An organization has deployed Microsoft Copilot for Microsoft 365. The security team wants to ensure that Copilot cannot surface files labeled 'Confidential - Finance' to users who do not have the appropriate sensitivity label permissions. Which configuration achieves this outcome?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — c is correct because Microsoft Purview sensitivity labels enforce access control through encryption and rights management. When files are labeled 'Confidential - Finance' with protection settings, only authorized users can decrypt and access those files, and Copilot respects these permissions—it cannot surface content the user is not authorized to read.
Full Explanation
C is correct because Microsoft Purview sensitivity labels enforce access control through encryption and rights management. When files are labeled 'Confidential - Finance' with protection settings, only authorized users can decrypt and access those files, and Copilot respects these permissions—it cannot surface content the user is not authorized to read. A is wrong because DLP policies for Copilot prevent sharing or output of sensitive content, but do not control underlying file access permissions. B is wrong because Conditional Access governs sign-in to Copilot, not per-file content permissions within it. D is wrong because Defender for Cloud Apps session policies can block downloads or uploads but do not enforce label-based access to Copilot-retrieved content.