Sensitivity Label Permissions for Microsoft 365 Copilot Summarization

SC-401 By islever Editorial Last updated

Implement and manage sensitivity labels in Microsoft Purview

Short answer

B Select Copy and extract content (EXTRACT) to grant Microsoft 365 Copilot the necessary permissions to programmatically access and summarize files protected by Label1.

Question

You have a Microsoft 365 E5 subscription.
You need to create a sensitivity label named Label1. The solution must ensure that users can use Microsoft 365 Copilot to summarize files that have Label1 applied.
Which permission should you select for Label1?
  1. Export content(EXPORT)
  2. Copy and extract content(EXTRACT) Correct Answer
  3. Edit content(DOCEDIT)
  4. View rights(VIEW)

Key Takeaways

The exam tests the specific distinction between human viewing rights (VIEW) and AI processing rights (EXTRACT); granting VIEW alone blocks Copilot from summarizing encrypted content.

To enable Microsoft 365 Copilot to summarize files with a sensitivity label, you must configure the label with the EXTRACT usage right. This ensures AI services can access protected content for processing.

Common mistake: Candidates often select View rights (VIEW) assuming that since humans can view the file, Copilot should also be able to read it. However, without EXTRACT, Copilot is explicitly blocked from summarizing the content.

Expert Analysis

The question requires configuring a sensitivity label in Microsoft Purview to allow Microsoft 365 Copilot to summarize protected files. The core concept here is how Usage Rights interact with AI services when encryption or protection is applied via a sensitivity label.

According to Microsoft's official documentation on AI considerations for Microsoft Purview, if content has usage rights restrictions, Copilot and other agents check these rights before processing data. Specifically, the documentation states: "If content grants a user VIEW usage rights but not EXTRACT... Copilot won't summarize this content." This explicitly rules out option D (View rights), which is the most attractive wrong answer because it seems sufficient for human viewing. However, AI summarization requires the system to programmatically extract text from the protected file, which necessitates the EXTRACT permission.

Option B (Copy and extract content) is the correct choice. The EXTRACT permission allows Copilot to access the document content to generate summaries. Without this specific right, even if a user can view the file, the AI service is blocked from reading the underlying text for processing. Options A (Export) and C (Edit) are either too broad, irrelevant to the specific action of summarization, or not the primary requirement identified in the vendor's guidance for AI interoperability.

Official Reference

https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-considerations

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with Microsoft Purview sensitivity labels and third-party integrations like Copilot or Power BI, always check the vendor's specific 'AI considerations' or 'integration' documentation. Memorize the exact usage right names (VIEW, EXTRACT, EDIT) and their specific implications for automated services versus human users. Do not assume 'viewing' implies 'processing'.

Frequently Asked Questions

Why doesn't VIEW permission allow Copilot to summarize?

VIEW only allows human users to open and read the file. Copilot requires programmatic access to extract text for processing, which is granted by the EXTRACT permission. Without EXTRACT, Copilot cannot read the content.

What happens if I set EXTRACT but not EDIT?

Copilot can still summarize and reference the content. EDIT is required for modifying the file itself, but summarization only requires reading/extraction capabilities.

More SC-401 FAQ →

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. Fiqri 👍 12 Answered B
    according to this article: https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-considerations If content grants a user VIEW usage rights but not EXTRACT: Copilot won't summarize this content but can reference it with a link so the user can then open and view the content outside Copilot. So the answer is B.
  2. rodscherdead 👍 3 Answered D
    https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-considerations If content grants a user VIEW usage rights but not EXTRACT: - When a user has this content open in an app, they won't be able to use Copilot. - Copilot won't summarize this content but can reference it with a link so the user can then open and view the content outside Copilot. When...open...in...an...app -> THIS content won´t summarize by Copilot So I go with D
  3. JFROG 👍 3 Answered B
    I am going for B. Check https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-considerations If content grants a user VIEW usage rights but not EXTRACT: When a user has this content open in an app, they won't be able to use Copilot. Copilot won't summarize this content but can reference it with a link so the user can then open and view the content outside Copilot.
  4. gabbinu 👍 3 Answered B
    Answer is B https://learn.microsoft.com/en-us/purview/sensitivity-labels “If the labels applied encryption from Microsoft Purview Information Protection, Copilot and agents check the usage rights for the user. Only if the user is granted permissions to copy (the EXTRACT usage right) from an item, is data from that item returned by Copilot or agents.”
  5. SSL2 👍 2 Answered B
    Correct answer: B. Copy and extract content (EXTRACT) Why EXTRACT? When a sensitivity label applies encryption or protection to a file, Copilot will respect those protections. Even if a user has basic viewing access, Copilot needs the EXTRACT permission so that the content can be programmatically accessed and processed (e.g., summarized) when generating output. Without EXTRACT, Copilot cannot read the file contents for summarization.
Show 9 more comments
  1. TheMCT 👍 2 Answered D
    To ensure that Microsoft 365 Copilot can summarize files with a sensitivity label applied, the label must grant Copilot the ability to read and process the content.
  2. tuantmb 👍 2 Answered B
    EXTRACT allows services like Copilot to read and process the content for summarization, insights, and other AI-powered features.
  3. starlord45 👍 1 Answered D
    I consider D View rights (VIEW) as right. Because a summary can be done from a user when he can view the content. so open document and ask for a summary. Common name: Copy Encoding in policy: EXTRACT Enables options to copy data (including screen captures) from the document into the same or another document. In some applications, it also allows the whole document to be saved in unprotected form. Extract is more for reports and new documents generated on the source file. But for a summary this is not needed. https://learn.microsoft.com/en-us/azure/information-protection/configure-usage-rights
  4. NeerajSap 👍 1 Answered B
    For Microsoft 365 Copilot to generate summaries of protected documents, users need the ability to extract content from the files. The EXTRACT permission ("Copy and extract content") allows: Copying content from a protected document Extracting text for services such as search, indexing, and AI-based processing Microsoft 365 Copilot to access the document content and generate summaries Without EXTRACT, Copilot may not be able to process the protected content even if the user can open the file.
  5. Jarem 👍 1 Answered B
    In the Microsoft Purview portal, the EXTRACT usage right is displayed as Copy and extract content(EXTRACT). For example, the default permission level selected is Editor, where you see Copy and extract content(EXTRACT) is included. As a result, content protected with this encryption configuration can be returned by Copilot and agents https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-considerations#copilot-honors-existing-protection-with-the-extract-usage-right
  6. GregJ123456 👍 1 Answered C
    Tried setting up files with all the below sensitivty labels. Shared it with different user. Guess what worked for the other user. The one whcih had C on it. But for the creator of this file, it worked on B. Hence I will select C as this is required for Co-pilot to work
  7. tuantmb 👍 1 Answered B
    Same as previous users, copilot needs EXTRACT permission to process data (VIEW permission only allow use resource as reference)
  8. RoMoo 👍 1 Answered D
    VIEW is the minimum necessary permission for this specific task.
  9. dmoorthy 👍 1 Answered B
    Copy and extract content (EXTRACT)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide