Microsoft 365 Endpoint AdministratorManage identity and compliance (10-15%)Easy

A company policy states that all highly confidential emails sent from Exchange Online must be encrypted and prevent forwarding. The administrator has already created a sensitivity label named 'Highly Confidential' with the appropriate encryption and content marking settings. Which additional step is required to enforce the 'prevent forwarding' restriction when users apply this label?

  1. AEnsure the sensitivity label is published to end-users.
  2. BConfigure an Exchange mail flow rule (transport rule).
  3. CEnable Azure Information Protection (AIP) Unified Labeling client.
  4. DConfigure a Data Loss Prevention (DLP) policy in Microsoft Purview.
Show answer & explanation

Correct answer: A. Ensure the sensitivity label is published to end-users.

For users to be able to apply a sensitivity label and for its associated protection settings (like encryption and 'prevent forwarding') to take effect, the label must first be published to them via a label policy.

Why the other options are wrong

  • B. Mail flow rules can apply labels or enforce actions, but if the label is already created, it needs to be available to users first.
  • C. The AIP Unified Labeling client is for older Windows desktop apps; the question implies Exchange Online and a modern sensitivity label.
  • D. DLP policies detect and prevent data exfiltration, they don't enable users to apply sensitivity labels and their associated protections.

Sensitivity Label Publishing

The process of making a created sensitivity label available to specific users or groups within an organization so they can apply it to their content.

  • Labels are useless until published.
  • Published via label policies in Microsoft Purview.
  • Targeted to specific users/groups.

Memory trick: To use the label, you first have to share it with everyone.

More Manage identity and compliance (10-15%) questions