A security engineer is configuring Microsoft Purview sensitivity labels for documents that will be used as grounding data for an Azure OpenAI RAG solution. The requirement is that documents labeled 'Highly Confidential' cannot be retrieved and used as grounding context by the AI. How should this be enforced?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when you apply Purview sensitivity label encryption to 'Highly Confidential' docs, only identities with Rights Management usage rights can decrypt them. If the Azure AI Search index account doesn't have decryption rights, it can't index those docs, so they can't be used as RAG grounding data.
Full Explanation
The correct approach is to configure sensitivity label encryption on 'Highly Confidential' documents so the Azure AI Search index account cannot decrypt them. When Microsoft Purview sensitivity labels apply encryption, only identities granted Rights Management usage rights can decrypt the content. If the Azure AI Search service identity is not granted decryption rights, it cannot index the encrypted 'Highly Confidential' documents, preventing them from being used as RAG grounding data. The custom skillset option that skips documents with 'Highly Confidential' labels during indexing is incorrect because custom skillsets require custom code and do not natively check Purview sensitivity labels during indexing. The Purview DLP policy option is incorrect because DLP policies target data movement and sharing scenarios, not Azure AI Search indexing operations. The Entra RBAC option denying the Azure AI Search managed identity read permissions to 'Highly Confidential' SharePoint libraries is incorrect because RBAC controls site/library access, while encryption is more reliable and portable across data stores.