An organization has deployed Microsoft Copilot for Microsoft 365. The security team wants to ensure that Copilot cannot surface files labeled 'Confidential - Finance' to users who do not have the appropriate sensitivity label permissions. Which configuration achieves this outcome?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because Microsoft Purview sensitivity labels enforce access control through encryption and rights management. When files are labeled 'Confidential - Finance' with protection settings, only authorized users can decrypt and access those files, and Copilot respects these permissions—it cannot surface content the user is not authorized to read.
Full explanation below image
Full Explanation
C is correct because Microsoft Purview sensitivity labels enforce access control through encryption and rights management. When files are labeled 'Confidential - Finance' with protection settings, only authorized users can decrypt and access those files, and Copilot respects these permissions—it cannot surface content the user is not authorized to read. A is wrong because DLP policies for Copilot prevent sharing or output of sensitive content, but do not control underlying file access permissions. B is wrong because Conditional Access governs sign-in to Copilot, not per-file content permissions within it. D is wrong because Defender for Cloud Apps session policies can block downloads or uploads but do not enforce label-based access to Copilot-retrieved content.