How to lock files from leaving the org M365 via email

Thank you for asking this question on the Microsoft Q&A Platform.

I understand that you require adding a security level for your documents in a SharePoint Site/Library. To achieve that you require Configure a default sensitivity label for a SharePoint document library

When SharePoint is enabled for sensitivity labels, you can configure a default label for document libraries. Then, any new files uploaded to that library, or existing files edited in the library will have that label applied if they don't already have a sensitivity label, or they have a sensitivity label but with lower priority. For example, you configure the Confidential label as the default sensitivity label for a document library. A user who has General as their policy default label saves a new file in that library. SharePoint will label this file as Confidential because of that label's higher priority. For a quick summary of the possible outcomes, see Will an existing label be overridden on this page.

Hope this helps!

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.

NOTE: To answer you as quickly as possible, please mention me in your reply.

In the outlook email, you could through attachment or sharing link to send files from a SharePoint Online site.

From attachment point, you could set block download policy for a SharePoint site by using PowerShell.

$AdminSiteURL="https://tenant-admin.sharepoint.com"
$SiteURL="https://tenant.sharepoint.com/sites/emilytest" 
  
Connect-SPOService -URL $AdminSiteURL
   
Set-SPOSite -Identity $SiteURL -BlockDownloadPolicy $true 

From sharing link point, users even if only with read permission can share files in new outlook message. There is no option to avoid this situation.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hi

How sensitivity labels could prevent sending files, marked with sensitivity label, via email?

I can't see a setting that would prevent a marked file to be sent out via email?

And that BlockDownloadPolicy is not what we are looking for..

You can apply privacy labels with encryption and set permissions for reading, editing documents according to your needs (like restricting by domain). This will not prevent sending, but you will have control over the actual access.