A security engineer configures the Microsoft Purview AI Hub and notices that some AI interactions are categorized as 'Sensitive information detected' but no policy action was taken. What is the most likely reason?
Select an answer to reveal the explanation.
Short Explanation
If you see 'Sensitive information detected' but no action, it's because the AI Hub is in audit-only mode. Detection gives you visibility, but you need a linked DLP policy with enforcement actions to actually block or warn.
Full Explanation
The correct answer is the option stating that the AI Hub is in audit-only mode and requires a DLP policy with enforcement actions to be linked. The Microsoft Purview AI Hub provides visibility and detection of sensitive content in AI interactions, but enforcement actions require a Microsoft Purview DLP policy to be configured with appropriate rules and enforcement actions. The AI Hub itself is an observability and detection surface, not an enforcement engine. The option about sensitivity labels not being configured with encryption is incorrect because encryption on sensitivity labels is a separate control for document protection and does not affect AI Hub enforcement. The option about requiring Microsoft Entra ID P2 licenses for enforcement actions is incorrect because AI Hub enforcement is controlled by DLP policies, not an Entra ID P2 license requirement. The option about the user having a DLP policy exemption applied to their account is incorrect because DLP exemptions would prevent the detection entirely, not just the enforcement action.