A water utility wants public-health attachments protected with classification and protection before they enter email workflows. Which Purview focus fits?

A water utility that wants public-health attachments protected with classification and protection before they enter email workflows should focus on Microsoft Purview Information Protection concepts for labeling and protecting sensitive attachments. Applying sensitivity labels and protection prior to or as part of email handling reduces the chance that unprotected public-health files circulate through Exchange Online.

Microsoft Purview Data Loss Prevention policies for detecting and blocking sensitive attachments act after content is identified to block or restrict sharing, but they are not the labeling capability that classifies and applies persistent protection beforehand; labeling is the Information Protection concept the water utility needs before DLP policies have consistent labels to detect on. Microsoft Purview Insider Risk Management indicators for detecting risky handling of sensitive attachments surface risky insider activity signals, not the labeling and protection of attachments before they enter email workflows. Microsoft Purview Communication Compliance policies for reviewing sensitive attachments in email workflows help review messages already in email workflows for policy concerns, but they do not classify attachment sensitivity or apply persistent protection before attachments enter those workflows.

Exam caveat: Pre-email protection of sensitive attachments maps to Information Protection labeling/protection, not Data Loss Prevention policies for detecting and blocking, Insider Risk Management indicators for detecting risky handling, or Communication Compliance policies for reviewing. AB-900 expects the Purview family name when the stem says classify and protect.

Operational check: Require sensitivity labels on public-health attachment libraries, enable protection actions for the highest labels, block or warn on unlabeled highly sensitive sends via complementary DLP if needed, and test an email workflow where a labeled attachment retains protection for internal water-utility recipients and restricts external forwarding per policy.