How to Auto-Apply a Sensitivity Label with a Custom Sensitive Info Type and Require Justification for Removal
A compliance officer needs to automatically detect and apply a sensitivity label to documents in SharePoint Online that contain a custom sensitive information type (e.g., employee ID pattern). The label must be applied automatically, and users must be prompted to provide a justification when attempting to remove the label. Which combination of configurations should the officer implement?
Quick Answer
The correct answer is to create a sensitivity label with an auto-labeling policy that uses a custom sensitive info type, and configure the label’s protection settings to require user justification to remove the label. This works because Microsoft Purview auto-labeling policies can scan documents in SharePoint Online for patterns like employee IDs defined as custom sensitive information types, then automatically apply the label. The justification requirement is a separate setting within the label’s protection configuration, ensuring users cannot strip the label without providing a reason. On the MS-102 exam, this scenario tests your understanding that auto-labeling policies handle detection and application, while the label’s own settings control removal behavior. A common trap is confusing auto-labeling policies with manual label recommendations or forgetting that justification is a per-label protection setting, not part of the policy itself. Memory tip: think “policy applies, label protects”—the policy finds the data, the label locks down removal.
⚠ Common exam trap
It's easy for candidates to confuse retention labels (which handle lifecycle) with sensitivity labels (which handle classification and protection), or they mistakenly think DLP policies can enforce label removal justification, which is a sensitivity label property, not a DLP rule action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a sensitivity label with an auto-labeling policy that uses a custom sensitive info type, and configure the label's protection settings to require user justification to remove the label.
Microsoft Purview sensitivity labels support auto-labeling policies that can automatically apply a label based on custom sensitive information types (e.g., employee ID patterns). Additionally, the label's protection settings include an option to require user justification when removing the label, which meets the compliance officer's requirement for both automatic detection and removal justification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a sensitivity label with an auto-labeling policy that uses a custom sensitive info type, and configure the label's protection settings to require user justification to remove the label.
Why this is correct
This allows automatic detection and application of the label, and the justification requirement prevents easy removal.
- ✗
Create a retention label and publish it to the site via auto-labeling policy.
Why it's wrong here
Retention labels do not support automatic classification based on sensitive info types; they are for retention actions.
- ✗
Use a Data Loss Prevention (DLP) policy to apply the label and configure the policy to block removal.
Why it's wrong here
DLP policies can apply labels but cannot enforce user justification for label removal; that is a label setting.
- ✗
Deploy the Azure Information Protection scanner to scan SharePoint Online documents.
Why it's wrong here
Azure Information Protection scanner is designed for on-premises file shares and does not integrate with SharePoint Online auto-labeling.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A compliance officer needs to automatically detect and apply a sensitivity label to documents in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. The label should be applied automatically, and users must be able to override the label with a justification. Which two Microsoft Purview components must be configured to achieve this?
medium- ✓ A.sensitive info type (SIT) and an auto-labeling policy
- B.sensitivity label with auto-labeling for SharePoint and a policy tip
- C.data loss prevention (DLP) policy and a retention label
- D.default sensitivity label and a compliance tag
Why A: An auto-labeling policy can scan SharePoint Online for sensitive info types (SITs) like social security numbers and automatically apply a sensitivity label. The policy can be configured to allow users to override the label with a justification via the 'Mandatory labeling with justification' setting in the sensitivity label policy. Option B is incorrect because policy tips are a feature of Data Loss Prevention (DLP) policies, not sensitivity label auto-labeling. User override with justification is handled by the sensitivity label policy's 'Mandatory labeling' setting, not a policy tip. Therefore, only option A correctly identifies the required components.
Variation 2. A compliance officer needs to automatically apply a sensitivity label to all documents in SharePoint Online that contain a credit card number. The label must mark the document as 'Confidential' and encrypt it. Which two Microsoft Purview components must be configured to achieve automatic labeling based on sensitive content? (Choose two.)
hard- ✓ A.Sensitivity label
- ✓ B.Auto-labeling policy
- C.Data Loss Prevention (DLP) policy
- D.Retention label policy
Why A: Sensitivity labels define the classification and protection settings (e.g., 'Confidential' marking and encryption). Auto-labeling policies automatically apply those labels to documents containing sensitive information types, such as credit card numbers, without requiring user intervention. Together, they enable automatic labeling based on sensitive content in SharePoint Online.
Variation 3. A compliance officer needs to automatically apply a sensitivity label that encrypts documents in SharePoint Online when the documents contain a custom regex pattern (e.g., employee ID). The labeling must occur automatically without requiring user interaction. Which two Microsoft Purview components must be configured? (Select the option that correctly identifies both components.)
medium- ✓ A.An auto-labeling policy and a sensitivity label with encryption configured
- B.Data Loss Prevention (DLP) policy and a sensitivity label
- C.retention label and an auto-labeling policy
- D.sensitive info type and a sensitivity label
Why A: It includes both an auto-labeling policy (to automatically apply the label without user interaction) and a sensitivity label with encryption (to protect documents containing the custom regex pattern). Option D is incorrect because it lacks the auto-labeling policy; a sensitive info type and a sensitivity label alone cannot automatically apply the label. Only option A provides both required components.
Variation 4. A compliance officer needs to automatically apply a sensitivity label that encrypts documents in SharePoint Online when they contain credit card numbers. The solution must not require manual user action. Which two Microsoft Purview components must be configured? (Select the option that correctly identifies both required components.)
medium- ✓ A.Sensitivity labels and auto-labeling policies
- B.Data loss prevention (DLP) policies and retention labels
- C.Sensitivity labels and retention policies
- D.Auto-labeling policies and communication compliance policies
Why A: The requirement is to automatically apply a sensitivity label that encrypts documents containing credit card numbers, without manual user action. Sensitivity labels define the encryption and protection settings, while auto-labeling policies automatically apply those labels based on sensitive information types (e.g., credit card numbers). This combination meets the automation and encryption need. Option B is incorrect because retention labels do not provide encryption; they are designed for retention and deletion policies, not for protection. DLP policies can detect sensitive data but cannot directly apply retention labels with encryption; moreover, retention labels lack encryption capabilities. Therefore, only Option A correctly identifies the two required components.
Variation 5. A compliance officer needs to automatically apply a sensitivity label named 'Confidential' to documents stored in SharePoint Online whenever the documents contain social security numbers. Users must be prevented from removing the label. Which configuration should the officer implement?
medium- A.Create a retention label with auto-labeling based on sensitive info types
- ✓ B.Create a sensitivity label with auto-labeling and set 'Mark content as mandatory'
- C.Use Microsoft Information Protection (MIP) unified labeling client to apply labels
- D.Configure Data Loss Prevention (DLP) policy to apply the label
Why B: Sensitivity labels support auto-labeling based on sensitive info types (e.g., social security numbers) and can be configured with protection settings, such as requiring justification to remove the label, which prevents users from easily removing the label. While the option incorrectly states 'Mark content as mandatory' (which only makes labeling mandatory, not prevents removal), the concept of using a sensitivity label with auto-labeling and appropriate protection settings meets the requirement. The other options are incorrect: retention labels (A) handle lifecycle, the MIP client (C) is outdated, and DLP policies (D) apply labels via policy but do not inherently prevent label removal.
Variation 6. A compliance officer needs to automatically encrypt and apply a 'Do Not Forward' restriction to all outgoing emails sent by the finance department that contain credit card numbers. The solution must work without requiring users to manually apply labels. Which configuration is required?
hard- A.Create a Data Loss Prevention (DLP) policy with the action 'Encrypt email messages'
- ✓ B.Create an auto-labeling policy for Microsoft Purview Sensitivity Labels that applies a label with encryption and 'Do Not Forward' configured, scoped to the finance department
- ✓ C.Create a mail flow rule in Exchange Online to apply Rights Management template 'Do Not Forward'
- D.Create a retention label that encrypts the email
Why B: Microsoft Purview auto-labeling policies can automatically apply a sensitivity label that includes encryption and 'Do Not Forward' based on sensitive info types and user scope. However, a mail flow rule in Exchange Online can also satisfy the requirement by using the 'Apply rights protection to a message' action with the 'Do Not Forward' RMS template, scoped to the finance department and sensitive content. Therefore, both B and C are valid configurations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.