Compliance wants a protection marking attached to Fabric items containing culturally restricted donor records, so that if an analyst exports the data to an Excel file, the same protection (such as encryption or access restriction) travels with the exported file. Which feature accomplishes this?

Sensitivity labels, backed by Microsoft Purview Information Protection, classify a Fabric item and can enforce protection — such as encryption or restricted access — that persists when data is exported to supported downstream file formats, so the classification and its protection don't stop at the Fabric boundary. This directly matches the compliance requirement: the marking follows the donor-records data into an exported Excel file. Endorsement (Promoted or Certified) is a trust-and-quality signal about an item's reliability for reuse — it carries no protection or classification and has nothing to do with export behavior. Row-level security filters which rows a querying identity sees inside the Warehouse or Lakehouse; it has no bearing on a file once it has already been exported, since the filtering happens at query time, not after the fact. Fabric audit logs record that an export happened and by whom, which supports investigation after the fact, but they don't apply any protection to the exported file itself. To confirm the setup, compliance should export a labeled item and check that the resulting file opens with the expected protection (such as a permission prompt or encryption indicator) intact.