When Does Content Expiry Apply After a Sensitivity Label Change?
You have a Microsoft 365 E5 subscription that contains two users named User1 and User2.
On January 1, you create the sensitivity label shown in the following table.
On January 2, you publish Label1 to User.
On January 3, User1 creates a Microsoft Word document named Doc1 and applies Label1 to the document.
On January 4, User2 edits Doc1.
On January 15, you increase the content expiry period for Label1 to 28 days.
When will access to Doc1 expire for User2?
Community Insight
The exam tests whether content expiry is calculated from label application or from a user's first access; the trap is resetting the clock when User2 edits Doc1 on January 4 or applying the January 15 policy change retroactively.
This SC-401 scenario tests how a sensitivity label's content-expiry setting is fixed when Label1 is applied to Doc1. Because Label1 was applied on January 3 with a 21-day expiry, Doc1 expires for User2 on January 24; the later change to 28 days does not retroactively update the existing document.
The most common wrong choice is C (January 25), because candidates start the 21-day period when User2 first edits Doc1 on January 4. That treats expiry as per-user first-access time, but Label1's content expiry is fixed at application on January 3 and yields January 24.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The exhibit's Label1 sets content expiry to 21 days after the label is applied, not after first access. User1 applied Label1 to Doc1 on January 3, so the expiry date baked into Doc1 is January 24 (January 3 plus 21 days). User2's January 4 edit does not restart that clock because content expiry belongs to the protected document, not to each user's first opening. The January 15 increase to 28 days applies to newly labeled or re-labeled content; it does not retroactively rewrite Doc1's existing expiry, so B is the answer.
Why the Other Options Are Wrong
A (January 23) is an off-by-one date that would come from counting from publication on January 2 or mishandling the application date. C (January 25) incorrectly starts the 21-day period at User2's first edit on January 4, even though the label's content-expiry rule is anchored to when the label was applied. D (January 31) wrongly applies the new 28-day value to Doc1 as if the January 15 policy change recalculated existing protection from January 3. The document would need to be re-labeled or re-protected under the updated label setting for the 28-day value to govern.
Community Comment Notes
gabbinu captures the core rule: the expiry period is "stamped into the document at the time the label is applied," and changing the label later does not retroactively update protected content. Eltooth reaches the same January 24 result by counting from Doc1's creation/labeling on January 3 with the original 21-day setting. kollyp2000 notes that label changes can be picked up during authentication after a use license expires, but that does not move this document's content-expiry date for the scenario. MultiCloudIronMan's January 25 rationale treats the RMS license issued at first access as resetting expiry, which conflates use-license issuance with the content-expiry value set when Label1 was applied.
Official Reference
Exam Strategy
For content-expiry questions, anchor the calculation to the date the sensitivity label was applied and use the setting in force at that moment. Don't let a later label-policy edit or another user's first access pull you into recalculating an existing document's expiry.
Frequently Asked Questions
Why doesn't the January 15 change to 28 days extend Doc1's expiry to January 31?
Because content expiry is applied to Doc1 when Label1 is applied on January 3. Changing the label policy later does not recalculate existing protected content unless the document is re-labeled.
Why isn't User2's first edit on January 4 the start of the 21-day expiry?
The label setting uses time after the label is applied, not after a user's first access. User2's January 4 edit does not restart the expiry clock for Doc1.