How Do You Auto-Encrypt fabrikam.com Mail and Set a Seven-Day Expiry?
Short answer
Requirement 1: a mail flow (transport) rule that encrypts mail sent to fabrikam.com. Requirement 2: a custom branding template with message expiration set to seven days.
Question
You are implementing Microsoft Purview Advanced Message Encryption for a Microsoft 365 tenant named contoso.com.
You need to meet the following requirements:
• All email to a domain named fabrikam.com must be encrypted automatically.
• Encrypted emails must expire seven days after they are sent.
What should you configure for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The exam tests that automatic encryption is triggered by a mail flow rule, but the seven-day expiry is only configurable inside a custom branding template — not in the rule itself.
Microsoft Purview Advanced Message Encryption uses a mail flow (transport) rule to automatically encrypt mail sent to a partner domain such as fabrikam.com, and a custom branding template to make encrypted messages expire. This page confirms the mail-flow-rule plus custom-branding-template pairing and explains why connectors or default OME settings do not satisfy the requirements.
Common mistake: Candidates pick a mail flow connector, or try to set the expiry directly on the encryption rule or in the default OME configuration, instead of creating a custom branding template that carries the expiration setting.
Expert Analysis
Why the Answer Is Correct
Requirement 1 asks for automatic encryption of every message addressed to fabrikam.com. In Exchange Online, that condition is expressed as a mail flow (transport) rule whose recipient domain condition is fabrikam.com and whose action applies the Office 365 Message Encryption / encryption protection action. Requirement 2 asks for a seven-day lifetime on those encrypted messages. In Advanced Message Encryption, expiration is a property of the custom branding template — you build a template, set the message expiration in days, and the mail flow rule references that template. Because a rule can only wrap mail with an expiry when it points to a custom branding template, the two answers work together: the rule decides which mail is encrypted, the template decides how long it stays readable. This matches the community consensus that the first blank is a mail flow rule and the second is a custom branding template.
Why Other Candidate Answers Are Wrong
A mail flow connector only routes or secures transport between organizations; it does not apply OME encryption to messages based on a recipient domain, so it cannot satisfy requirement 1. The default (non-custom) OME configuration can encrypt mail, but it exposes no expiration control — setting a number of days there has no effect, which is exactly the trap the question sets. Applying a sensitivity label or DLP policy would encrypt content, but neither provides the classic recipient-domain-based OME experience nor the Advanced Message Encryption expiry described here. Likewise, a retention policy or label deletes or retains items for compliance; it does not expire the recipient's access to an encrypted message.
Community Comment Notes
Alcpt states the key doctrine plainly: "You can only use expiration if you use custom branding," and summarises the pair as "#1 mail flow rule #2 custom branding." MultiCloudIronMan concurs with the same two selections, and rvln7 marks the answer "CORRECT" while pointing to the two Microsoft Learn articles on mail flow rules for encryption and advanced expiration. The repeated agreement across independent commenters, plus the documented behaviour that expiry lives in the branding template, makes this pairing the reliable answer rather than a simple majority vote.
Official Reference
- https://learn.microsoft.com/en-us/purview/define-mail-flow-rules-to-encrypt-email
- https://learn.microsoft.com/en-us/purview/ome-advanced-expiration
These links open the official vendor documentation in a new tab.
Exam Strategy
When a scenario separates the encryption trigger from the message lifetime, split the answer: the trigger is almost always a mail flow rule, and the lifetime (expiry) is a property of the custom branding template. Look for the words "expire" or "days" and immediately think custom branding template, not rule settings.
Frequently Asked Questions
Can encrypted messages expire without a custom branding template in Advanced Message Encryption?
Why is a mail flow connector wrong for encrypting mail to fabrikam.com?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Alcpt 👍 13With Microsoft Purview Advanced Message Encryption, anytime you apply custom branding, Microsoft 365 applies the wrapper to email that fits the mail flow rule to which you apply the template. You can only use expiration if you use custom branding. #1 mail flow rule #2 custom branding
-
MultiCloudIronMan 👍 41 mail flow rule 2 custom branding
-
rvln7 👍 3CORRECT 1. mail flow rule 2. custom branding template https://learn.microsoft.com/en-us/purview/define-mail-flow-rules-to-encrypt-email https://learn.microsoft.com/en-us/purview/ome-advanced-expiration
-
kollyp2000 👍 1Requirement 1: encrypt all mail to fabrikam.com. Mail flow rule. - Not Mailflow connector a custom branding template in Exchange Online PowerShell for expiry.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.