Encrypting Files With an Open-Access Product1 Label
Short answer
Create a sensitivity label named Product1 with encryption enabled and permissions granted to all authenticated users in the organization, then publish that label in a label policy so SharePoint Online users can apply it manually.
Question
Username and password
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and select the username below.
To enter your password, place your cursor in the Enter password box and select the password below.
Microsoft 365 Username:
[email protected]
Microsoft 365 Password: XXXXXXXXX
If the Microsoft Edge browser or Microsoft 365 portal does not load successfully, select the Microsoft Edge browser icon from the task bar, type the URL “https://admin microsoft.com”, and press Enter.
The following information is for technical support purposes only:
Lab Instance: XXXXXXXX.
Task 1
You need to provide users with the ability to manually classify files that contain product information that are stored in SharePoint Online sites. The solution must meet the following requirements:
• The users must be able to apply a classification of Product1 to the files.
• Any authenticated user must be able to open files classified as Product1.
• Files classified as Product1 must be encrypted.
Key Takeaways
It tests whether you can separate label encryption from permission restriction, and whether you remember that a label must be published before users can apply it.
The SC-401 lab requires a manually applicable Product1 sensitivity label that encrypts SharePoint Online files while remaining openable by any authenticated user, so encryption permissions must be granted broadly and the label must be published.
Common mistake: Enabling encryption with permissions assigned only to specific users or a security group, which blocks other authenticated users from opening the files, or creating the label without publishing it in a label policy.
Expert Analysis
The boundary being tested This lab turns on the line between two settings that learners routinely merge: the encryption applied inside a sensitivity label, and the publication of that label through a label policy. The requirement "files classified as Product1 must be encrypted" is satisfied by the label's encryption settings, but encryption in Purview is always paired with a permissions grant, and that grant is where this scenario lives.
Where this scenario falls Because "any authenticated user must be able to open files classified as Product1," you must not restrict encryption to a named set of users or groups. Configure the Product1 label with encryption enabled and assign viewing (and, for practical editing, view/edit) permissions to every authenticated user in the tenant — the broad "all users in your organization" style grant rather than a specific-users ACL. A comment on this lab notes the label "would also need to be published so the users can apply the label," which is the second half of the answer: manual classification is impossible until the label appears in a label policy scoped to the SharePoint Online users.
Correct construction So the complete answer is an ordered pair: create the sensitivity label Product1 with encryption on and permissions open to all authenticated users, then publish that label via a label policy so users can apply it by hand to their SharePoint files. Encryption without broad permissions, or a label that is never published, fails one of the stated requirements.
Official Reference
https://learn.microsoft.com/en-us/purview/sensitivity-labels
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a lab says files must be encrypted and be openable by everyone authenticated, treat the encryption permission scope as the deciding setting: choose the broad all-tenants-users grant, never a specific-users list. Then ask the second-order question for every sensitivity-label task — can the user actually see this label? If not, the missing piece is a label policy. This 'configure, then publish' pair repeats across most Purview label simulations.
Frequently Asked Questions
Why does encrypting a file with a sensitivity label not block other users?
I created the Product1 label but users cannot see it to apply it. What is missing?
Can users classify SharePoint files manually without auto-labeling rules?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Unit73 👍 1The label would also need to be published so the users can apply the label to the files.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.