Question

A financial services company stores millions of documents across SharePoint Online, OneDrive, and Exchange Online. Compliance requires that documents containing customer PII and payment card data be automatically classified and protected without relying on end users to manually apply labels. The security architect must design a solution that discovers this data at rest across the existing content and applies sensitivity labels consistently, including encryption for the most sensitive documents. Which approach should the architect choose?

Accepted Answer

Configure Microsoft Purview auto-labeling policies with sensitive information types and trainable classifiers to automatically apply sensitivity labels to data at rest across SharePoint, OneDrive, and Exchange.

Answer

Deploy the Microsoft Purview Information Protection client to every endpoint and require users to select the correct sensitivity label when saving documents.

Answer

Create Microsoft Purview DLP policies that block sharing of documents matching PII sensitive information types, relying on DLP to classify the content.

Answer

Enable Defender for Cloud Apps file policies to scan connected apps and quarantine files that contain payment card numbers.