SC-401 — frequently asked questions

No, Microsoft Purview includes built-in sensitive info types for credit card numbers. You can use these directly in your auto-labeling policy without creating a custom one.

The requirement specifies that documents with credit card numbers must be 'labeled'. Labeling applies sensitivity settings (encryption/access restrictions), whereas retention applies how long data is kept. These are distinct features in Purview.

Yes, you can use Set-SPOTenant -EnableAIPIntegration $true, but the Purview portal is the standard GUI method.

The SharePoint admin center manages site infrastructure. Sensitivity labels are an information protection feature managed centrally in Purview.

Not for the requested pattern. Purview can match the token within scanned content; anchors only constrain the match to the start or end of a line or string if the SIT design specifically requires that.

The + quantifier accepts one or more digits, so it would also match pjt1sct or pjt1234567sct; {6} enforces exactly six digits as required.

The scanner relies on specific service authentication mechanisms that are incompatible with interactive MFA prompts required by most passwordless methods.

No, User1 is an interactive tester using the client normally, so they should retain MFA for maximum security as per standard policy.

The core required pattern is [a-zA-Z]{3}\d{3}; add boundaries only if the requirement must prevent a match inside a longer alphanumeric string, because the stem stresses exactly three letters and three digits.

That class accepts any mix of six letters and digits, such as 123Abc or Ab12Cd, so it does not enforce the required three letters followed by three digits.

You can actually change it. Microsoft Purview allows reverting a Resolved alert to Active or Investigating if new evidence emerges, or to Dismissed if it was a false positive.

Resolved means the issue is handled but might still be relevant. Dismissed means the alert is irrelevant or a false positive. Both are terminal states, but Resolved can be reopened.

No, Content Search finds content items. It does not provide an audit trail of administrative actions like label policy changes.

Activity Explorer typically retains data for up to 90 days, but the question specifies looking at the last 30 days, which is well within this window.

Security Reader lacks the specific permission to read the UnifiedAuditLogIngestionEnabled setting in Exchange Online, which DSPM for AI uses to report auditing status.

No, it is the least privilege option for this task because it only grants read-only access to Exchange Online configuration, which is necessary to check the audit log status.

Yes. A label's auto-labeling rule can reference multiple built-in passport SITs, so the four country types do not require four labels.

Those are DLP policy actions. The question asks only for sensitivity labels and auto-labeling policies, so the DLP policy is separate from the 1 label and 1 auto-labeling policy.

No. DLP detects sensitive info but requires explicit actions like 'Apply Message Encryption' or integration with OME to encrypt content.

DLP focuses on content detection and policy enforcement across M365 apps. Mail Flow Rules (Transport Rules) operate at the SMTP level and can also apply encryption or modifications to messages.

Microsoft provides a built-in SIT named All Medical Terms And Conditions, so no custom classifier training is needed; the SIT is the least-effort match.

Yes. Microsoft Purview includes an Offensive Language trainable classifier that can be used in Exchange email labeling without custom training.

The rule condition shown in the exhibit is 'includes these words in the message subject [Encrypt]'. Body matching is a separate condition, and sender address/header is about how the sender is matched, not where the keyword is found.

Yes. Do Not Forward encrypts the message and requires recipient authentication, after which recipients cannot forward, print, or copy the content — so printing restriction is the correct second selection.

Windows 11 x64 and ARM64 are supported for the viewer and file labeler; Windows 10 x86 is not listed, and ARM64 does not support the scanner or PowerShell.

No. The scanner is a separate discovery tool; on the device, users label files and images through File Explorer's Classify and protect menu.

No. Microsoft's retention auto-apply guidance excludes document fingerprinting and EDM SITs, so use a regex or keyword SIT for retention auto-labeling instead.

Yes. Document fingerprinting can be used as a condition for sensitivity auto-labeling in supported workloads, although the hotspot's dropdown may not list the exact DLP+Sensitivity combination.

They are location-based: a sensitivity label with a watermark can be applied to a site or library without inspecting content, so no SIT condition is needed.

Yes. A custom SIT can use a keyword list or regex that matches either Project1 or Project2, so both terms count as one SIT.

Proximity is measured in characters between the primary and secondary elements. The default threshold is usually 15 characters.

No. If the regex explicitly requires 22 digits (e.g., \d{22}), it will not match a string with only 12 digits.

Because content expiry is applied to Doc1 when Label1 is applied on January 3. Changing the label policy later does not recalculate existing protected content unless the document is re-labeled.

The label setting uses time after the label is applied, not after a user's first access. User2's January 4 edit does not restart the expiry clock for Doc1.

Yes. Supported image types such as .png can be labeled by the client; C:\Temp is not an excluded system location, so File1.png qualifies for Label1.

The client applies sensitivity labels to individual files, not folders themselves, so Folder2 cannot receive Label1 directly even though files inside it may be labeled.

Recipient1 gets an inline encrypted experience in Outlook, and Microsoft Purview revocation applies only to link-based branded encrypted messages, not native inline encryption.

No. Microsoft 365 and Microsoft account/outlook.com external recipients still get inline encryption in supported Outlook clients; only non-Microsoft types such as Gmail get link-based mail.

Activity policies watch user actions, but the documented external-sharing scenario for sensitive files is handled by a Defender for Cloud Apps file policy.

No, that DLP policy is Exchange-scoped; OneDrive external-sharing alerts require a Defender for Cloud Apps file policy.

Opening encrypted content requires VIEW, but Copilot processing requires EXTRACT. File3's label lacks the EXTRACT right for User1, so Copilot cannot summarize it.

No. The EXTRACT requirement applies when a sensitivity label encrypts content; unencrypted files do not carry Rights Management usage rights for Copilot to honor.

500,000 refers to eDiscovery limits for total locations or exports, not the item count per location in data risk assessments.

Yes, the 200,000 items per location limit applies to both default and custom data risk assessments.

No. Built-in SITs provided by Microsoft cannot be copied or modified. You must create a new custom SIT from scratch if you need to adjust detection logic for these standards.

A custom SIT is one created by your organization's admins. It typically has a unique name or includes your tenant domain in the publisher field, distinguishing it from Microsoft's global definitions.

Retention policies do not support EDM-based SITs as conditions. They rely on other methods like content match or labels.

While some sources mention eDiscovery, the primary supported configurations for EDM SITs are DLP and Insider Risk Management for policy enforcement.

Yes, if the rule conditions are met by the sender or the message content, the rule applies to the message as it is processed for delivery to each member.

It evaluates the sender's current group memberships. If the sender belongs to the specified group, the rule condition is satisfied, regardless of the recipient.

RP4 has priority 10, a lower number than RP2's priority 20, so RP4 takes precedence for actions it covers. Purview audit retention policy priority overrides a broader all-activities policy with a longer duration.

Yes, in this scenario RP2's None/All scope covers every SharePoint activity by User1. It applies unless a higher-priority policy such as RP4 specifically covers the same action.

Edge still needs the Microsoft Purview extension add-on in this scenario; built-in Edge capabilities alone do not satisfy the insider risk management browser signal collection described.

The Information Protection client labels and classifies files; it does not provide the browser extension telemetry that insider risk management uses when a user copies files to USB from Edge.

No. Sublabels do not inherit parent label settings except label color, so encryption must be configured separately on Internal.

No. A justification prompt appears only when the label policy is configured to require it; label priority alone does not force a justification.

Yes, if the sensitivity label is configured with a watermark and it is applied to the email, the watermark appears in the email content.

Yes, auto-labeling policies can apply visual markings such as headers and watermarks to Office documents stored in SharePoint Online.

The label issues a use license that remains valid for the offline period, so the user is not reauthenticated on every open until that license expires or refreshes.

Yes. Guests authenticate through Entra ID or a federated identity, so they are authenticated users and receive the label's permitted rights unless explicitly excluded.

The ID combines a hire date with three digits, so its shape varies; only a regex can match that structured date-plus-digits pattern, while a keyword list can only find fixed text.

It is the proximity window for the supporting keyword list: Employee, ID, or Identification must appear within 300 characters of the regex-matched employee ID.

No. Expiration is configured in the custom branding template, and Microsoft 365 only applies that wrapper, including the expiry, to mail matched by the rule bound to the template.

A connector controls mail routing between systems, not content encryption. Automatic encryption of messages to a partner domain requires a mail flow rule with the encryption action.

No. Built-in SITs are read-only; copy the built-in SIT to create a custom, editable sensitive information type.

It is a document-fingerprint SIT, so it does not use the standard copy/edit path; recreate it from a template if changes are needed.

Yes. Without that condition, the transport rule would also encrypt internal messages whose subject contains Falcon, which exceeds the task's external-only scope.

Choose Apply message classification and rights protection > Apply RMS template and select Highly Confidential \ All Employees, because the task names that RMS template explicitly.

Microsoft Purview restricts mixing Teams messaging locations (chats/channels) with productivity locations (Exchange/SharePoint) in a single static retention policy.

Yes, Teams channel messages can be included in the same retention policy as Exchange mailboxes, SharePoint sites, and Microsoft 365 Groups.

No. For retention labels, the Microsoft 365 Groups location includes only the SharePoint teams site, so AutoApply1 does not cover the group mailbox or Teams channel messages.

Not from the group location alone. A policy scoped to Microsoft 365 Groups covers the group mailbox and SharePoint teams site; Teams channel messages need the separate Teams location.

It covers web1 and web2 but also every other contoso.com subdomain, so it over-blocks and may require later cleanup if other sites must stay reachable.

No. Microsoft Purview's service-domain entry does not accept a partial-label wildcard in that position, so the pattern will not persist as a valid entry.

You can only have one multi-token primary element in a composite key. Since both Name and AccountNumber are multi-token, you must exclude one.

No. While the system supports up to 10, practical limits exist if your schema contains multiple multi-token fields, restricting the count further.

No, only those matching the specific sensitive information type rules defined in the policy.

It is a feature that allows sending encrypted emails to external recipients without requiring them to have an account.

No. While explicit labels take precedence for retention settings, the principle of 'Retention wins over deletion' means the longest retention period controls the timeline, overriding any deletion actions.

They are suspended. No deletion action is applied until the longest retention period expires, ensuring compliance with the strictest retention requirement.

File2 matches both Rule1 and Rule2, but Purview displays only one policy tip: the tip from the highest-priority matching rule, Rule1.

No. The single-tip result comes from DLP policy-tip display behavior; Stop processing only controls whether later rules are evaluated for enforcement.

A retain-only retention label does not block deletion in SharePoint. The deleted file is moved to the site's Preservation Hold Library, where it stays until the label expires on March 1, 2027.

Retention2 is retain-and-delete for two years, so File2 was automatically deleted on March 1, 2025. By March 15, 2025 the file is no longer in the library to be edited.

IRM only uses high-severity DLP incidents as qualifying triggers for the Data leaks and priority-user templates, so DLP2 and DLP3 medium matches do not alert.

No. Priority-user membership scopes Policy3 to User3, but DLP3's medium Incident reports severity still fails the high-severity trigger requirement.

The DLP policy-tip UI in Outlook mobile is not supported for this user-notification scenario, so the tip appears only in the web and Win32 Outlook clients.

No; it enables policy tips where the client supports them, which for this question means Outlook on the web and Outlook Win32, not Outlook mobile.

Dismiss only closes the notification. The browser paste is stopped by the Endpoint DLP policy itself, and only an explicit override under the Block with override action would permit it.

Yes. With Audit only the event is logged but the paste is not blocked, so the user could proceed; the exhibit's blocking error shows the restriction is enforced.

No. The block-everyone action continues access for the content owner, last modifier, and site admin, so User1 and User2 retain access to File1.

No. The DLP exception is for a site admin, meaning a site collection administrator for Site1; Admin1's tenant SharePoint Administrator role does not automatically grant that access.

No. You must explicitly add OneDrive for Business to the Locations list in the policy configuration. If it is not added, the policy ignores OneDrive files.

'Any of these' applies the label if at least one condition is met. 'All of these' requires every single listed condition to be true for the label to be applied.

No, site-wide retention policies are scoped to the specific SharePoint site or library. Moving a file out of that site removes it from the policy's scope.

Apply a Retention Label directly to the file or folder. Retention Labels are attached to the content itself and persist regardless of where the file is stored.

Technically, Global Administrators have full access. However, in this exam scenario, Option E includes Admin1, suggesting that explicit assignment is expected or the question logic prioritizes excluding only the Compliance Administrator.

Yes, members of the Compliance Administrator role group have the default permission to create and manage sensitivity labels without needing additional role assignments.

The Security Operator role allows viewing alerts and managing security incidents but does not grant the specific permissions required to create or manage sensitivity labels in Microsoft Purview.

No. DLP policies monitor and block data transmission but do not inherently restrict Copilot's ability to index and process data for summarization. Sensitivity labels are required to enforce access controls that Copilot respects.

Copilot respects the permissions and restrictions defined in sensitivity labels. If a label blocks connected experiences or encrypts content, Copilot will not process or include that content in its responses unless the user has explicit permission to override those settings.

The Access level filter supports four values: Public (Internet), Public, External, and Internal. It may also include Private depending on the context, allowing policies to target files shared outside the organization.

Yes, you can combine multiple filters in a single Defender for Cloud Apps file policy. This allows you to create complex rules, such as blocking external sharing of files that are specifically labeled as Confidential.

No. Copilot automatically inherits the sensitivity label of the most sensitive source file.

If Copilot can access the content to generate a summary, it still inherits the label. Permissions control human access, but Copilot follows label inheritance rules.

VIEW only allows human users to open and read the file. Copilot requires programmatic access to extract text for processing, which is granted by the EXTRACT permission. Without EXTRACT, Copilot cannot read the content.

Copilot can still summarize and reference the content. EDIT is required for modifying the file itself, but summarization only requires reading/extraction capabilities.

Double Key Encryption requires two separate keys for decryption, which prevents Microsoft 365 services from accessing the file stream in real-time needed for collaborative editing.

No. Co-authoring is not supported if User access to content expires. It must be set to 'Never' to ensure uninterrupted real-time collaboration.

No. The initial opt-in process for custom trainable classifiers requires Global Administrator privileges because it involves enabling a core tenant capability. Once enabled, Compliance Administrators can manage the classifiers.

The opt-in process registers the tenant with the service required for custom trainable classifiers. It ensures that organizations explicitly consent to using these advanced AI-driven classification tools.

No. Trainable Classifiers use machine learning models trained on sample documents. They do not support importing keyword dictionaries or CSV files for direct text matching.

EDM is a feature within Sensitive Information Types that allows you to hash data from an external file (like a CSV) and use it as a keyword dictionary to detect exact matches in content.

No, a static scope is sufficient for applying retention to all Teams chats and channel messages. Adaptive scope is only needed if you want to apply different rules based on conditions like sensitivity labels or user location.

The question specifies 'from the date they are created.' Ensure you select the option that triggers the retention timer at creation, not modification, to meet the requirement accurately.

No. While sensitivity labels help define policies, JIT can block actions like copying to removable drives based on user scope and device onboarding status alone, even if the file is 'Not evaluated'.

JIT protection cannot enforce restrictions on that device because the necessary endpoint agent is missing. The action will likely proceed unless blocked by other mechanisms.

Test Mode logs violations but does not enforce actions like Block. However, exam questions asking if a file 'can be uploaded' usually refer to the policy's intended enforcement logic. If the policy were enabled, it would block. In this context, the focus is on whether the rule matches.

Endpoint DLP relies on file type support to scan content. The .dwg extension is not supported for content inspection. Since the engine cannot read the file, it finds no match, and no policy action is taken.