M365 PlaybooksPurview · SharePoint · Teams · Exchange· Deploy · Meetings
Label meetings and calendar items
Purpose
Some of the most sensitive information an organization has is never written down: it is said in board meetings, HR cases, negotiations and incident calls. Labelling meetings lets the organizer set protection once, on the invite, and have Outlook and Teams enforce it: who waits in the lobby, who can present, whether the meeting is recorded, and whether chat can be copied. Protection then depends on the label, not on each organizer remembering the right meeting options every time.
Overview
Meeting protection set by the label on the invite: lobby, presenters, recording, watermarks and chat copying, enforced in Outlook and Teams.
- Effort
- About 10 to 15 person-days
- Duration
- 4 to 8 weeks
- Complexity
- Medium
- Who's in the room
- Purview admin, Teams admin, Exchange admin, communications lead, executive assistants and other organizers of sensitive meetings
- Licensing
- Labels for scheduled meetings need Microsoft 365 E5, Microsoft Purview Suite, Microsoft 365 E5 Information Protection and Governance, or Office 365 E5. Teams meeting options in labels (lobby, presenters, recording, watermarks, end-to-end encryption) also need Teams Premium; for end-to-end encryption only the organizer needs it.
Risk of not doing it
Sensitive meetings rely on each organizer remembering the right options; one forgotten lobby setting or automatic recording can expose what was never meant to leave the room.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Confirm licences for organizers
Labels on calendar items need an E5-level licence. The Teams meeting options a label can enforce (lobby, presenters, recording, video watermarks, end-to-end encryption, chat copying) need Teams Premium, and without it you can't configure all of those options. For end-to-end encryption, only the organizer needs Teams Premium; attendees don't. Start with the people who organize sensitive meetings, not everyone. Keep the licensed group aligned with the label policy scope, so nobody sees meeting options they can't use.
Check Outlook and Teams versions
Calendar labels need Outlook on the web or built-in labelling in Microsoft 365 Apps at the versions in Microsoft's minimum versions table, and Teams needs recent desktop or mobile clients or the web app on Edge or Chrome. When someone joins on an older client, the meeting options from the label can't be enforced for them. Meeting labels also work only with Exchange Online mailboxes.
Extend the label scopes
To use a label for meetings, it needs the Meetings scope together with the Files and Emails scopes; Microsoft notes all three are needed because they depend on each other. Plan this as a change to existing labels, published in the usual way, and allow up to 24 hours for it to reach apps.
Decisions
Decision: Which labels carry meeting settings?
Add meeting settings to the labels people already know rather than creating meeting-only labels. Typically, Confidential limits who bypasses the lobby and who can present, and Highly Confidential adds no recording, a video watermark, end-to-end encryption and no copying of meeting chat, captions and transcripts. The label locks these options in Teams, and Microsoft notes a label can enforce end-to-end encryption, watermarks and automatic recording even when the admin policy has them turned off.
Options
- Create separate labels just for meetings
- Add meeting settings to the top two existing labels
- Add meeting settings to every label
Recommended default: Add meeting settings to the top two existing labels
Decision: Default and mandatory labels for meetings?
Label policies have their own meeting settings, independent of the email settings: a default label for meetings and mandatory labelling for meetings. In Outlook the default applies to new calendar events and to existing unlabelled ones when they are updated; in Teams it isn't applied when an existing unlabelled meeting is updated. Mandatory labelling for every meeting interrupts organizers for routine catch-ups, so most organizations start with a default that carries no meeting restrictions.
Options
- No default, labelling optional
- A default with no meeting restrictions, labelling optional
- Mandatory labelling for every meeting
Recommended default: A default with no meeting restrictions, labelling optional
Decision: Inherit labels from files shared to meetings?
A policy setting lets a meeting take its label from files shared to it. It catches the meeting about a Highly Confidential document that the organizer forgot to label, but it can also surprise people when a meeting becomes more restricted partway through planning. Try it in the pilot before deciding.
Options
- Leave it off
- Turn it on after the pilot
Recommended default: Turn it on after the pilot
Decision: Protect channel meetings through the team's label?
For channel meetings, the meeting label comes from the team: you associate a meeting label with the container label, and every channel meeting and chat in teams with that label inherits it, without users being able to change it. This is set by editing an existing label for groups and sites. It suits teams that already carry a Highly Confidential container label.
Options
- Don't associate a meeting label
- Associate a meeting label with the most sensitive container labels
Recommended default: Associate a meeting label with the most sensitive container labels
Pilot configuration
Publish to sensitive-meeting organizers
Publish the updated labels and policy settings to a pilot of the people who run sensitive meetings: executive assistants, HR, legal, and the incident response lead. Brief them on what each label does to a meeting before they first see it. Executive assistants usually schedule on behalf of others, so check how labels appear when they create meetings for their executives, and make sure both the assistant and the executive know which label to use for which meeting type.
Test the edges
Test a labelled invite to an external guest (they see headers and footers; those whose client can't open an encrypted invite are sent to Outlook on the web or the encryption portal), a recurring series (labels apply to the series, not individual occurrences, and existing exceptions aren't labelled), changing a label during a meeting (recording, encryption and watermark settings change only after the organizer ends and restarts it), and Meet Now, which doesn't enforce the label's settings. Shared mailbox calendars can't be labelled at all. Write what you find into the organizer guide in plain terms, so organizers know the limits before they rely on the label.
Production configuration
Widen to all organizers in waves
Extend the policy to more organizers, starting with departments that run regular confidential meetings. Give every wave a one-page guide on which label to choose for which meeting and what attendees will notice. Use the pilot's experience to write the examples: the kinds of meetings people actually run, matched to labels. Organizers choose faster from real examples than from definitions.
Watch the labelling of meeting artifacts
A policy setting that applies the meeting label to recordings, transcripts and notes is in preview. Track it, test it when you are ready, and until then remind organizers that the label protects the meeting itself, not every file it produces.
Make it enforceable
The label locks the meeting options in Teams and can enforce end-to-end encryption, watermarks and recording settings even where the admin policy has them off, so organizers can't forget or undo them. The label can't stop people sharing the meeting link or taking screen captures, and Meet Now doesn't enforce it, so those remain risks to cover in guidance.
Partly enforced. The gaps are a risk until a mechanism covers them.
Pilot to production
Rollout approachBy risk tier · Pilot size: 20 to 50 organizers of sensitive meetings
The value is concentrated in a small number of high-risk meetings. Starting with the people who organize board, HR, legal and incident meetings protects what matters first and tests the settings with users who care about them.
Make your pilot representative
- Every major role, not only IT and enthusiasts
- More than one location or time zone
- Heavy users of the workload you are changing
- People who handle sensitive information
- At least one team you expect to be sceptical
Brief the pilot organizersChange: Inform
Explain what each label does to a meeting and what attendees, including guests, will see.
Move on when: Organizers can say which label suits which meeting
Run labelled meetings for three weeksChange: Explain
Organizers label real sensitive meetings and report anything unexpected. Collect what attendees noticed as well as what organizers did: lobby waits, missing recordings and watermarks are the usual surprises.
Move on when: No unresolved issue stops a meeting from running
Adjust settings and guidanceChange: Explain
Tune the meeting settings per label and decide on inheritance from shared files.
Move on when: Pilot feedback is closed or scheduled
Extend to the next risk tierChange: Explain
Add departments that run regular confidential meetings. Brief each department's assistants and managers with the organizer guide a week before labels reach them.
Move on when: Each wave settles without a rise in support requests
Make it routineChange: Sustain
Add meeting labels to the labelling guide and to onboarding for assistants and managers.
Move on when: Guidance covers meetings and is part of onboarding
Common challenges
If youTreat the label as the only protection
What tends to happenPeople assume a labelled meeting can't leak, but the label can't stop link sharing or screen captures.
A better approachTell organizers plainly what the label does and doesn't do, and keep the most sensitive discussions to invited, identified attendees.
If youLabel meetings for everyone at once
What tends to happenRoutine meetings pick up restrictions nobody expected, and organizers stop labelling.
A better approachStart with organizers of sensitive meetings and keep the default free of meeting restrictions.
If youForget older clients
What tends to happenAttendees on old Teams or Outlook versions join without the label's settings being enforced.
A better approachCheck versions before the pilot and close the gaps before widening.
If youLabel a recurring series and assume every occurrence is covered
What tends to happenExisting exceptions in the series stay unlabelled.
A better approachLabel the series before exceptions are created, and check existing series when you roll out.
If youChange the label once the meeting has started
What tends to happenRecording and watermark settings don't change until the meeting is restarted, so attendees see the old behaviour.
A better approachSet the label on the invite; if it must change, end and restart the meeting.
If youSchedule sensitive meetings from a shared mailbox calendar
What tends to happenThe meeting can't be labelled at all, because shared mailbox calendars don't support labels.
A better approachHave organizers schedule sensitive meetings from their own calendar, or delegate access rather than use a shared mailbox.
Checkpoints
Pilot
- Do pilot organizers have the licences their labels need?
- Do chosen labels have the Files, Emails and Meetings scopes?
- Have external guests, recurring series and Meet Now been tested?
- Do executive assistants know how labels behave when they schedule on behalf of others?
Production
- Can every licensed organizer apply meeting labels?
- Are channel meetings in sensitive teams covered through their container labels?
- Does the labelling guide say what meeting labels do and don't protect?
- Is there a decision date for labelling recordings and transcripts?
- Have assistants and managers in each wave received the organizer guide before labels reached them?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Sensitive meetings carrying a label | Spot checks with executive assistants | Up |
| Meetings recorded against the label's intent | Organizer reports | Down |
| Support requests about meeting labels | Service desk | Down |
Ready-to-use text
Organizer guide: which label for which meeting
General: everyday meetings; no restrictions. Confidential: meetings about non-public plans; only people from our organization skip the lobby and only you present. Highly Confidential: board, HR cases, legal and incidents; no recording, a watermark on shared video, and chat can't be copied. A label can't stop someone sharing the link or taking a screenshot, so invite only the people who need to be there.
Note for attendees on labelled meetings
This meeting is labelled [label]. You may wait in the lobby, recording may be turned off, and you may see a watermark on shared content. These settings come from the label, so the organizer can't change them during the meeting.
Pilot feedback questions
1. Which label did you use for which meetings? 2. Did any setting stop the meeting from working as you needed? 3. What did attendees, including guests, ask about? 4. Was any meeting harder to label than it should be?
Additional reading
Plan
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |