How does Contoso Confidential label encryption affect access?

Implement and manage sensitivity labels in Microsoft Purview

Answer Select No, Yes, No: disabled accounts are not blocked immediately while the 7-day offline use license persists; guests are Authenticated Users; SharePoint auto-labeling/scope is not configured.

HOTSPOT You have a Microsoft 365 subscription that contains a sensitivity label named Contoso Confidential. You publish Contoso Confidential to all users. Contoso Confidential is configured as shown in the Configuration exhibit. (Click the Configuration tab.) exhibit The Access control settings of Contoso Confidential are configured as shown in the Access control exhibit. (Click the Access control tab.) exhibit For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. exhibit

Community Insight

The exam tests the difference between a label’s online authorization check and its cached offline use license, plus who counts as Authenticated Users and whether the label scope auto-applies to SharePoint.

This hotspot tests how a Microsoft Purview sensitivity label named Contoso Confidential behaves when encryption grants rights to Authenticated Users and allows seven days of offline access. It establishes the correct hotspot pattern as No, Yes, No: disablement is not immediate revocation, guests are authenticated, and SharePoint automatic labeling is not enabled by this configuration.

The common error is treating account disablement as an instant kill switch for already-issued label use licenses; the seven-day offline setting means access can persist until the license expires or refreshes.

Community Discussion (6 comments)

kollyp2000 👍 1

The answer is No, Yes, No. Statement 1: a disabled user is blocked immediately? No. “Allow offline access” is set to 7 days, and that sets how long the use license lasts. Learn: “For the duration of the use license, the user isn’t reauthenticated or reauthorized for the content... When the use license validity period expires, the next time the user accesses the protected document or email, the user must be reauthenticated and reauthorized.” Source: Restrict access to content by using sensitivity labels to apply encryption, https://learn.microsoft.com/purview/encryption-sensitivity-labels#assign-permissions-now So a disabled user can keep opening a file they’ve already opened for up to 7 days. With offline access set to Never, the check would happen every time. Statement 2: guest users can open the documents? Yes. The permission goes to AuthenticatedUsers, the “Add any authenticated users” option. Learn describes it as a setting that “doesn’t restrict who can access the content that the label encrypts.” Guests are authenticated users, so they can open the documents. Compare it with the other choice on the same page: “Everyone in your organization (all tenant members). This setting excludes guest accounts.” That’s the option that would have locked guests out. Source: same page, “Add users or groups”. Statement 3: applied automatically to SharePoint files? No. The exhibit shows “Auto-labeling for files and emails: None,” and nothing in the question mentions an auto-labeling policy or a default library label. Publishing a label only makes it “available to select in apps.” Source: Create and configure sensitivity labels and their policies, https://learn.microsoft.com/purview/create-sensitivity-labels#create-and-configure-sensitivity-labels

TDAC 👍 1

Answer is NO, YES, YES 1. The user is allowed to have access to the file offline for up to 7 days. Disabling the user account is not guaranteed to revoke access immediately. If the user is offline, and their account is disabled, they will still have access to the file. ANSWER = NO 2. Guest users are part of Authenticated Users. Gues Users count as authenticated users in any permission model that distinguishes between authenticated vs. anonymous access. ANSWER = YES 3. The scope of the policy is to apply to "File and other data assets, Email". This means the policy applies to data asset containers like SharePoint, Teams, Viva Engage, Azure, Fabric, PowerBI and Exchange. These locations are clearly identified when you are creating the policy and choose this option. ANSWER = YES

Ender3 👍 11

Yes, disabled accounts have no access to any content, and even offline the file is protected by the sensitivity label. Yes, Guest users are authenticated users. No, no auto-labeling policy was set.

Xarou 👍 3

Imagine in the first situation the person goes offline. The label allows offline access for 7 days A disabled account does not immediately revoke access if the user is still within the offline access window. it will only revoke access when either the offline period expires, or the license cache refreshes.

Eltooth 👍 3

Yes - only Authenticated Users are allowed Yes - Guests are authenticated on Contoso through Entra or federated social provider or authenticated by a Microsoft account. No - SharePoint is not listed in scope (Groups & sites)

skalolaz 👍 16

I would say NYN, guest users are authenticated users.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The label grants encryption rights to Authenticated Users and permits offline access for seven days, so a user who already opened the protected file may keep using a cached use license after the account is disabled. That makes the immediate-blocking statement false: revocation is not guaranteed until the offline period expires or the license cache refreshes. Guest accounts authenticate through Entra ID or a federated/Microsoft identity, so they fall within Authenticated Users for this permission set, making the guest-access statement true. The SharePoint-related statement is false because the configuration does not enable automatic application to SharePoint content, and the Groups & sites scope is not selected where relevant. The resulting hotspot pattern is No, Yes, No.

Why Other Candidate Answers Are Wrong

Answering Yes to the disabled-account statement assumes a real-time check every time the file opens, which contradicts the seven-day offline use license configured on Contoso Confidential. Answering No to guest access wrongly treats guests as anonymous users; they are authenticated identities and receive the label’s Authenticated Users rights. Answering Yes to the SharePoint statement assumes auto-labeling or site scope that the exhibits do not show. The minority NYY view correctly recognizes persistent offline access but overreaches by granting SharePoint behavior that is not configured.

Community Comment Notes

skalolaz summarized the pattern as NYN and noted "guest users are authenticated users", which matches the label’s Authenticated Users permission. kollyp2000 reached No, Yes, No and focused on the "Allow offline access" setting, explaining that the use license controls when reauthentication occurs. Xarou made the same point about the "offline period expires, or the license cache refreshes", while Eltooth tied the third No to "SharePoint is not listed in scope". Ender3 argued for a different first answer and cited "no auto-labeling policy was set" for the third statement; TDAC’s NYY reflects a minority view that overextends the offline-access behavior to the SharePoint statement.

Official Reference

Exam Strategy

Read the label’s encryption and offline-access settings before judging any “immediate revocation” statement; cached use licenses often outlive account changes. Then verify whether the statement concerns guests, who are authenticated, versus SharePoint auto-labeling or site scope, which require separate configuration.

Frequently Asked Questions

Why does disabling a user account not immediately block a labeled file with 7-day offline access?

The label issues a use license that remains valid for the offline period, so the user is not reauthenticated on every open until that license expires or refreshes.

Are Microsoft Entra guest users included in the Authenticated Users permission on a sensitivity label?

Yes. Guests authenticate through Entra ID or a federated identity, so they are authenticated users and receive the label's permitted rights unless explicitly excluded.

More SC-401 FAQ →

Related Analysis

← Back to SC-401 Study Guide