A security engineer is configuring Microsoft Purview sensitivity labels for documents that will be used as grounding data for an Azure OpenAI RAG solution. The requirement is that documents labeled 'Highly Confidential' cannot be retrieved and used as grounding context by the AI. How should this be enforced?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because when Microsoft Purview sensitivity labels apply encryption to documents, only identities granted Rights Management usage rights can decrypt the content. If the Azure AI Search service identity is not granted decryption rights, it cannot index the encrypted 'Highly Confidential' documents, preventing them from being used as RAG grounding data.
Full explanation below image
Full Explanation
D is correct because when Microsoft Purview sensitivity labels apply encryption to documents, only identities granted Rights Management usage rights can decrypt the content. If the Azure AI Search service identity is not granted decryption rights, it cannot index the encrypted 'Highly Confidential' documents, preventing them from being used as RAG grounding data. A is incorrect because custom skillsets require custom code and do not natively check Purview sensitivity labels during indexing. B is incorrect because Purview DLP policies target data movement and sharing scenarios, not Azure AI Search indexing operations. C is incorrect because RBAC on SharePoint controls site/library access but encryption is more reliable and portable across data stores.