How does Contoso Confidential label encryption affect access?
Short answer
Select No, Yes, No: disabled accounts are not blocked immediately while the 7-day offline use license persists; guests are Authenticated Users; SharePoint auto-labeling/scope is not configured.
Question
You have a Microsoft 365 subscription that contains a sensitivity label named Contoso Confidential.
You publish Contoso Confidential to all users.
Contoso Confidential is configured as shown in the Configuration exhibit. (Click the Configuration tab.)
The Access control settings of Contoso Confidential are configured as shown in the Access control exhibit. (Click the Access control tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Key Takeaways
The exam tests the difference between a label’s online authorization check and its cached offline use license, plus who counts as Authenticated Users and whether the label scope auto-applies to SharePoint.
This hotspot tests how a Microsoft Purview sensitivity label named Contoso Confidential behaves when encryption grants rights to Authenticated Users and allows seven days of offline access. It establishes the correct hotspot pattern as No, Yes, No: disablement is not immediate revocation, guests are authenticated, and SharePoint automatic labeling is not enabled by this configuration.
Common mistake: The common error is treating account disablement as an instant kill switch for already-issued label use licenses; the seven-day offline setting means access can persist until the license expires or refreshes.
Expert Analysis
Why the Answer Is Correct
The label grants encryption rights to Authenticated Users and permits offline access for seven days, so a user who already opened the protected file may keep using a cached use license after the account is disabled. That makes the immediate-blocking statement false: revocation is not guaranteed until the offline period expires or the license cache refreshes. Guest accounts authenticate through Entra ID or a federated/Microsoft identity, so they fall within Authenticated Users for this permission set, making the guest-access statement true. The SharePoint-related statement is false because the configuration does not enable automatic application to SharePoint content, and the Groups & sites scope is not selected where relevant. The resulting hotspot pattern is No, Yes, No.
Why Other Candidate Answers Are Wrong
Answering Yes to the disabled-account statement assumes a real-time check every time the file opens, which contradicts the seven-day offline use license configured on Contoso Confidential. Answering No to guest access wrongly treats guests as anonymous users; they are authenticated identities and receive the label’s Authenticated Users rights. Answering Yes to the SharePoint statement assumes auto-labeling or site scope that the exhibits do not show. The minority NYY view correctly recognizes persistent offline access but overreaches by granting SharePoint behavior that is not configured.
Community Comment Notes
skalolaz summarized the pattern as NYN and noted "guest users are authenticated users", which matches the label’s Authenticated Users permission. kollyp2000 reached No, Yes, No and focused on the "Allow offline access" setting, explaining that the use license controls when reauthentication occurs. Xarou made the same point about the "offline period expires, or the license cache refreshes", while Eltooth tied the third No to "SharePoint is not listed in scope". Ender3 argued for a different first answer and cited "no auto-labeling policy was set" for the third statement; TDAC’s NYY reflects a minority view that overextends the offline-access behavior to the SharePoint statement.
Official Reference
- https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels
- https://learn.microsoft.com/en-us/purview/sensitivity-labels
These links open the official vendor documentation in a new tab.
Exam Strategy
Read the label’s encryption and offline-access settings before judging any “immediate revocation” statement; cached use licenses often outlive account changes. Then verify whether the statement concerns guests, who are authenticated, versus SharePoint auto-labeling or site scope, which require separate configuration.
Frequently Asked Questions
Why does disabling a user account not immediately block a labeled file with 7-day offline access?
Are Microsoft Entra guest users included in the Authenticated Users permission on a sensitivity label?
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
skalolaz 👍 16I would say NYN, guest users are authenticated users.
-
Ender3 👍 11Yes, disabled accounts have no access to any content, and even offline the file is protected by the sensitivity label. Yes, Guest users are authenticated users. No, no auto-labeling policy was set.
-
Xarou 👍 3Imagine in the first situation the person goes offline. The label allows offline access for 7 days A disabled account does not immediately revoke access if the user is still within the offline access window. it will only revoke access when either the offline period expires, or the license cache refreshes.
-
Eltooth 👍 3Yes - only Authenticated Users are allowed Yes - Guests are authenticated on Contoso through Entra or federated social provider or authenticated by a Microsoft account. No - SharePoint is not listed in scope (Groups & sites)
-
kollyp2000 👍 1The answer is No, Yes, No. Statement 1: a disabled user is blocked immediately? No. “Allow offline access” is set to 7 days, and that sets how long the use license lasts. Learn: “For the duration of the use license, the user isn’t reauthenticated or reauthorized for the content... When the use license validity period expires, the next time the user accesses the protected document or email, the user must be reauthenticated and reauthorized.” Source: Restrict access to content by using sensitivity labels to apply encryption, https://learn.microsoft.com/purview/encryption-sensitivity-labels#assign-permissions-now So a disabled user can keep opening a file they’ve already opened for up to 7 days. With offline access set to Never, the check would happen every time. Statement 2: guest users can open the documents? Yes. The permission goes to AuthenticatedUsers, the “Add any authenticated users” option. Learn describes it as a setting that “doesn’t restrict who can access the content that the label encrypts.” Guests are authenticated users, so they can open the documents. Compare it with the other choice on the same page: “Everyone in your organization (all tenant members). This setting excludes guest accounts.” That’s the option that would have locked guests out. Source: same page, “Add users or groups”. Statement 3: applied automatically to SharePoint files? No. The exhibit shows “Auto-labeling for files and emails: None,” and nothing in the question mentions an auto-labeling policy or a default library label. Publishing a label only makes it “available to select in apps.” Source: Create and configure sensitivity labels and their policies, https://learn.microsoft.com/purview/create-sensitivity-labels#create-and-configure-sensitivity-labels
Show 1 more comment
-
TDAC 👍 1Answer is NO, YES, YES 1. The user is allowed to have access to the file offline for up to 7 days. Disabling the user account is not guaranteed to revoke access immediately. If the user is offline, and their account is disabled, they will still have access to the file. ANSWER = NO 2. Guest users are part of Authenticated Users. Gues Users count as authenticated users in any permission model that distinguishes between authenticated vs. anonymous access. ANSWER = YES 3. The scope of the policy is to apply to "File and other data assets, Email". This means the policy applies to data asset containers like SharePoint, Teams, Viva Engage, Azure, Fabric, PowerBI and Exchange. These locations are clearly identified when you are creating the policy and choose this option. ANSWER = YES
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.