ID group setting: EnableMIPLabels = True PS C:\> PS C:\> PS C:\> _ PREREQUISITES Labels can be used on groups and sites (EnableMIPLabels) The labels are synced to Entra ID. It can take up to 24 hours. The label has Groups & sites in its scope, from the previous video Devices are enrolled in Intune with a compliance policy Microsoft Entra admin center HomeProtectionConditional AccessIdentityDevicesMonitoring & healthSign-in logs Conditional Access › Authentication contexts New authentication context NAMEDESCRIPTIONID c1 Publish to apps Save Conditional Access › Policies New policy NAME ENABLE POLICY Create Monitoring & health › Sign-in logs Sign-in details UserEli Employee ApplicationOffice 365 SharePoint Online DeviceNot managed Conditional AccessBasic infoDevice info POLICY NAMEAUTH CONTEXTRESULT Require MFA for all usersNoneSuccess Labeled sites: compliant devicec1Failure Microsoft Purview Edit sensitivity label Strictly Confidential Back Next Define the scope for this label Define external sharing and conditional access settings Control who can share SharePoint content with people outside your organization and decide whether users can access labeled sites from unmanaged devices. Control external sharing from labeled SharePoint sites Content can be shared with: Only people in your organization Use Microsoft Entra Conditional Access to protect labeled SharePoint sites Determine whether users can access SharePoint sites from unmanaged devices Choose an existing authentication context Select▼ SharePoint ⚙ Board Strictly Confidential · Private HomeDocumentsPagesSite contents Welcome to the Board site Agendas, minutes and decisions for the board. Site information Site name Board Privacy settings Private, only members can access Sensitivity Strictly Confidential From the previous video. The settings in this label now also apply to the site. SharePoint Board Strictly Confidential · Private HomeDocumentsPagesSite contents Welcome to the Board site Agendas, minutes and decisions for the board. News Board meeting in NovemberNew strategy approvedBudget process 2027 Microsoft eli@contoso.com You can't get there from here This application contains sensitive information and can only be accessed from: • Devices or client applications that meet Contoso management compliance policy. Troubleshooting detailsApp name: Office 365 SharePoint OnlineDevice state: Unregistered THE USER EXPERIENCE The Board site from two devices Eli opens the same site from a work PC and from a private PC. Good to know 1/7 SENSITIVITY LABELS · SITES AND TEAMS Restrict a site to compliant devices Only approved devices should open the sites with the most sensitive content. We connect the site label to Conditional Access with an authentication context, and test from a work PC and from a private PC. informasjonsbeskyttelse.no