Microsoft 365 Endpoint AdministratorManage identity and compliance (10-15%)Easy
A company policy states that all highly confidential emails sent from Exchange Online must be encrypted and prevent forwarding. The administrator has already created a sensitivity label named 'Highly Confidential' with the appropriate encryption and content marking settings. Which additional step is required to enforce the 'prevent forwarding' restriction when users apply this label?
- AEnsure the sensitivity label is published to end-users.
- BConfigure an Exchange mail flow rule (transport rule).
- CEnable Azure Information Protection (AIP) Unified Labeling client.
- DConfigure a Data Loss Prevention (DLP) policy in Microsoft Purview.
Show answer & explanationAnswer & explanation
Correct answer: A. Ensure the sensitivity label is published to end-users.
For users to be able to apply a sensitivity label and for its associated protection settings (like encryption and 'prevent forwarding') to take effect, the label must first be published to them via a label policy.
Why the other options are wrong
- B. Mail flow rules can apply labels or enforce actions, but if the label is already created, it needs to be available to users first.
- C. The AIP Unified Labeling client is for older Windows desktop apps; the question implies Exchange Online and a modern sensitivity label.
- D. DLP policies detect and prevent data exfiltration, they don't enable users to apply sensitivity labels and their associated protections.
Sensitivity Label Publishing
The process of making a created sensitivity label available to specific users or groups within an organization so they can apply it to their content.
- Labels are useless until published.
- Published via label policies in Microsoft Purview.
- Targeted to specific users/groups.
Memory trick: To use the label, you first have to share it with everyone.