A Microsoft 365 administrator wants to implement a policy that automatically encrypts all emails containing specific sensitive keywords or attachments, regardless of the recipient. The goal is to ensure that even if an email is accidentally sent to the wrong external party, its content remains protected. Which Microsoft 365 capability should be configured?
- AMicrosoft Purview Message Encryption (MPE)
- BMicrosoft Purview Information Protection (MPIP) sensitivity labels
- CMicrosoft Purview Data Loss Prevention (DLP)
- DMicrosoft Purview Communication Compliance
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Purview Message Encryption (MPE)
While MPIP sensitivity labels can apply encryption, Microsoft Purview Message Encryption (MPE) is the specific underlying technology that handles the encryption of emails. It can be triggered by transport rules (often configured via DLP policies or directly in Exchange mail flow rules) to automatically encrypt emails based on content or recipient, ensuring data protection in transit and at rest for external recipients.
Why the other options are wrong
- B. MPIP sensitivity labels can apply encryption to documents and emails, but MPE specifically refers to the email encryption service itself, which can be configured independently or via labels. The question focuses on *automatic encryption* of emails.
- C. DLP policies can *trigger* encryption, but MPE is the encryption technology itself. DLP's primary function is prevention, not encryption.
- D. Communication Compliance monitors messages for policy violations, it does not encrypt emails.
Microsoft Purview Message Encryption (MPE)
A service in Microsoft 365 that allows organizations to send encrypted emails to anyone, inside or outside the organization. It uses Azure Information Protection to protect the content of emails, ensuring they remain confidential and are only viewable by authorized recipients.
- Encrypts emails sent to internal and external recipients.
- Can be triggered automatically by mail flow rules or DLP policies.
- Protects email content in transit and at rest.
Memory trick: Message Encryption: Lock your emails so only the right eyes can see.