This solution distinguishes between protecting data by securing the container versus securing the individual content items.

• SharePoint Online & Microsoft Teams: For these collaborative environments, a primary protection strategy is to label the container itself—the SharePoint site or the Microsoft Team (which is built on a Microsoft 365 Group). Applying a label with the Groups and sites scope enforces container-level policies, such as privacy settings (public vs. private) and external user access. This secures the entire workspace, thereby protecting all data stored within it. This is a foundational step before applying granular labels to the content.
• Exchange Online: The focus here is on the data items themselves—the emails and their attachments. The Files and emails scope is required to apply sensitivity labels directly to this content. This allows for specific protections like encryption or visual markings to be applied to individual emails based on their sensitivity, regardless of where they are stored.

This strategy uses a combination of container-level and content-level protection across the different Microsoft 365 services.

Microsoft Learn, Official Documentation: "Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites."

Reference: This document explicitly states, "When you apply this sensitivity label to a supported container [Microsoft Teams, Microsoft 365 groups, and SharePoint sites], the label automatically applies the classification and configured protection settings to the connected site or group." This confirms that the Groups and sites scope is the correct choice for applying protection at the container level for both Teams and SharePoint sites.

Microsoft Learn, Official Documentation: "Manage sensitivity labels in Office apps."

Reference: Under the section "How sensitivity labels are applied," the documentation details how labels are applied to email messages and documents. It clarifies that this functionality, which includes applying protection like encryption, is enabled by labels configured for the 'Files & emails' scope. This supports using this scope specifically for content within Exchange Online.