Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Purview complianceMedium
A Human Resources department uses Microsoft 365 and needs to ensure that all documents containing employee performance reviews are automatically assigned a sensitivity label that encrypts the document and restricts access to only HR personnel. These documents are created in various SharePoint Online sites and OneDrive accounts. The identification of these documents should be based on a combination of keywords such as 'performance review' and 'employee ID'. Which method should the administrator use to achieve this automated labeling?
- AAuto-labeling policies for content containing specific Sensitive Information Types (SITs) or keywords
- BCreating a custom retention policy with a preservation lock
- CData Loss Prevention (DLP) policies to block sharing
- DManual application of sensitivity labels by users
Show answer & explanationAnswer & explanation
Correct answer: A. Auto-labeling policies for content containing specific Sensitive Information Types (SITs) or keywords
Auto-labeling policies can be configured to automatically apply a sensitivity label based on the presence of specific keywords ('performance review') and Sensitive Information Types (SITs, like 'employee ID'), ensuring encryption and restricted access as required.
Why the other options are wrong
- B. A custom retention policy with a preservation lock focuses on data retention and immutability, not automatic encryption and access restriction based on content.
- C. DLP policies prevent data loss but do not automatically apply sensitivity labels for encryption and access control.
- D. Manual application is prone to user error and does not ensure consistent, automatic protection.
Auto-labeling Policies (Sensitivity Labels)
Auto-labeling policies for sensitivity labels automatically apply a designated label to content (emails, documents) based on conditions such as the presence of sensitive information types, keywords, or patterns, enforcing protection like encryption or access restrictions.
- Automates sensitivity label application.
- Uses conditions like SITs, keywords, regex patterns.
- Ensures consistent protection (encryption, access control).
Memory trick: Auto-labels find keywords, then protection they herd.