Tony thank you, that link is really helpful. Are you aware of anything on the roadmap or something that exists today, available through a standard O365 E3 license, that could be used to prevent a group / team owner from ever inviting a guest account to a group that hasn’t been pre-approved for guest use?

The requirement is, once a guest account is in the tenant, it should only have access to groups authorized for guest access, and there should never be a way for a group owner to circumvent that control.

BTW, this article might help: https://practical365.com/monitor-changes-sensitivity-labels-container-management/

You can certainly use PowerShell to assign a sensitivity label to all sites, and have a scheduled job to pick up new groups/sites and make sure that they’re assigned the right label (you can also define a default label for new groups/teams/sites in the label policy published to users).

You’d have to come up with a way to mark approved sites/groups for group access. Maybe one of the custom attributes available for groups would do the job.

This is a great article!
Any thoughts if we are able to apply a label to a folder instead of container?
My use case is the following: Let’s say I have an HR container, containing several folders. I would like to classify folder one as “Personal information”, where we’ll collect all candidates data, personal accounts, etc, so any file placed by the HR in this folder will be classified as PII. Then I have folder two as “Confidential data” , where I keep contracts, salary information, etc. So I would like to classify everything in this HR fder two as confidential.
If this is not a direct out of the box solution I can implement, what would be your suggestions to do in order to support this use case?

Thanks a lot in advance!

You may apply only one label to a file at a time. You can change the label, but you can’t (and wouldn’t want to) apply two or more labels to the same file.

Use the SharePoint Online PowerShell option.
Get all sites with template = Group#0
Set-SPOSite -SensitivityLabel Guid (the identifier of the label to set).

No, there is no connection between the site label and labels applied to documents within the site. Two very separate things at the moment as Tony has stated already.