Hi all,

I have created a SharePoint site Sensitivity set to Highly Confidential. In CSS I have set up this sensitivity label as follows.

The site and Group Settings -Private- Only Members can access the site 

Also unchecked - External users access- Let O365 group owner add people outside the organization to the group.

Then I have shared a document with an external user. The external user successfully can access this document. Is this expected behavior or the SharePoint site shouldn't allow an external user to access this document because the site is classified as Highly Confidential.

FYI- Document is not classified, the document sitting on the document library on the above site and the external user is not a member of the site.