Question

A financial services firm applies sensitivity labels that encrypt documents classified as 'Highly Confidential'. Business units now need to share some of these encrypted documents with a specific external audit partner while ensuring the partner can only view the content and cannot print, copy, or forward it. The security architect must design a solution that preserves the encryption and usage restrictions even after the file leaves the tenant, without deploying Double Key Encryption. Which approach best meets these requirements?

Accepted Answer

Configure the sensitivity label's encryption settings to assign the external partner's domain or specific users co-authoring rights limited to View and grant them Viewer-level usage rights that exclude print, copy, and forward.

Answer

Remove encryption from the label and rely on a DLP policy that blocks the document from being forwarded outside the organization.

Answer

Use a Conditional Access policy requiring the partner to authenticate with MFA before the encrypted document can be opened.

Answer

Share the documents through a password-protected SharePoint anonymous link so the partner can download them without needing tenant access.