Fabrikam's compliance team needs to prevent credit card numbers from being shared in Microsoft Teams chats and channel messages, including in Microsoft 365 Copilot interactions within Teams. A policy must block users from sending this information and notify them of the policy violation in real time. What should the admin create?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Microsoft Purview DLP is exactly the right tool for this — it's your digital bouncer who scans outgoing messages for credit card patterns (16 digits in the right format) and stops them from going through while popping up a policy tip that says 'Hey, you're about to share payment card data — is this right?' It covers both Teams chats AND Copilot interactions in Teams because DLP applies at the service layer, not just the app.
Full explanation below image
Full Explanation
Microsoft Purview Data Loss Prevention (DLP) policies can be scoped to Teams chat and channel messages as a workload location. When creating a DLP policy, the admin selects 'Teams chat and channel messages' as the location and adds the 'Credit Card Number' built-in sensitive information type (SIT) to the policy rule. The rule action is set to 'Block users from sending the message' (or block with override option for less strict enforcement), and a policy tip (user notification) is configured to inform the user in real time why their message was blocked. DLP policies in Teams also extend to Microsoft 365 Copilot interactions within Teams, since Copilot interactions are subject to the same DLP policy evaluation as direct messages and channel posts.
Option A (sensitivity label policy) controls how users can classify, protect, and share documents and emails — it does not scan message content for data patterns like credit card numbers in real time during Teams chat. Sensitivity labels are applied by users (or automatically based on content) to classify content, not to prevent transmission of specific data patterns.
Option B (Conditional Access blocking Teams access) is entirely the wrong tool. Conditional Access makes binary access decisions at sign-in time — a user either gets access to Teams or they don't, based on conditions like device compliance or MFA. It has no ability to inspect message content or block specific types of content during Teams usage.
Option D (Teams admin center disable content sharing) is an all-or-nothing control — it would prevent users from sharing any files or content in Teams, which would destroy legitimate collaboration capabilities. This does not target credit card data specifically, and it would not apply to typed text in chat messages (only file sharing). This is too broad and operationally destructive.
Exam tip: Microsoft Purview DLP now supports a broad range of Microsoft 365 locations: Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, Microsoft 365 Copilot interactions, Endpoint devices, and third-party apps via Defender for Cloud Apps. For the AB-650 exam, know that Teams + Copilot coverage is provided by the 'Teams chat and channel messages' location in DLP. The Credit Card Number SIT uses regex patterns and checksum validation to detect credit card data.