A healthcare organization deploys Microsoft Copilot for Microsoft 365. The legal team requires that all Copilot interactions involving Protected Health Information (PHI) be flagged for legal review before the interaction data can be deleted. Which Microsoft 365 feature achieves this?

C is correct because Microsoft Purview Communication Compliance policies can be configured to detect PHI content in Copilot interactions and route them to reviewers. The review workflow ensures that interactions are not deleted (through retention conflicts) until reviewers have assessed them, meeting the legal review requirement. A is incorrect because eDiscovery legal holds preserve existing content and prevent deletion but do not provide the flagging and review workflow needed for ongoing PHI detection in new interactions. B is incorrect because a retention policy prevents deletion during the retention period but does not provide a review workflow or flag interactions for legal team action. D is incorrect because Conditional Access restricts access to Copilot but does not provide a content review workflow for PHI in interactions.