Question

A financial services firm needs to protect a repository of contract documents stored in SharePoint Online. The security architect has two goals: (1) ensure that any contract file, even when downloaded to an unmanaged personal device or emailed to an external partner, remains encrypted and only openable by authorized internal users, and (2) automatically block the copying of credit card numbers from those files into non-corporate cloud storage while users work on managed endpoints. The design must persist protection with the file regardless of where it travels. Which combination of Microsoft Purview capabilities best satisfies BOTH goals?

Accepted Answer

Apply sensitivity labels with encryption and usage rights for goal 1, and configure Endpoint DLP policies with a sensitive info type for credit card numbers for goal 2.

Answer

Use Endpoint DLP for both goals, relying on egress rules to encrypt files as they leave managed devices and to block credit card copying.

Answer

Use retention labels with encryption for goal 1, and configure Insider Risk Management adaptive protection for goal 2.

Answer

Apply sensitivity labels without encryption plus service-side SharePoint encryption for goal 1, and use a DLP policy scoped only to SharePoint locations for goal 2.