Question

A financial services company must protect a set of highly confidential documents stored in SharePoint Online. The security architect requires that: (1) content is encrypted with a key the organization controls and can revoke, (2) Microsoft services (including co-authoring, eDiscovery, and search indexing) continue to function on the content, and (3) the encryption key material is stored in a FIPS 140-2 Level 2-validated Azure service under organizational governance. Which encryption approach for the sensitivity label best satisfies all three requirements?

Accepted Answer

Apply a sensitivity label configured with encryption using a customer-managed key stored in Azure Key Vault (BYOK)

Answer

Apply a sensitivity label that uses Microsoft-managed encryption with the default cloud-based tenant root key

Answer

Apply a sensitivity label configured with Double Key Encryption (DKE) using an on-premises key service

Answer

Disable label-based encryption and rely on SharePoint service-side encryption with a customer key at the tenant level