Microsoft Planner security settings — configure them safely

If you need to secure Microsoft Planner without breaking team collaboration, treat Planner as three surfaces: Microsoft 365 Groups (membership and owners), SharePoint (task attachments and Files tab), and Azure AD (authentication, guests, and Conditional Access). To control access, change Microsoft 365 Group membership and guest settings, use SharePoint tenant and site sharing settings for files, and apply Conditional Access, sensitivity labels, retention, and DLP from the Microsoft 365 admin and compliance centers. The rest of this article gives the exact checks to run first, the places to make changes, safe step sequences, PowerShell examples, monitoring steps, and quick recovery actions if you need to roll back.

What do I need to check before changing anything

• You must be signed in with one of these admin roles: Global Administrator, SharePoint Administrator (for SharePoint tenant settings), Exchange Administrator (for Microsoft 365 Groups via Exchange), or Azure AD Administrator (for guest/Conditional Access).
• Planner is enforced by three systems:
• Microsoft 365 Group membership controls who can see and edit a plan.
• Plan attachments and the Files tab live in the Group’s SharePoint document library.
• User identities, MFA, and guest settings are enforced by Azure AD and Conditional Access.
• Potential impact of changes:
• Changing Group membership immediately affects plan access.
• Tightening SharePoint sharing can break access to attached files while tasks remain visible.
• Blocking guests at the tenant level prevents guests from opening any Group resources.

Prerequisites:

• A Global Administrator or the specific admin role listed above.
• The Microsoft 365 Group name or the plan URL.
• A test external account (if you will validate guest behavior).
• PowerShell modules available and connected if you intend to run the sample commands.

Steps (checks to run before making changes):

1. Confirm the plan’s Microsoft 365 Group name and owners.
2. Open the plan, click Members, and note the Group name.
3. Verify where attachments live.
4. Open Files in the plan and confirm the SharePoint document library and site URL.
5. List current guests and external users.
6. Check Azure AD > Users > Guest users and the Group membership for external accounts.
7. Check for existing Conditional Access or tenant-wide sharing restrictions.
8. Review Azure AD > Security > Conditional Access and Microsoft 365 admin center > SharePoint > Policies > Sharing.

Have a rollback contact (a Group owner or Global Admin) ready before making tenant-wide changes.

Completion: what you should have before you begin changes

• You know the Group that backs the plan and its owners.
• You can access the Group’s SharePoint site URL.
• You have identified any guest accounts to preserve or remove.
• You have a test user to validate changes.

How do Planner permissions actually work and where to make changes

Planner has no separate permissions store: access to a plan equals membership in the underlying Microsoft 365 Group. Files attached to tasks follow the Group site’s SharePoint permissions.

When to change which system:

• Change Group membership when you want to add or remove people from the plan (owners, members, guests).
• Change Group settings (privacy, guest access) when you want to change how access is granted or whether external users can join.
• Change SharePoint sharing when you want to limit or allow access to files attached to tasks.

Steps to inspect and change membership (do these so you make the right change):

1. Open the plan and note the Group name in the Members pane.
2. Manage owners and members in the Microsoft 365 admin center or Teams if the Group is Teams-backed.
3. Use PowerShell to review Group membership if you prefer command-line checks.

# Get group members (Exchange Online module must be connected)
Get-UnifiedGroup -Identity "Product Launch" | Format-List DisplayName,PrimarySmtpAddress
Get-UnifiedGroupLinks -Identity "Product Launch" -LinkType Members
Get-UnifiedGroupLinks -Identity "Product Launch" -LinkType Owners

4. To remove a user from the Group (so they lose plan access), remove them from Group membership rather than expecting Planner UI to revoke rights.

Removing a Group owner without assigning another owner can orphan the Group and make recovery harder. Ensure at least one owner remains or assign a new owner first.

Completion: how you know it worked

• The Members pane shows the intended owners and members.
• Non-members cannot open the plan even with the plan URL.
• Owners can manage the Group and reassign ownership if needed.

How to control external sharing and guest access for plans and files

Control guest access at two levels: Azure AD for B2B guest settings and SharePoint for file link sharing. If you want to block guests from all Planner plans, disable guest access in Azure AD first. To block links to attached files, tighten SharePoint sharing.

Azure AD guest access (portal steps):

1. Sign in to the Azure portal as an admin.
2. Open Azure Active Directory > External Identities > External collaboration settings.
3. Set restrictions on guest user permissions and invite settings.
4. Save.

Microsoft 365 admin center (Group-level guest control):

1. Microsoft 365 admin center > Groups > Active groups.
2. Select the Group tied to the plan > Settings.
3. Toggle whether guests can be members and whether non-owners can invite guests.

SharePoint tenant sharing (to control attachments):

Changing tenant sharing can block legitimate external access to many sites. Test on a pilot Group or a single site first.

1. Microsoft 365 admin center > SharePoint > Policies > Sharing.
2. Choose the tenant default and set allowed link types: Anyone, New and existing guests, Existing guests, Only people in your organization.
3. To restrict a specific Group site, go to SharePoint admin center > Sites > Active sites, select the Group site, then click Policies > Sharing and set site-level sharing.

PowerShell example to change tenant sharing:

# Connect to SharePoint Online first
Connect-SPOService -Url https://contoso-admin.sharepoint.com
# Set tenant-wide sharing to allow only authenticated users (no anonymous links)
Set-SPOTenant -SharingCapability Disabled
# Or to allow external users but not anonymous links:
Set-SPOTenant -SharingCapability ExternalUserSharingOnly

Practical sequence to lock a plan's files while keeping internal Planner use:

1. Set the Group site sharing to "Existing guests" or "Only people in your organization" at site level.
2. If you must block guests entirely, disable guest invitations or restrict guest access in Azure AD.
3. Communicate to Group owners that external collaborators may lose attachment access and provide alternatives (secure SharePoint links or separate collaboration sites).

Blocking anonymous links does not remove attachments from tasks; it changes who can open them.

Completion: how you know it worked

• External test accounts either cannot access files or can only access them per the new sharing rules.
• The Group still has the same visible tasks in Planner for internal members, but attachment access reflects SharePoint settings.

How to apply conditional access, sensitivity labels, retention and DLP to Planner content

Which controls affect Planner and where they apply:

• Conditional Access: applies at authentication to Planner (browser or app). Use it to require MFA, block legacy authentication, or restrict access to compliant devices. It does not change Group membership or file permissions.
• Sensitivity labels: apply to documents stored in the Group’s SharePoint site and can enforce encryption, access restrictions, or site classification when configured. Planner task text is not labeled directly; attachments inherit labeling rules via SharePoint.
• Retention and eDiscovery: retention policies and content search in Microsoft Purview can include Group mailbox, Group site content, and associated Planner artifacts where they are stored.
• DLP: Microsoft Purview DLP policies scan files in SharePoint and Exchange. Planner task text and comments are not primary DLP targets; attached documents are covered.

Conditional Access setup (portal steps):

1. Azure portal > Azure Active Directory > Security > Conditional Access.
2. New policy > Users and groups: select the users/groups to target.
3. Cloud apps or actions: select "Office 365" or specific apps that include Planner access.
4. Conditions and Access controls: require MFA or require device to be marked compliant.
5. Enable the policy.

Sensitivity labels (Purview / Compliance center steps):

1. Microsoft Purview compliance portal > Information protection > Labels.
2. Create a label, configure encryption and site policy; publish it to a label policy and include the Group sites or users.
3. For auto-labeling of files, configure a label with conditions and an auto-apply policy.

Retention and eDiscovery (portal steps):

1. Microsoft Purview > Information governance > Retention policies. Create a policy targeting Microsoft 365 Groups and specify retention or deletion settings.
2. Purview > Content search or eDiscovery to search Group mailbox and Group site content.

DLP (portal steps):

1. Microsoft Purview > Data loss prevention > Policy > Create policy.
2. Select locations: choose SharePoint sites and Group sites; configure rules to detect sensitive info types and actions (block access, restrict sharing, notify).

PowerShell commands to review Group membership and site URLs:

# Get Unified Group details (ExchangeOnline module)
Get-UnifiedGroup -Identity "Product Launch" | Format-List DisplayName,PrimarySmtpAddress,AccessType
# Get SharePoint site URL for the Group (PnP or SharePoint Online module)
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/ProductLaunch

Conditional Access and sensitivity labels can block access in ways users will notice immediately. Pilot new policies on a small group before wide rollout.

Completion: how you know it worked

• Conditional Access sign-in logs show MFA or device compliance checks for targeted users.
• Labeled files in the Group site have the expected protection applied.
• Retention policies include the Group and prevent deletion per the configured rules.

Cautions and common mistakes to avoid when locking Planner down

Common mistakes and how to avoid them:

• Managing plan membership only inside the Planner UI. Planner shows members but does not store a separate permissions model—edit the Microsoft 365 Group membership.
• Tightening SharePoint sharing tenant-wide without checking which Groups need external collaboration. Test and inventory dependent Groups before a tenant-wide change.
• Expecting Planner-specific DLP or sensitivity labels to protect task text. Task titles, comments, and checklists are not covered by file-level labels; protect files in SharePoint instead.

Safe alternatives and rollback tips:

• Test changes on a pilot Group that mirrors a real team.
• When removing guests, keep a named owner who can re-invite if you need to roll back.
• Record the previous SharePoint tenant or site sharing setting so you can revert the exact value.

Rollback examples:

• If users lose access after a Group membership change, add the user back to the Group or assign them a temporary owner role.

# Add a user back to a unified group
Add-UnifiedGroupLinks -Identity "Product Launch" -LinkType Members -Links user@contoso.com

• If attachments stop opening after a SharePoint policy change, set the site-level sharing back to the previous level or create a secure guest link for a specific file.

Use tenant-wide settings only when you have a communication and support plan. Unexpected access changes generate helpdesk tickets and can delay business processes.

Completion: how you know it worked

• You can restore access by re-adding users to the Group or reverting site sharing.
• Helpdesk tickets related to the change drop after rollback and affected users can open tasks and attachments again.

How to verify and monitor your changes and what to do if something goes wrong

Where to check activity and configuration after changes:

• Azure AD sign-in logs: show sign-in attempts, Conditional Access blocks, and device/location details.
• Microsoft 365 audit logs: capture Group membership changes, sharing link creations, and file access events.
• SharePoint site usage and sharing reports: show who accessed files and which links were created.
• Microsoft Purview content searches and eDiscovery: verify where content is stored and whether retention or DLP policies applied.

Verification checklist (what you should see after a correct change):

1. Members: only the intended users and guests are members of the Microsoft 365 Group.
2. Plan access: non-members cannot open the Planner plan; members can.
3. File access: files attached to tasks reflect the new SharePoint sharing settings (test with an external test account if possible).
4. Conditional Access: sign-in logs show MFA or device checks for targeted users.

Steps to check audit logs (portal steps):

1. Microsoft Purview compliance portal > Audit > Audit log search. Search for "Added member to group" or "Sharing link created".
2. Azure portal > Azure AD > Sign-ins. Filter by user and date to see access failures or Conditional Access blocks.

Quick remediation steps for two common incidents:

• Users lose access to a plan:

1. Confirm whether they were removed from the Microsoft 365 Group.
2. If removed unintentionally, re-add them as a member or owner in the Microsoft 365 admin center or with PowerShell.

# Add a user back to a unified group
Add-UnifiedGroupLinks -Identity "Product Launch" -LinkType Members -Links user@contoso.com

3. If Conditional Access is blocking legitimate access, disable the policy for the pilot users and review the policy settings before re-enabling.

• Guests still see files after you attempted to block them:

1. Check SharePoint site-level sharing overrides; site-level settings can allow more permissive access than tenant defaults.
2. Revoke specific sharing links on the SharePoint site: Site > Settings > Site permissions > Advanced > Access Requests and Invitations, or use the document library GUI to manage links.

# Revoke guest links for a site (example approach using PnP)
# Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/ProductLaunch -Interactive
# Get-PnPListItem -List Documents | ? { $_.FieldValues.SharedWithUsers } | ForEach-Object { # remove links }

If you cannot quickly identify why a guest retains access, remove the guest from the Group first, then revoke sharing links on the SharePoint site and audit the guest’s Azure AD account.

Completion: how you know it worked

• Members-only can open the plan and attachments; external accounts cannot.
• Audit logs show the expected membership and sharing events.
• Affected users signing out and back in no longer see cached access.

Conclusion

Secure Planner by changing the system that actually enforces the permission you want: adjust Microsoft 365 Group membership for plan access, set SharePoint sharing for attachments, and use Azure AD Conditional Access and tenant collaboration controls for guest and device restrictions. Test on a pilot Group, record the pre-change settings, and verify results with audit and sign-in logs. If access breaks, re-add users to the Group or revert site sharing while you investigate.

Frequently Asked Questions

Can I disable Planner entirely for my tenant?

There is no single "disable Planner" switch exposed to end admins in Planner itself. You can block client access through Conditional Access by targeting the Planner service or Office 365 app, and you can restrict creation of new Microsoft 365 Groups (which prevents new plans). For existing plans, remove Group membership or use tenant guest and SharePoint policies to restrict access.

Do sensitivity labels protect Planner task content?

No. Sensitivity labels apply to files stored in SharePoint and other supported file stores; they do not label Planner task titles, comments, or checklists. Protect sensitive information by applying labels to documents attached to tasks and by restricting who can access the underlying SharePoint site.

How do I audit who downloaded a file attached to a Planner task?

Use SharePoint file access logs and Microsoft 365 audit logs. In the Purview compliance portal, search the audit log for events like "FileDownloaded" or check the document library's access records. Azure AD sign-in logs can show whether the user authenticated successfully around the download time.