Using Microsoft Purview to Classify and Label PII in Source Code
Your organization uses Microsoft Purview to manage sensitive data in Azure DevOps repositories. The compliance team needs to automatically classify and label source code that contains personally identifiable information (PII). Which solution should you use?
Quick Answer
Microsoft Purview Information Protection is built to automatically scan repositories and classify sensitive content — using built-in sensitive-information types and classifiers to detect patterns like PII, then apply the matching sensitivity label directly to the affected files. That gives the compliance team automatic, ongoing classification without writing custom detection logic.
⚠ Common exam trap
Many candidates confuse Microsoft Purview Information Protection (which handles data classification and labeling) with Azure Policy (which handles resource governance) or Microsoft Defender for Cloud (which handles security posture), leading them to select a tool that cannot perform content-level scanning or labeling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Purview Information Protection to automatically scan and label repositories.
Microsoft Purview Information Protection provides built-in data classification and labeling capabilities that can automatically scan Azure DevOps repositories for sensitive data such as PII. It uses sensitive information types and machine learning classifiers to detect patterns like social security numbers or credit card numbers, then applies the appropriate sensitivity label directly to the source code files. This meets the compliance team's requirement for automatic classification and labeling without custom development.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Policy to enforce PII labeling on repositories.
Why it's wrong here
Azure Policy cannot inspect source code content for PII.
- ✓
Use Microsoft Purview Information Protection to automatically scan and label repositories.
Why this is correct
Purview Information Protection can automatically classify and label sensitive data in source code.
- ✗
Use Microsoft Sentinel to detect PII in repositories.
Why it's wrong here
Sentinel is a SIEM, not a data classification tool.
- ✗
Use Microsoft Defender for Cloud to scan for PII.
Why it's wrong here
Defender for Cloud focuses on security configurations, not data classification.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Purview to classify and protect sensitive data. You need to ensure that source code in Azure DevOps repositories containing credit card numbers is detected and flagged. What should you configure?
easy- A.Create a Data Loss Prevention (DLP) policy in Microsoft 365.
- B.Set up Microsoft Sentinel to monitor Azure DevOps logs.
- ✓ C.Configure a Microsoft Purview Data Classification scan for Azure DevOps repositories.
- D.Enable Microsoft Defender for Cloud to scan repositories.
Why C: Microsoft Purview Data Classification scans can be configured to scan Azure DevOps repositories for sensitive data types, such as credit card numbers, using built-in or custom sensitive information types. This allows the organization to detect and flag source code containing credit card numbers directly within the repository, aligning with the requirement to classify and protect sensitive data under a compliance plan.
Variation 2. Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Azure DevOps repositories. The compliance team has identified that source code containing credit card numbers (PCI data) was accidentally committed to a public repository. You need to implement a solution that meets the following requirements: (1) Automatically scan all new commits in Azure Repos for sensitive data types like credit card numbers. (2) If sensitive data is detected, automatically block the push and notify the security team. (3) The solution must be integrated with Microsoft Purview and Azure DevOps. Option A: Enable Microsoft Purview Data Loss Prevention for Azure DevOps, which automatically scans and blocks pushes containing sensitive data. Option B: Configure a branch policy in Azure Repos that runs a custom Azure Function via a service hook when a push occurs, and the function uses Purview APIs to scan the commit. Option C: Use GitHub Advanced Security secret scanning for Azure Repos, and configure a webhook to notify the security team. Option D: Install a third-party extension from Azure DevOps Marketplace that provides content scanning and configure it to block pushes. Which option is the most appropriate and efficient?
medium- ✓ A.Enable Microsoft Purview Data Loss Prevention for Azure DevOps, which automatically scans and blocks pushes containing sensitive data
- B.Configure a branch policy in Azure Repos that runs a custom Azure Function via a service hook when a push occurs, and the function uses Purview APIs to scan the commit
- C.Use GitHub Advanced Security secret scanning for Azure Repos, and configure a webhook to notify the security team
- D.Install a third-party extension from Azure DevOps Marketplace that provides content scanning and configure it to block pushes
Why A: Microsoft Purview DLP for Azure DevOps (currently in preview) provides native integration to automatically scan commits for sensitive data types like credit card numbers and block the push if detected, meeting all requirements natively without custom development. Option B describes a custom Azure Function approach which is more complex and not native, and may not integrate as seamlessly with Purview. Option C uses GitHub Advanced Security, which is not available for Azure Repos (it's for GitHub repositories). Option D relies on a third-party extension, which may not have native Purview integration and could be less reliable. Therefore, Option A is the most appropriate and efficient solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.