Data Protection and Governance for Microsoft 365 and Copilot · Topic 2 of 6
Sensitivity Labels, Classification and Retention
AB-900 data protection: use cases for sensitivity labels, how Purview classifies data with sensitive info types and classifiers, and retention.
- 4 min
- Classification finds sensitive data. Labels protect it. Retention governs its lifetime.
- Sensitivity labels can encrypt, add markings and apply to containers such as Teams and sites.
- Label policies publish labels to users. Labels can be applied manually or automatically.
What it is
Three ideas work as a chain. Classification finds out what content is sensitive. Sensitivity labels mark and protect it. Retention decides how long it is kept. Copilot respects all three, which is why they matter for this exam.
How it works
Data classification
Purview recognizes sensitive content by what it contains or what kind of document it is.
| Method | What it does |
|---|---|
| Sensitive information types | Match patterns such as credit card, bank account or national ID numbers. Many are built in and you can add custom ones |
| Trainable classifiers | A machine learning model recognizes a kind of document, such as a contract, from examples |
| Exact data match | Compares content with a table of your own sensitive values, such as customer records |
Classification results appear in explorers in the Purview portal. The next pages show which explorer answers which question.
Use cases for sensitivity labels
A sensitivity label is a tag on an item that says how sensitive it is and can apply protection. The label travels with the file, so the protection stays when it is emailed or copied.
| Use case | What the label does |
|---|---|
| Protect a confidential document | Encrypts it so only chosen people can open it |
| Show people how to handle it | Adds a header, footer or watermark such as Confidential |
| Control a team or site | Applies to a container such as a Teams team or SharePoint site, to set privacy, external sharing and access from unmanaged devices |
| Feed other protections | DLP rules and Copilot controls can act on the label |
| Label automatically | An auto labeling policy applies a label when content matches a sensitive information type |
An administrator creates labels, then publishes them to users with a label policy. A policy can make labeling mandatory. Labels are ordered from less to more sensitive, such as Public, General, Confidential and Highly Confidential.
Labels also influence Copilot. If a label encrypts content, Copilot honors the usage rights the user has. A user needs the right to extract the content for Copilot to use it in an answer.
Retention
Retention is the rule for how long content is kept and what happens after.
| Item | Scope | Notes |
|---|---|---|
| Retention policy | Applies to whole locations such as all Exchange mailboxes or SharePoint sites | Set and forget. Users do not choose it |
| Retention label | Applied to individual items by users or automatically | Can also mark an item as a record |
Both can retain content (keep it), delete it, or retain then delete after a period. Retention policies can also cover Copilot interactions, so prompts and responses can be kept or deleted like other content.
A retain rule wins over a delete rule when both apply to the same item. Content that must be kept is not deleted early.
A worked example
A hospital stores patient letters in SharePoint. A sensitive information type finds national ID numbers in them. An auto labeling policy applies the Highly Confidential label, which encrypts the letters. A retention label keeps the letters for ten years and then deletes them. When a doctor asks Copilot for a summary, Copilot works only if that doctor has permission and the usage rights to the encrypted letter.
How the exam asks about this
- "Automatically apply a label to files containing national ID numbers." An auto labeling policy using a sensitive information type.
- "Keep all Exchange email for five years and then delete it." A retention policy.
- "Identify contract documents based on examples." A trainable classifier.
What to remember for the exam
- Classification finds sensitive data. Labels protect it. Retention governs its lifetime.
- Sensitivity labels can encrypt, add markings and apply to containers such as Teams and sites.
- Label policies publish labels to users. Labels can be applied manually or automatically.
- A retention policy covers locations. A retention label covers items.
- Retain beats delete if rules overlap.
Sensitivity labels and retention labels have different jobs. A sensitivity label protects. A retention label keeps or deletes. Questions often swap them as distractors.
Common mistakes
Believing a label alone blocks external sharing of a message. A label can restrict access through encryption. Blocking an outbound send is a DLP action.
Using retention to stop sensitive data leaking. Retention is about time. Use labels and DLP for leaks.
Thinking classification changes the content. Classification only identifies it. Applying a label or policy is a separate step.
Check yourself
Which feature applies encryption that follows a document?
A sensitivity label.
Which method recognizes a type of document, such as a contract, from examples?
A trainable classifier.
What is the difference between a retention policy and a retention label?
A policy covers whole locations, while a label is applied to individual items.
Topic 2 of 6 in Data Protection and Governance for Microsoft 365 and Copilot
Test yourself on Data Protection and Governance for Microsoft 365 and Copilot
The full Microsoft AB-900 question bank has 499 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.