Contoso is running a confidential merger and acquisition project. Project documents stored in a dedicated SharePoint site must be encrypted so only designated M&A team members can open them — even if a document is accidentally shared externally or downloaded to a personal device. The protection must travel with the document. What should the admin configure?

Microsoft Purview sensitivity labels with encryption use Azure Rights Management under the hood to embed cryptographic protection directly in the document file itself. When a sensitivity label with encryption is applied to a document, the file is encrypted and the decryption key is controlled by Microsoft Entra ID. The admin specifies in the label's encryption settings which users or groups can access the content and what permissions they have, such as View, Edit/Co-author, or Full Control. Assigning co-author permissions to the M&A project security group means only group members can open and edit the files, regardless of where the files travel. Publishing the label with a default application to the M&A SharePoint site means all new documents in the site automatically receive the label and encryption.

The DLP policy that blocks external sharing of files containing the word 'Confidential' from the M&A SharePoint site provides a network-layer control that prevents sharing from within Microsoft 365, but it does not encrypt the document. If the file is downloaded by a legitimate M&A team member and then emailed or copied to another location, the DLP policy no longer applies, and the file is unprotected. DLP and sensitivity labels are complementary: DLP prevents oversharing within the service, while sensitivity label encryption protects the file everywhere.

The retention label that prevents deletion and restricts editing for 5 years is a data lifecycle control, not an information protection control. Retention labels manage when content can be deleted or must be preserved, and they have no encryption or access control capability. The retention label cannot restrict who can open or edit a document.

The Conditional Access policy that blocks external sharing of documents from the M&A SharePoint site is a valid access control for the SharePoint site itself, but it does not protect the files that are already downloaded or that travel outside the SharePoint service. Conditional Access operates at the authentication level, so it cannot follow a file after it has been downloaded to a device.

Exam tip: Sensitivity labels have two protection components that can be applied independently: encryption, which uses Azure Rights Management to control who can open the file, and content marking, which adds visual markings such as watermarks, headers, and footers. Auto-labeling can apply labels to content at rest in SharePoint or OneDrive, or in transit through Exchange, based on sensitive information types or trainable classifiers. Know that sensitivity labels require Microsoft Purview Information Protection licensing, such as Microsoft 365 E3/E5 or equivalent.