School district IT needs SharePoint Advanced Management capabilities that help limit oversharing on sensitive libraries. Which description is accurate?

School-district IT should understand that SharePoint Advanced Management (SAM) features such as restricted access control help govern and limit oversharing on sensitive SharePoint content. SAM provides governance capabilities aimed at tightening access and reducing sprawling sharing on libraries that hold student, HR, or other sensitive district records.

SAM does not configure data loss prevention policies to block external sharing of sensitive district library documents; DLP handles that separately, while SAM governs sharing and access at the site level. It does not enforce conditional access policies requiring multifactor authentication for access to sensitive district sites; that's Entra Conditional Access, while restricted access control is configured per site so districts can target sensitive libraries specifically. It does not apply sensitivity labels to district library documents to classify content for retention and discovery handling; sensitivity labels are applied through Microsoft Purview, not SAM.

Exam caveat: SAM complements Entra Conditional Access and DLP, but it does not apply sensitivity labels to district documents—that's a Microsoft Purview capability. When AB-900 asks how to limit oversharing on sensitive libraries with Advanced Management, restricted access control and related SAM features are the correct conceptual answer.

Operational check: Enable appropriate SAM restricted access control on sensitive district libraries, review sharing reports afterward, remove lingering Anyone links, keep Conditional Access policies for students and staff intact, and document the SAM configuration in the district's data-governance runbook before Copilot pilots touch those libraries.