Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Purview complianceHard
A manufacturing company needs to manage access to highly confidential design documents stored in SharePoint Online. These documents should only be accessible by members of the 'Design Team' and 'Management' groups. Furthermore, members of the 'Contractors' group, even if they are part of the 'Design Team', should never be able to access these specific documents. Which Microsoft Purview feature would allow the administrator to implement these granular access controls and exclusions?
- ABasic SharePoint permissions and security groups
- BSensitivity labels with container management
- CInformation Barriers (IB) policies
- DAdaptive scopes for retention policies
Show answer & explanationAnswer & explanation
Correct answer: B. Sensitivity labels with container management
Sensitivity labels with container management (for SharePoint sites) allow defining specific access controls, including restricting access to designated groups ('Design Team', 'Management') and excluding others (e.g., 'Contractors') even if they are members of an included group, providing granular control.
Why the other options are wrong
- A. Basic SharePoint permissions can grant access, but excluding members of one group who are *also* in an allowed group is complex and prone to misconfiguration.
- C. Information Barriers prevent communication between user groups, not granular document access control within a site.
- D. Adaptive scopes dynamically target policies for retention, not for real-time access control to documents.
Sensitivity Labels with Container Management
Sensitivity labels applied to containers (SharePoint sites, Teams, Microsoft 365 Groups) allow organizations to enforce access controls, external sharing restrictions, and other settings directly on the container and its content.
- Applies labels to SharePoint sites, Teams, M365 Groups.
- Enforces access control (public/private, specific groups).
- Can restrict external sharing, unmanaged device access.
Memory trick: Labels protect the container, excluding the strainer.