MS-900 Describe Microsoft 365 apps and services Practice Question
A hospital uses Microsoft 365 and needs to comply with HIPAA by ensuring that patient health information in emails is encrypted both in transit and at rest. Which Microsoft 365 feature should they enable?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Office 365 (a threat protection tool) with email encryption, because both are security-related, but Defender does not provide the persistent encryption required for HIPAA compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Office 365 Message Encryption
Office 365 Message Encryption (OME) is the correct feature because it provides built-in encryption for emails both in transit (via TLS) and at rest (via Azure Rights Management), ensuring that patient health information (PHI) remains protected and compliant with HIPAA requirements. OME integrates with Azure Information Protection to apply persistent encryption that travels with the email, regardless of where it is stored.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Microsoft Defender for Office 365 is a threat protection suite that scans emails for malicious links, attachments, and phishing attempts in real time. It does not encrypt message content or provide any cryptographic control over ePHI in transit or at rest. HIPAA's encryption requirements are satisfied by a dedicated encryption capability, not by threat detection tools.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based service for managing devices and applications through policies like PIN locks, jailbreak detection, and app protection. While it can enforce device-level security controls that indirectly reduce risk, it does not apply cryptographic encryption to the body or attachments of an individual email message. For HIPAA compliance, email transport encryption must come from a solution like Office 365 Message Encryption.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management is designed to govern records by applying retention, preservation, and deletion rules across content. It classifies and expunges data according to regulatory internal policies but lacks the ability to encrypt a message's payload during delivery or storage. HIPAA requires ePHI to be rendered unreadable via encryption, which is fundamentally a data protection action, not a lifecycle governance action.
- ✓
Office 365 Message Encryption
Why this is correct
Office 365 Message Encryption is exactly the service for HIPAA because it uses Azure Rights Management to encrypt messages in transit and at rest for authorized recipients both inside and outside the organization. It supports configurable encrypted email templates and can be integrated with data loss prevention rules to automatically protect ePHI. This directly fulfills the HIPAA Security Rule's requirement to encrypt email containing protected health information.
Go deeper
Related to this question
Learn chapter
Records Management in Microsoft 365
Key term
Office 365
Office 365 is a cloud-based subscription service from Microsoft that provides access to productivity applications like Word, Excel, and Outlook, along with other cloud services, for a monthly or annual fee.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.