A financial services company uses Microsoft 365 Copilot and must prevent the AI from surfacing salary data stored in SharePoint to users outside the Human Resources department. Users in HR have a specific Microsoft Entra ID group. Which combination of controls enforces this restriction?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because a defense-in-depth approach is required. Restricting SharePoint site permissions (B) means non-HR users do not have access to the SharePoint site containing salary files, so Copilot—which operates within the user's permissions—cannot index or retrieve that content for non-HR users.
Full explanation below image
Full Explanation
D is correct because a defense-in-depth approach is required. Restricting SharePoint site permissions (B) means non-HR users do not have access to the SharePoint site containing salary files, so Copilot—which operates within the user's permissions—cannot index or retrieve that content for non-HR users. Adding sensitivity label encryption (A) provides a second layer: even if files are ever moved or shared, only users in the HR group can decrypt them. Together, these controls comprehensively prevent Copilot from surfacing salary data to unauthorized users. B alone relies solely on SharePoint permissions, which could be bypassed if files are shared improperly. A alone requires careful label application to every file. C is wrong because keyword-based DLP is imprecise and does not address the underlying access control problem.