Encrypting Emails with Azure Storage Keys via DLP

SC-401 By islever Editorial Last updated

Create and configure data loss prevention policies

Short answer

A A DLP policy targeting Exchange can detect Azure Storage Account Keys and enforce encryption via Office 365 Message Encryption.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties.
You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted.
Solution: You create a data loss prevention (DLP) policy that has only the Exchange email location selected.
Does this meet the goal?
  1. Yes Correct Answer
  2. No

Key Takeaways

The core concept tested is the capability of DLP policies to enforce Office 365 Message Encryption (OME) when specific sensitive information types are detected in email messages.

This question tests whether a Microsoft Purview DLP policy targeting Exchange can encrypt emails containing Azure Storage Account keys. The page establishes that the solution is correct because DLP policies support encryption actions for sensitive content.

Common mistake: Candidates often choose 'No' by assuming that detecting sensitive data does not automatically imply encryption, or they believe additional manual configuration steps are required beyond creating the policy scope and action.

Expert Analysis

Why the Answer Is Correct

Creating a Data Loss Prevention (DLP) policy with the Exchange location selected allows you to define conditions based on sensitive information types, such as "Azure Storage Account Key." When such content is detected, the policy can trigger protection actions, including "Encrypt" using Office 365 Message Encryption (OME). Therefore, the solution meets the goal of ensuring encrypted transmission.

Why the Other Options Are Wrong

Option B is incorrect because it assumes that a DLP policy cannot handle encryption or that the described configuration is incomplete. In reality, the combination of location (Exchange), condition (content contains key), and action (encrypt) is a complete and valid DLP rule configuration within Microsoft Purview.

Community Comment Notes

Community members like user 4d76265 confirm this works by testing the flow: select Exchange, add the built-in SIT for Azure Storage Account Keys, and choose the encryption action. User kollyp2000 references official documentation stating that DLP can create sensitive information type policies with message encryption. Some users initially doubted it, but the consensus supports that DLP natively supports OME integration.

Exam Strategy

When analyzing DLP scenarios, look for the combination of Location, Condition (Sensitive Info Type), and Action. If the action includes "Encrypt" or "Block," the policy is considered sufficient to meet security goals unless explicitly stated otherwise.

Frequently Asked Questions

Does a DLP policy automatically encrypt all emails?

No, only those matching the specific sensitive information type rules defined in the policy.

What is Office 365 Message Encryption (OME)?

It is a feature that allows sending encrypted emails to external recipients without requiring them to have an account.

More SC-401 FAQ →

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. 4d76265 👍 11 Answered A
    Given answer is correct. I have tested in Purview - I can create new DLP policy > scope to Exchange > content contains built-in SIT for Azure Storage Account Keys > restrict or encrypt the content in 365 locations > choose protection setting for encryption. Test, test, test, and don't rely solely on Copilot.
  2. dache 👍 9 Answered B
    Copilot: The correct answer is: B. No. A DLP policy with only the Exchange email location selected can detect and restrict the sharing of Azure Storage Account keys, but it does not automatically encrypt emails. To ensure encryption, you need to configure Microsoft Purview Information Protection or Microsoft Defender for Office 365 to enforce encryption policies when sensitive data is detected.
  3. Eltooth 👍 3 Answered A
    A. Yes, this solution does meet the goal — assuming the DLP policy is properly configured. By creating a Data Loss Prevention (DLP) policy that targets Exchange email and includes rules to detect Azure Storage Account keys, you can enforce email encryption when such sensitive information is found. This helps prevent the transmission of secrets in plain text. Key Considerations: The DLP policy must include accurate pattern matching for Azure Storage Account keys (e.g., using regular expressions or sensitive info types). The policy action must be set to encrypt the email or apply other protective measures. Since the location is set to Exchange email only, it will not cover other channels like Teams or SharePoint — but for email-specific protection, this is sufficient.
  4. rvln7 👍 1
    When a DLP policy detects sensitive information (e.g., Social Security numbers, credit card data), it can trigger Office 365 Message Encryption (OME). This is configured via mail flow rules. Also protective actions of DLP policies are: - show a pop-up policy tip - block the sharing, allow the user to override the block and capture the users' justification - block the sharing without the override option - for data at rest, sensitive items can be locked and moved to a secure quarantine location https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp read, read, read the docs, dont rely solely on tests
  5. kollyp2000 👍 1 Answered A
    Yes. : “You can use either Exchange mail flow rules or Microsoft Purview Data Loss Prevention (DLP) to create a sensitive information type policy with Microsoft Purview Message Encryption... You can create a rule based on conditions such as the presence of... sensitive information types in the message or attachment.” Source: Create a sensitive information type policy for your organization using Microsoft Purview Message Encryption, https://learn.microsoft.com/purview/ome-sensitive-info-types
Show 3 more comments
  1. ppolychron 👍 1 Answered A
    Answer Is Correct. Create a new DLP Policy with Exchange as location and Select: Conditions Content is shared from Microsoft 365 with people outside my organization AND Content contains-> sensitive information types> Azure Storage Account Key Actions Restrict access or encrypt the content in Microsoft 365 locations ->Encrypt email messages - > Select Encrypt (This is an OME template, you can also select a sensitivity label)
  2. Alcpt 👍 1 Answered B
    B No, selecting only the Exchange email location in a data loss prevention (DLP) policy is not enough to encrypt emails on its own; you must also configure a specific action within the policy to enforce encryption. This question says nothing about making additional / complete DLP configs.
  3. almitite 👍 1 Answered A
    The DLP policy can then automatically enforce actions, such as encrypting the email, blocking it, or displaying warnings.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide