Question

Contoso is finalizing a merger and must protect a set of Word and Excel documents so that only reviewers from an external partner firm, Fabrikam, can open them. The partner reviewers use accounts in their own Microsoft Entra tenant (fabrikam.com). Contoso wants the encryption permissions defined directly in the sensitivity label so users do not have to assign permissions manually each time. Which configuration in the label's encryption settings meets this requirement?

Accepted Answer

Set encryption to 'Assign permissions now' and add the Fabrikam domain (fabrikam.com) as an authenticated user with the appropriate rights.

Answer

Set encryption to 'Let users assign permissions when they apply the label' and rely on Do Not Forward.

Answer

Configure Double Key Encryption and share the customer-held key with Fabrikam.

Answer

Add the Fabrikam reviewers as guests in Contoso's tenant and use a container label on the SharePoint site instead.