How to Auto-Label PII and Require Justification for Access in Microsoft Purview
A compliance officer needs to ensure that all documents uploaded to SharePoint Online that contain passport numbers are automatically labeled with a 'Highly Confidential' sensitivity label. Which two Microsoft Purview features must be configured together to achieve this? (Choose two.)
⚠ Common exam trap
Many candidates confuse DLP policies with auto-labeling policies, but DLP does not apply sensitivity labels—it only monitors and blocks data sharing, while auto-labeling is the correct feature for automatic label assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policy for SharePoint Online
An auto-labeling policy in Microsoft Purview can automatically apply a sensitivity label to documents containing sensitive information, such as passport numbers, when they are uploaded to SharePoint Online. This policy uses conditions based on sensitive info types to trigger the labeling action without user intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Auto-labeling policy for SharePoint Online
Why this is correct
An auto-labeling policy for SharePoint Online is the correct mechanism because it automatically applies a sensitivity label to documents when they match specified conditions, such as containing a passport number via a sensitive info type. This policy can run in simulation mode to assess coverage and then enforce labeling on all existing and new files in a site, ensuring consistent classification without manual user action. This directly satisfies the compliance requirement for labeling every uploaded document.
- ✗
Data Loss Prevention (DLP) policy
Why it's wrong here
A Data Loss Prevention (DLP) policy is incorrect here because DLP is designed to detect and prevent unauthorized sharing or exfiltration of sensitive data by blocking actions or showing policy tips, not to apply sensitivity labels. While a DLP policy can reference sensitivity labels as conditions, it does not have the capability to assign or write labels onto documents. Therefore, it cannot ensure that all uploaded files are labeled.
- ✗
Retention label policy
Why it's wrong here
A retention label policy is not suitable because retention labels are intended for records management and compliance lifecycle governance—controlling how long content must be retained and when it is deleted—rather than for sensitivity classification. Applying a retention label does not protect a file with encryption or rights management, and it does not serve as a sensitivity label. Thus, it cannot meet the requirement to classify documents based on their sensitive content such as passport numbers.
- ✓
Sensitive info type (passport number)
Why this is correct
A sensitive info type (e.g., passport number) is a correct but enabling component, not the standalone policy: it defines the detection pattern that an auto-labeling policy uses to identify content. When the auto-labeling policy is configured, it references this sensitive info type as a condition, so any document containing a passport number will be matched and automatically labeled. Without the sensitive info type, the policy would have no way to recognize which documents need the label.
Go deeper
Related to this question
Learn chapter
Microsoft Purview Portal Overview
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A compliance officer needs to ensure that all documents in a SharePoint Online library are automatically labeled with a 'Confidential' sensitivity label if they contain at least one of a predefined list of sensitive information types such as credit card numbers or social security numbers. Users should be able to override the label with a business justification. Which Microsoft Purview feature should the officer configure?
easy- ✓ A.Auto-labeling policy for SharePoint Online
- B.Data Loss Prevention (DLP) policy
- C.Retention label policy
- D.Sensitivity label with manual classification
Why A: Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on the detection of sensitive information types (e.g., credit card numbers, SSNs). This policy supports user override with a business justification, meeting the compliance officer's requirement exactly. Manual classification (Option D) would not automate the labeling, and DLP policies (Option B) focus on preventing data loss, not applying sensitivity labels.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.