A financial services company uses Microsoft 365 Copilot and must prevent the AI from surfacing salary data stored in SharePoint to users outside the Human Resources department. Users in HR have a specific Microsoft Entra ID group. Which combination of controls enforces this restriction?
Select an answer to reveal the explanation.
Short Explanation
You need both controls. Restricting the SharePoint site to the HR group stops Copilot from indexing or retrieving salary files for non-HR users, and sensitivity-label encryption keeps the files decryptable only by HR even if they move or get shared.
Full Explanation
The combination of sensitivity-label encryption restricted to the HR group and SharePoint site permissions restricted to the HR group is required because defense-in-depth is needed. Restricting SharePoint site access to the HR group means non-HR users cannot access the site containing salary files, so Copilot—which operates within the user's permissions—cannot index or retrieve that content for non-HR users. Adding sensitivity-label encryption that restricts decryption to the HR group provides a second layer: even if files are moved or shared, only HR users can decrypt them. Together, these controls prevent Copilot from surfacing salary data to unauthorized users. The sensitivity-label encryption option alone is wrong because it requires careful label application to every salary document; an unlabeled document would not be protected, and the label alone does not prevent non-HR users from accessing salary content that is not labeled. The SharePoint site permission option alone is wrong because it relies solely on SharePoint permissions, which could be bypassed if files are shared improperly, copied, or moved outside the restricted site. The keyword-based data-loss-prevention policy option is wrong because keyword-based data-loss-prevention is imprecise and does not address the underlying access control problem.