Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Purview complianceMedium
A healthcare provider is implementing Microsoft Purview to ensure compliance with HIPAA regulations. They need to categorize and protect all documents containing Protected Health Information (PHI) within SharePoint Online and Exchange Online. The protection must include encryption and visual markings (header/footer). Additionally, the company requires that these documents cannot be shared with external users, even if the external user has an Azure AD account. Which Microsoft Purview feature should be used to achieve this comprehensive protection?
- ARegulatory Record declaration with preservation locks
- BData Loss Prevention (DLP) policies with custom sensitive information types
- CSensitivity labels with encryption and container management
- DInformation Barriers with communication compliance policies
Show answer & explanationAnswer & explanation
Correct answer: C. Sensitivity labels with encryption and container management
Sensitivity labels provide comprehensive data protection by allowing classification, encryption, visual markings, and strong access controls, including preventing sharing with external users. Container management extends this protection to sites and groups.
Why the other options are wrong
- A. Regulatory Record declaration manages immutable retention, not encryption, visual markings, or dynamic sharing restrictions.
- B. DLP policies detect and prevent sharing, but sensitivity labels are required for encryption, visual markings, and persistent access control on the document itself.
- D. Information Barriers segment user groups and Communication Compliance monitors communications, neither directly encrypts documents or prevents external sharing based on content classification.
Sensitivity Labels (Comprehensive)
Microsoft Purview Sensitivity Labels enable classification, encryption, visual markings, and granular access controls for documents, emails, and containers, ensuring persistent protection regardless of location or sharing.
- Applies classification and protection directly to content.
- Includes encryption, visual markings, and access restrictions.
- Can prevent external sharing and extend to containers (sites/groups).
Memory trick: Labels 'stick' to your data, protecting it everywhere it goes, even outside!