Category: Data Governance

Data Governance, Data Security, DP-800, Microsoft Certification, SQL August 1, 2026

Design and implement object-level permissions (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement object-level permissions

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Securing data is one of the most important responsibilities of a SQL developer. While server-level and database-level permissions determine who can connect to SQL Server and access databases, object-level permissions determine what users can do with individual database objects such as tables, views, stored procedures, functions, sequences, and schemas.

The DP-800 certification expects candidates to understand how to implement the principle of least privilege, ensuring that users receive only the permissions required to perform their jobs.

Object-level permissions are a fundamental component of SQL Server security and are widely used in:

Microsoft SQL Server
Azure SQL Database
Azure SQL Managed Instance
Microsoft Fabric SQL Database
SQL Database in Fabric Warehouses (where supported)

Understanding how permissions are inherited, granted, denied, revoked, and combined with roles is essential for designing secure database solutions.

What Are Object-Level Permissions?

Object-level permissions control access to individual database objects rather than the entire database.

For example, one user might:

Read data from a table
Execute a stored procedure
Update rows in another table
View metadata
Create indexes

while another user has completely different permissions.

Unlike database-level permissions, object permissions provide very granular security.

Example:

			
Sales.Customers
Sales.Orders
Sales.Products
HR.Employees

A salesperson may have access to Sales tables but no access to HR tables.

Common Database Objects That Can Be Secured

Permissions can be assigned to numerous SQL Server objects, including:

Tables
Views
Stored procedures
Functions
Schemas
Sequences
Synonyms
External tables
User-defined types
XML schema collections
Service Broker objects

DP-800 focuses primarily on:

Tables
Views
Stored procedures
Functions
Schemas

Permission Hierarchy

Permissions exist at several levels.

			
Server
    ↓
Database
    ↓
Schema
    ↓
Object

		

Example:

			
Database
    Sales
Schema
    Sales
Table
    Orders

		

Permissions granted on the schema may automatically apply to objects within that schema.

Common Object Permissions

The most commonly used permissions include:

Permission	Purpose
SELECT	Read rows
INSERT	Add rows
UPDATE	Modify rows
DELETE	Remove rows
EXECUTE	Run stored procedures/functions
REFERENCES	Create foreign keys
ALTER	Modify an object
CONTROL	Full control over an object
TAKE OWNERSHIP	Change ownership
VIEW DEFINITION	View object definition

GRANT

GRANT gives permissions.

Example

			
GRANT SELECT
ON Sales.Orders
TO SalesUser;

The user can now query the table.

Example

			
GRANT INSERT, UPDATE
ON Sales.Orders
TO SalesUser;

Multiple permissions can be granted simultaneously.

Grant execute permission

			
GRANT EXECUTE
ON dbo.usp_ProcessOrders
TO SalesUser;

The user may execute the procedure without having direct table permissions.

DENY

DENY explicitly prevents access.

Example

			
DENY DELETE
ON Sales.Orders
TO SalesUser;

Even if another role grants DELETE, DENY overrides it.

This is one of the most important security concepts on the DP-800 exam.

REVOKE

REVOKE removes previously granted or denied permissions.

Example

			
REVOKE SELECT
ON Sales.Orders
FROM SalesUser;

REVOKE does not deny access.

It simply removes the explicit permission.

GRANT vs DENY vs REVOKE

Command	Effect
GRANT	Allows access
DENY	Explicitly blocks access
REVOKE	Removes a GRANT or DENY

Permission Precedence

SQL Server evaluates permissions using precedence rules.

Highest priority:

DENY

Lower priority:

GRANT

Example

User belongs to:

SalesRole

SalesRole:

GRANT SELECT

Another role:

DENY SELECT

Result:

User cannot SELECT.

DENY wins.

Granting Permissions to Roles

Best practice is to grant permissions to roles rather than directly to users.

Example

CREATE ROLE SalesReaders;

Grant permission

			
GRANT SELECT
ON Sales.Orders
TO SalesReaders;

Add user

			
ALTER ROLE SalesReaders
ADD MEMBER Alice;

This greatly simplifies administration.

Schema-Level Permissions

Instead of granting access to each table individually, permissions may be granted on an entire schema.

Example

			
GRANT SELECT
ON SCHEMA::Sales
TO SalesReaders;

The role receives SELECT permission on all objects within the Sales schema.

Stored Procedure Permissions

Applications often use stored procedures instead of direct table access.

Example

			
GRANT EXECUTE
ON dbo.usp_GetCustomerOrders
TO AppUser;

Users execute the procedure without needing direct permissions on the underlying tables (ownership chaining permitting).

Benefits include:

Better security
Reduced attack surface
Easier auditing
Centralized business logic

View Permissions

Views frequently expose only selected columns or rows.

Example

			
GRANT SELECT
ON Sales.vCustomerSummary
TO SalesReaders;

Applications query the view rather than the underlying table.

Advantages include:

Hide sensitive columns
Simplify queries
Provide logical security boundaries

Function Permissions

Scalar and table-valued functions also require EXECUTE permission.

Example

			
GRANT EXECUTE
ON dbo.fn_CalculateDiscount
TO SalesUser;

Ownership Chaining

Ownership chaining occurs when objects owned by the same owner access one another.

Example

			
User
   ↓
Stored Procedure
   ↓
Table

		

If both objects share the same owner:

SQL Server does not perform additional permission checks on the table.

Benefits:

Simplifies application security
Eliminates unnecessary table permissions
Improves manageability

DP-800 frequently tests this concept.

Least Privilege Principle

One of Microsoft’s most important security recommendations.

Users should receive:

Only the permissions required
Nothing more

Poor example

db_owner

Better example

			
SELECT
EXECUTE

Grant only what is necessary.

Avoid Granting db_owner

Many organizations incorrectly solve permission issues by granting db_owner.

Problems:

Full database control
Can drop objects
Can change security
Can alter schemas
Increased security risk

Instead:

Create custom roles
Grant only required permissions

Object Permissions and AI Applications

Modern AI-enabled SQL solutions frequently access databases through:

APIs
Stored procedures
Semantic search
Retrieval-Augmented Generation (RAG)
Microsoft Fabric
Copilot applications

Best practice:

AI applications should never connect using highly privileged accounts.

Instead:

Create service accounts.
Grant only EXECUTE on required procedures or SELECT on approved views.
Avoid direct access to sensitive tables.
Combine object permissions with Row-Level Security (RLS), Dynamic Data Masking (DDM), and Always Encrypted where appropriate.

This approach reduces the risk of exposing sensitive information through AI-assisted applications.

Best Practices

Microsoft recommends:

Grant permissions through roles.
Follow least privilege.
Prefer views over direct table access.
Use stored procedures for data modifications.
Avoid granting db_owner.
Regularly audit permissions.
Remove unused permissions.
Use schema-based permissions when appropriate.
Minimize explicit DENY statements unless required.
Combine object permissions with other SQL Server security features.

DP-800 Exam Tips

Candidates should know how to:

Grant object permissions
Revoke permissions
Deny permissions
Understand permission inheritance
Secure stored procedures
Secure views
Grant schema permissions
Use database roles
Explain ownership chaining
Apply least privilege
Understand permission precedence
Determine the effect of GRANT, DENY, and REVOKE
Design secure access models for AI-enabled database applications

Practice Exam Questions

Question 1

A database developer wants users to read data from the Sales.Orders table but prevent any modifications. Which permission should be granted?

A. EXECUTE

B. SELECT

C. ALTER

D. CONTROL

Correct Answer: B

Explanation:
The SELECT permission allows users to read rows from a table without permitting INSERT, UPDATE, or DELETE operations.

Question 2

A user belongs to two database roles. One role grants SELECT permission on a table, while the other role explicitly denies SELECT permission. What is the result?

A. SQL Server ignores the DENY.

B. SQL Server randomly selects one permission.

C. The user can still read the table.

D. The user cannot read the table.

Correct Answer: D

Explanation:
DENY takes precedence over GRANT. An explicit DENY overrides any granted permissions from other roles.

Question 3

Which statement is the recommended method for assigning permissions to multiple users?

A. Grant permissions directly to every user.

B. Add every user to db_owner.

C. Create database roles and grant permissions to the roles.

D. Use only server-level permissions.

Correct Answer: C

Explanation:
Assigning permissions to roles simplifies administration, improves consistency, and aligns with Microsoft security best practices.

Question 4

Which command removes a previously granted permission without explicitly denying access?

REVOKE

DENY

REMOVE

DROP

Correct Answer: A

Explanation:
REVOKE removes an existing GRANT or DENY. It does not prohibit future access unless another permission remains in effect.

Question 5

An application should execute a stored procedure but should not have direct access to the underlying tables. Which permission should be granted?

A. SELECT on every table

B. CONTROL on the database

C. EXECUTE on the stored procedure

D. ALTER on the schema

Correct Answer: C

Explanation:
Granting EXECUTE on the stored procedure allows users to perform approved operations without direct table access, leveraging ownership chaining when applicable.

Question 6

Which permission allows a user to modify the definition of an existing table?

A. ALTER

B. SELECT

C. EXECUTE

D. REFERENCES

Correct Answer: A

Explanation:
The ALTER permission enables changes to an object’s definition, such as adding or removing columns from a table.

Question 7

A database administrator grants SELECT permission on an entire schema. What is the primary benefit?

A. It encrypts every table in the schema.

B. It automatically creates new users.

C. It applies permissions to objects within the schema, simplifying administration.

D. It replaces Row-Level Security.

Correct Answer: C

Explanation:
Schema-level permissions reduce administrative effort by applying permissions to objects contained within the schema, rather than requiring individual grants on each object.

Question 8

Which principle recommends granting users only the permissions they require to perform their jobs?

A. Defense in depth

B. Separation of duties

C. Ownership chaining

D. Least privilege

Correct Answer: D

Explanation:
The principle of least privilege minimizes security risks by limiting permissions to only those necessary for a user’s responsibilities.

Question 9

Why is granting the db_owner role to application accounts generally discouraged?

A. It prevents applications from executing stored procedures.

B. It provides unnecessary administrative privileges and increases security risk.

C. It disables ownership chaining.

D. It prevents schema-level permissions from working.

Correct Answer: B

Explanation:
The db_owner role grants full control over the database, which violates the principle of least privilege and can expose the database to accidental or malicious changes.

Question 10

Which database object permission is required to run a user-defined function?

A. SELECT

B. UPDATE

C. EXECUTE

D. ALTER

Correct Answer: C

Explanation:
User-defined functions, like stored procedures, require the EXECUTE permission to be invoked by users or applications.

Go to the DP-800 Exam Prep Hub main page

Data Governance, Data Security, DP-800, Microsoft Certification, SQL August 1, 2026August 1, 2026

Design and implement Row-Level Security (RLS) (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement Row-Level Security (RLS)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

What is Row-Level Security (RLS)?

Row-Level Security (RLS) is a SQL Server and Azure SQL Database feature that restricts which rows a user can access based on a security policy. Rather than controlling access to an entire table, RLS filters data so that users see only the rows they are authorized to view.

For example, a Sales table might contain data for all sales regions:

SalesPerson	Region	Sales
Alice	East	125000
Bob	West	98000
Carol	North	143000
David	South	110000

With RLS enabled:

Alice sees only East region rows.
Bob sees only West region rows.
Regional managers see only their assigned regions.
Executives may see all rows.

The application continues to query the entire table, but SQL Server automatically filters the results.

Why Use Row-Level Security?

Many organizations have users who should share the same tables while viewing different subsets of the data.

Common scenarios include:

Multi-tenant Software-as-a-Service (SaaS) applications
Regional sales reporting
Department-specific HR records
Healthcare systems where providers access only their patients
Educational systems where instructors see only their own students
Financial institutions with branch-specific records

Without RLS, developers often implement filtering within application code. RLS centralizes these security rules inside the database, reducing development effort and improving security.

How Row-Level Security Works

RLS works by attaching a security policy to a table.

When a query executes:

SQL Server identifies the current user.
A predicate function evaluates each row.
Only rows that satisfy the predicate are returned.

This occurs automatically without modifying application queries.

Row-Level Security Architecture

			
Application
      │
      ▼
SELECT * FROM Orders
      │
      ▼
Security Policy
      │
      ▼
Predicate Function
      │
      ▼
Only Authorized Rows Returned

		

The application does not need to include a WHERE clause because SQL Server applies the filtering automatically.

Components of Row-Level Security

RLS consists of three primary components:

1. Predicate Function

A predicate function determines whether a row should be visible.

Typically, this is an inline table-valued function.

Example:

			
CREATE FUNCTION Security.fn_FilterSales
(
    @SalesRegion NVARCHAR(50)
)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
SELECT 1 AS fn_result
WHERE @SalesRegion = USER_NAME();

		

This function allows users to see rows only when the SalesRegion value matches their database user name.

2. Security Policy

The security policy associates the predicate function with a table.

Example:

			
CREATE SECURITY POLICY SalesFilter
ADD FILTER PREDICATE
Security.fn_FilterSales(SalesRegion)
ON dbo.Sales
WITH (STATE = ON);

		

Once enabled, every query against the Sales table automatically uses the filter.

3. Protected Table

The protected table contains the actual business data.

Applications continue to issue normal SELECT, UPDATE, DELETE, and MERGE statements while SQL Server enforces the policy.

Types of Security Predicates

SQL Server supports two predicate types.

Filter Predicate

A filter predicate limits which rows users can read.

Example:

			
SELECT *
FROM Sales;

The query returns only rows authorized by the security policy.

This is the most commonly used predicate.

Block Predicate

A block predicate prevents unauthorized modifications.

It can prevent:

INSERT
UPDATE
DELETE

Example:

A user may be allowed to read only West region rows and may also be prevented from inserting East region records.

Block Predicate Types

Block predicates can be applied:

BEFORE INSERT
AFTER INSERT
BEFORE UPDATE
AFTER UPDATE
BEFORE DELETE

This provides fine-grained control over data modifications.

Example: Multi-Tenant Application

Imagine a SaaS application storing customer records.

CustomerID	TenantID	CustomerName
101	TenantA	ABC Company
102	TenantB	XYZ Industries
103	TenantA	Contoso Ltd

Instead of creating separate databases for every customer, one database stores all tenants.

The predicate function filters rows by TenantID so that:

TenantA users see only TenantA records.
TenantB users see only TenantB records.

Applications require no additional filtering logic.

Example: Sales Regions

Sales table:

Employee	Region
Alice	East
Bob	West
Carol	East
David	South

Logged-in user:

EastManager

Predicate:

WHERE Region = USER_NAME()

Result:

Employee	Region
Alice	East
Carol	East

Other regions are invisible.

Creating an RLS Policy

Step 1: Create Schema

CREATE SCHEMA Security;

Step 2: Create Predicate Function

			
CREATE FUNCTION Security.fn_FilterRegion
(
    @Region NVARCHAR(50)
)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
SELECT 1
WHERE @Region = USER_NAME();

		

Step 3: Create Security Policy

			
CREATE SECURITY POLICY RegionFilter
ADD FILTER PREDICATE
Security.fn_FilterRegion(Region)
ON dbo.Sales
WITH (STATE = ON);

		

The policy immediately begins protecting the table.

Disabling a Security Policy

			
ALTER SECURITY POLICY RegionFilter
WITH (STATE = OFF);

The policy remains defined but no longer filters data.

Re-enabling the Policy

			
ALTER SECURITY POLICY RegionFilter
WITH (STATE = ON);

Dropping a Security Policy

DROP SECURITY POLICY RegionFilter;

Security Context Functions

RLS frequently uses identity functions.

Common examples include:

Function	Purpose
`USER_NAME()`	Current database user
`SUSER_SNAME()`	Login name
`SESSION_CONTEXT()`	Session-specific values
`ORIGINAL_LOGIN()`	Original login before impersonation

These functions allow security decisions based on the current user or application context.

SESSION_CONTEXT()

Many enterprise applications use SESSION_CONTEXT() rather than database usernames.

Example:

			
EXEC sp_set_session_context
@key='TenantID',
@value='TenantA';

Predicate:

			
WHERE
@TenantID =
SESSION_CONTEXT(N'TenantID');

This approach works well in web applications where many users connect using a shared database login.

Benefits of Row-Level Security

Centralized Security

Rules exist inside the database instead of multiple applications.

Transparent to Applications

Applications issue normal SQL statements.

No code changes are typically required.

Consistent Enforcement

Every query is filtered automatically.

Developers cannot accidentally omit security filters.

Simplifies Development

No need to duplicate WHERE clauses throughout application code.

Improved Maintainability

Security policies can be updated without changing application logic.

Limitations

Not a Replacement for Authentication

Users must still authenticate.

RLS determines only which rows are visible.

Does Not Encrypt Data

Use:

Always Encrypted
Transparent Data Encryption (TDE)

when encryption is required.

Does Not Mask Data

Use:

Dynamic Data Masking

when users should see masked values instead of hidden rows.

Predicate Performance

Complex predicate functions can reduce query performance.

Predicate functions should remain efficient.

RLS vs Dynamic Data Masking

Row-Level Security	Dynamic Data Masking
Hides rows	Masks column values
User cannot see unauthorized records	User sees rows but masked data
Controls access to records	Controls visibility of sensitive columns
Based on predicates	Based on masking functions
Often used with DDM	Often combined with RLS

RLS vs Always Encrypted

Row-Level Security	Always Encrypted
Controls visible rows	Encrypts stored values
Server evaluates predicates	Client decrypts data
Data remains readable by authorized users	Database cannot read encrypted values without client-side decryption
Access control	Confidentiality protection

Best Practices

Keep Predicate Functions Simple

Simple predicates improve query performance.

Use SCHEMABINDING

Predicate functions should use:

WITH SCHEMABINDING

This prevents changes that could invalidate the security policy.

Use SESSION_CONTEXT() for Web Applications

This scales better than relying solely on database usernames.

Test with Non-Administrative Accounts

Database administrators often bypass normal security scenarios.

Always validate RLS using standard user accounts.

Combine with Other Security Features

For comprehensive protection, combine RLS with:

Dynamic Data Masking
Always Encrypted
Transparent Data Encryption
Microsoft Entra authentication
Least-privilege permissions
SQL auditing

DP-800 Exam Tips

Candidates should be able to:

Explain the purpose of Row-Level Security.
Differentiate filter predicates from block predicates.
Understand the role of predicate functions and security policies.
Create RLS using inline table-valued functions.
Enable, disable, and drop security policies.
Use USER_NAME(), SUSER_SNAME(), and SESSION_CONTEXT() in predicate functions.
Differentiate RLS from Dynamic Data Masking and Always Encrypted.
Identify common scenarios such as multi-tenant SaaS applications.
Recognize that RLS is transparent to application code.

Practice Exam Questions

Question 1

A company stores sales records for all regions in a single table. Regional managers should view only the rows for their assigned region.

Which SQL Server feature should you implement?

A. Transparent Data Encryption

B. Row-Level Security

C. Dynamic Data Masking

D. Always Encrypted

Answer: B

Explanation: Row-Level Security filters rows based on a security policy so users automatically see only the records they are authorized to access.

Question 2

Which object determines whether a row is visible to a user in Row-Level Security?

A. Security predicate function

B. Database trigger

C. View

D. Stored procedure

Answer: A

Explanation: An inline table-valued predicate function evaluates each row and determines whether it should be returned.

Question 3

Which statement about Row-Level Security is correct?

A. It encrypts rows before storage.

B. It permanently removes unauthorized rows.

C. It automatically filters query results according to a security policy.

D. It masks sensitive column values.

Answer: C

Explanation: RLS evaluates a security policy during query execution and returns only authorized rows without modifying the stored data.

Question 4

Which type of security predicate prevents unauthorized INSERT, UPDATE, or DELETE operations?

A. Filter predicate

B. Access predicate

C. Security predicate

D. Block predicate

Answer: D

Explanation: Block predicates prevent users from performing unauthorized data modifications.

Question 5

Which function is commonly used in web applications to store tenant-specific information for Row-Level Security?

A. CURRENT_USER

B. SESSION_CONTEXT()

C. USER_ID()

D. DB_NAME()

Answer: B

Explanation: SESSION_CONTEXT() stores key-value pairs for the current session, making it ideal for multi-tenant applications.

Question 6

A developer creates the following policy:

			
ADD FILTER PREDICATE
Security.fn_FilterRegion(Region)
ON dbo.Sales;

What is the effect?

A. Rows are encrypted.

B. Columns are masked.

C. Unauthorized rows are automatically filtered from query results.

D. The table becomes read-only.

Answer: C

Explanation: A filter predicate restricts which rows are returned based on the predicate function.

Question 7

Which statement best describes the relationship between applications and Row-Level Security?

A. Applications must include special WHERE clauses.

B. Applications require encryption libraries.

C. Applications typically require no changes because SQL Server applies filtering automatically.

D. Applications cannot use SELECT * statements.

Answer: C

Explanation: RLS is transparent to applications. SQL Server automatically applies the filtering logic defined in the security policy.

Question 8

Which feature is most appropriate when users should see every row but sensitive values should be partially hidden?

A. Row-Level Security

B. Always Encrypted

C. Transparent Data Encryption

D. Dynamic Data Masking

Answer: D

Explanation: Dynamic Data Masking hides sensitive column values while still allowing users to access all authorized rows.

Question 9

Which statement is true regarding Row-Level Security?

A. It replaces authentication.

B. It determines which rows a user can access after authentication.

C. It encrypts the database backup.

D. It compresses tables.

Answer: B

Explanation: Authentication establishes the user’s identity, while RLS determines which rows that authenticated user is allowed to access.

Question 10

Which practice is recommended when designing Row-Level Security policies?

A. Use complex scalar functions to maximize flexibility.

B. Disable SCHEMABINDING to simplify maintenance.

C. Keep predicate functions simple and efficient to minimize performance overhead.

D. Place all filtering logic in application code instead of the database.

Answer: C

Explanation: Efficient predicate functions help reduce the performance impact of Row-Level Security while maintaining centralized, database-enforced access control.

Go to the DP-800 Exam Prep Hub main page

Data Governance, Data Security, DP-800, Microsoft Certification, SQL August 1, 2026

Design and implement Dynamic Data Masking (DDM) (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement Dynamic Data Masking

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

What is Dynamic Data Masking?

Dynamic Data Masking (DDM) is a SQL Server and Azure SQL feature that limits the exposure of sensitive data by masking the results returned to non-privileged users without modifying the actual data stored in the database.

Unlike encryption, DDM does not change or encrypt the stored data. Instead, SQL Server dynamically replaces sensitive values with masked values when queries are executed by users who do not have permission to view the original data.

For example, the database may contain:

CustomerName	SSN	Email
John Smith	123-45-6789	john@email.com

A privileged user sees:

CustomerName	SSN	Email
John Smith	123-45-6789	john@email.com

A non-privileged user may see:

CustomerName	SSN	Email
John Smith	XXX-XX-6789	jXXX@XXXX.com

The underlying data never changes.

Why Use Dynamic Data Masking?

Organizations frequently store sensitive information such as:

Personally Identifiable Information (PII)
Social Security Numbers
Credit card numbers
Email addresses
Phone numbers
Employee salaries
Medical information

Not every user who queries the database should have unrestricted access to these values.

DDM allows developers to:

Reduce accidental data exposure
Protect sensitive fields
Simplify application development
Support compliance initiatives
Allow customer support personnel to work with realistic-looking data

How Dynamic Data Masking Works

When a user executes a query:

SQL Server checks whether the user has permission to view unmasked data.
If the user has the UNMASK permission, actual values are returned.
Otherwise, SQL Server substitutes masked values before sending the results.

The database itself remains unchanged.

Dynamic Data Masking Architecture

			
Database
│
├── Actual Data
│      987-65-4321
│
├── User A
│      Has UNMASK permission
│
│      Result:
│      987-65-4321
│
└── User B
       No UNMASK permission
       Result:
       XXX-XX-4321

		

Benefits of Dynamic Data Masking

DDM provides several important advantages.

Easy to Implement

Masking is configured using T-SQL without requiring application changes.

No Data Duplication

The original data remains stored only once.

Transparent to Applications

Applications continue issuing the same queries.

No application code changes are required.

Supports Least Privilege

Users receive only the information they need.

Helps Meet Compliance Requirements

Although DDM is not encryption, it helps organizations reduce unnecessary exposure of sensitive information.

Dynamic Data Masking vs Encryption

Dynamic Data Masking	Encryption
Masks query results	Encrypts stored data
Data remains unchanged	Data stored encrypted
Protects against accidental viewing	Protects against data theft
Transparent to applications	May require encryption keys
Does not secure backups	Protects stored data

Microsoft expects candidates to understand that DDM is not a replacement for encryption technologies such as Always Encrypted or Transparent Data Encryption (TDE).

Supported Masking Functions

SQL Server supports several built-in masking functions.

Default Mask

Masks data according to its data type.

Example:

Original:

John Smith

Masked:

XXXX

Syntax:

MASKED WITH (FUNCTION = 'default()')

Email Mask

Designed specifically for email addresses.

Original:

john.smith@email.com

Masked:

jXXX@XXXX.com

Syntax:

MASKED WITH (FUNCTION = 'email()')

Partial Mask

Reveals part of a string while masking the remainder.

Example:

Original:

555-123-4567

Masked:

XXX-XXX-4567

Syntax:

			
MASKED WITH
(
FUNCTION='partial(prefix,padding,suffix)'
)

Example:

			
MASKED WITH
(
FUNCTION='partial(0,"XXX-XXX-",4)'
)

Random Mask

Returns a random value within a specified numeric range.

Example:

Original Salary

Masked

Syntax

			
MASKED WITH
(
FUNCTION='random(1,100000)'
)

Useful when exact values should never be exposed.

Creating a Masked Column

Example:

			
CREATE TABLE Customers
(
    CustomerID INT,
    Name NVARCHAR(100),
    Email NVARCHAR(200)
    MASKED WITH (FUNCTION='email()'),
    SSN CHAR(11)
    MASKED WITH
    (
        FUNCTION='partial(0,"XXX-XX-",4)'
    )
);

		

Adding a Mask to an Existing Column

			
ALTER TABLE Customers
ALTER COLUMN Email
ADD MASKED
WITH (FUNCTION='email()');

Removing a Mask

			
ALTER TABLE Customers
ALTER COLUMN Email
DROP MASKED;

Granting UNMASK Permission

Privileged users may view actual values.

GRANT UNMASK TO HRManager;

Revoking Permission

REVOKE UNMASK FROM HRManager;

Viewing Mask Definitions

View masking metadata.

			
SELECT *
FROM sys.masked_columns;

Useful during administration and auditing.

DDM with Azure SQL Database

Dynamic Data Masking is fully supported in:

Azure SQL Database
Azure SQL Managed Instance
SQL Server

Azure SQL also provides portal-based configuration through the Azure Portal.

Developers can create masks without writing T-SQL.

Limitations of Dynamic Data Masking

Candidates should understand these limitations.

It Is Not Encryption

Anyone with sufficient permissions can retrieve actual values.

Database Administrators Can View Data

Members of powerful administrative roles can bypass masking.

Cannot Stop Inference Attacks

Users may infer values through repeated queries.

Not Intended for High-Security Scenarios

Highly confidential data should use:

Always Encrypted
Transparent Data Encryption
Row-Level Security
Proper access control

Expressions Return Masked Values

If a masked column is used in expressions, the expression also returns masked results for users without UNMASK permission.

Best Practices

Mask Only Sensitive Columns

Avoid unnecessary masking.

Combine with Other Security Features

Use together with:

Always Encrypted
Row-Level Security
Transparent Data Encryption
Microsoft Entra authentication
Least privilege access

Grant UNMASK Sparingly

Only trusted users should receive this permission.

Test Using Non-Privileged Accounts

Always verify what ordinary users actually see.

Audit Sensitive Access

Monitor who receives UNMASK permissions.

Dynamic Data Masking vs Row-Level Security

Dynamic Data Masking	Row-Level Security
Masks values	Filters rows
User sees all rows	User sees only authorized rows
Protects columns	Protects records
Works with SELECT results	Controls data visibility
Often used with RLS	Often combined with DDM

DP-800 Exam Tips

Candidates should be able to:

Explain what Dynamic Data Masking is.
Differentiate masking from encryption.
Identify supported masking functions.
Create masked columns using CREATE TABLE and ALTER TABLE.
Grant and revoke the UNMASK permission.
Understand when DDM is appropriate.
Recognize DDM limitations.
Choose DDM versus Always Encrypted, TDE, or Row-Level Security based on the security requirement.
Understand that DDM protects against accidental exposure, not malicious users with elevated privileges.

Practice Exam Questions

Question 1

A company wants customer support representatives to view only partially masked Social Security numbers while allowing HR staff to view the full values.

Which SQL Server feature best meets this requirement?

A. Transparent Data Encryption

B. Dynamic Data Masking

C. Always Encrypted

D. Data Compression

Answer: B

Explanation: Dynamic Data Masking displays masked values to unauthorized users while allowing authorized users with the appropriate permissions to see the original data.

Question 2

Which statement about Dynamic Data Masking is true?

A. It encrypts data stored on disk.

B. It permanently changes stored values.

C. It masks query results for users without UNMASK permission.

D. It replaces encryption.

Answer: C

Explanation: Dynamic Data Masking only alters the data presented in query results. The stored values remain unchanged.

Question 3

Which masking function is specifically designed for email addresses?

A. partial()

B. random()

C. default()

D. email()

Answer: D

Explanation: The email() masking function preserves the general format of an email address while obscuring most of the information.

Question 4

Which statement best describes the partial() masking function?

A. It encrypts selected characters.

B. It returns random values.

C. It permanently replaces data.

D. It reveals specified prefix and suffix characters while masking the middle.

Answer: D

Explanation: The partial() function exposes configurable leading and trailing characters while masking the remaining portion of the value.

Question 5

Which permission allows a user to view unmasked data?

A. SELECT

B. CONTROL

C. UNMASK

D. VIEW DEFINITION

Answer: C

Explanation: Users granted the UNMASK permission can view the original values instead of the masked representations.

Question 6

Which system catalog view displays information about masked columns?

A. sys.columns

B. sys.masked_columns

C. sys.tables

D. sys.database_permissions

Answer: B

Explanation: The sys.masked_columns catalog view contains metadata about all columns configured with Dynamic Data Masking.

Question 7

A database administrator wants to protect highly confidential financial information from administrators who manage the database server.

Which technology should be preferred over Dynamic Data Masking?

A. Always Encrypted

B. Dynamic Data Masking

C. Partial masking

D. Random masking

Answer: A

Explanation: Always Encrypted ensures that sensitive data remains encrypted even from database administrators because encryption and decryption occur on the client side.

Question 8

Which statement about Dynamic Data Masking and application code is generally correct?

A. Applications must always be rewritten.

B. DDM requires client-side decryption.

C. Existing queries usually continue to work without modification.

D. Applications cannot access masked tables.

Answer: C

Explanation: Dynamic Data Masking is transparent to most applications, allowing existing queries to function normally while returning masked data when appropriate.

Question 9

A developer executes the following statement:

GRANT UNMASK TO SalesManager;

What is the effect?

A. The SalesManager can modify masked columns.

B. The SalesManager can bypass row-level security.

C. The SalesManager can view original values in masked columns, provided they also have permission to access the data.

D. All users inherit the UNMASK permission.

Answer: C

Explanation: The UNMASK permission allows a user to see unmasked values but does not grant access to data that the user is otherwise unauthorized to read.

Question 10

Which security strategy provides the strongest protection for sensitive database columns?

A. Use only Dynamic Data Masking.

B. Use only Row-Level Security.

C. Use only Transparent Data Encryption.

D. Combine Dynamic Data Masking with encryption, least-privilege access, and other SQL Server security features.

Answer: D

Explanation: Dynamic Data Masking is most effective as part of a layered security strategy that also includes encryption, access controls, auditing, and other SQL Server security features.

Go to the DP-800 Exam Prep Hub main page

Data Governance, Data Security, DP-800, Microsoft Certification August 1, 2026

Design and implement data encryption, including Always Encrypted and column-level encryption (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement data encryption, including Always Encrypted and column-level encryption

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Data encryption is one of the most important security capabilities available in Microsoft SQL Server, Azure SQL Database, Azure SQL Managed Instance, and Microsoft Fabric SQL Database. Encryption helps protect sensitive information such as personally identifiable information (PII), financial records, healthcare data, passwords, and confidential business information from unauthorized access.

For the DP-800: Developing AI-Enabled Database Solutions exam, you should understand not only how to implement encryption, but also when to use different encryption technologies, their limitations, performance implications, and how they interact with applications.

Why Data Encryption Matters

Modern organizations must comply with regulations such as:

GDPR
HIPAA
PCI-DSS
SOC 2
ISO 27001

Encryption protects data against:

Database theft
Unauthorized administrators
Lost backups
Insider threats
Network interception

SQL Server provides multiple encryption technologies, each solving a different security problem.

SQL Server Encryption Technologies

Understanding which technology solves which problem is critical for the exam.

Technology	Protects	Data State
Transparent Data Encryption (TDE)	Database files and backups	At rest
Always Encrypted	Sensitive columns from DBAs and attackers	In use and at rest
Column-Level Encryption	Individual columns	At rest
TLS/SSL	Network traffic	In transit
Dynamic Data Masking	Prevents accidental viewing	Query results
Row-Level Security	Limits rows returned	Query execution

Data at Rest vs Data in Transit vs Data in Use

A common exam objective is understanding these three states.

Data at Rest

Data stored on:

MDF files
LDF files
Backups
Storage disks

Protected using:

TDE
Column encryption
Always Encrypted

Data in Transit

Data traveling:

Client → SQL Server
SQL Server → Application

Protected using:

TLS (SSL)

Data in Use

Data currently being processed inside memory.

Only Always Encrypted protects sensitive data while SQL Server is processing queries.

Transparent Data Encryption (TDE)

Although the objective focuses on Always Encrypted and column-level encryption, you should understand how TDE differs.

TDE encrypts:

Database files
Log files
Backups

Advantages:

No application changes
Easy to enable
Minimal performance overhead

Limitations:

SQL Server decrypts data automatically.
Database administrators can still read data.

TDE protects storage—not the data itself from privileged users.

Column-Level Encryption

Column-level encryption encrypts specific columns inside a table.

Example:

			
CreditCardNumber
SocialSecurityNumber
Salary

Instead of encrypting the whole database, only selected columns are encrypted.

How Column-Level Encryption Works

SQL Server uses encryption functions such as:

ENCRYPTBYKEY
DECRYPTBYKEY
ENCRYPTBYPASSPHRASE
DECRYPTBYPASSPHRASE

Example:

			
OPEN SYMMETRIC KEY CustomerKey
DECRYPTION BY CERTIFICATE CustomerCert;
UPDATE Customers
SET SSN =
ENCRYPTBYKEY(KEY_GUID('CustomerKey'), '123-45-6789');

		

Reading data:

			
SELECT
CONVERT(varchar,
DECRYPTBYKEY(SSN))
FROM Customers;

Encryption Hierarchy

SQL Server uses multiple encryption layers.

			
Service Master Key
        ↓
Database Master Key
        ↓
Certificate
        ↓
Symmetric Key
        ↓
Encrypted Column

		

Each level protects the one below it.

Symmetric Encryption

Uses one key for both:

Encryption
Decryption

Advantages

Fast
Efficient
Best for large datasets

Example

			
Encrypt → Key A
Decrypt → Key A

Asymmetric Encryption

Uses:

Public key
Private key

Advantages

Strong security
Digital signatures

Disadvantages

Slower

Usually used to protect symmetric keys.

Certificates

Certificates often protect symmetric keys.

Example:

			
Certificate
↓
Protects Symmetric Key
↓
Encrypts Customer Data

		

Always Encrypted

Always Encrypted is one of the most important DP-800 topics.

Unlike traditional encryption:

SQL Server never sees the plaintext values.

Encryption occurs inside the client application.

Why Always Encrypted Exists

Imagine a database administrator with full access.

With normal encryption:

DBA can decrypt data.

With Always Encrypted:

DBA cannot read encrypted values.

Only authorized client applications possess the encryption keys.

How Always Encrypted Works

			
Application
↓
Encrypt value
↓
SQL Server stores ciphertext
↓
Application retrieves ciphertext
↓
Application decrypts

		

SQL Server never performs decryption.

Benefits

Protects against:

Curious administrators
Database theft
Backup theft
Cloud administrators
Insider attacks

Key Components

Always Encrypted uses two key types.

Column Master Key (CMK)

Stored outside SQL Server.

Examples:

Windows Certificate Store
Azure Key Vault
Hardware Security Module (HSM)

Purpose:

Protects Column Encryption Keys.

Column Encryption Key (CEK)

Stored inside SQL Server.

Purpose:

Encrypts actual column values.

Hierarchy:

			
CMK
↓
CEK
↓
Encrypted Data

		

Deterministic Encryption

Always produces the same ciphertext for identical values.

Example

			
"Florida"
↓
A91BCD
"Florida"
↓
A91BCD

		

Advantages

Supports:

Equality searches
Joins
GROUP BY
Indexes

Disadvantages

Repeated values are recognizable.

Randomized Encryption

Produces different ciphertext every time.

Example

			
Florida
↓
A91BCD
Florida
↓
XYZ123

		

Advantages

Maximum security.

Disadvantages

Cannot perform:

Equality comparisons
JOIN
GROUP BY
Index lookups

Deterministic vs Randomized

Feature	Deterministic	Randomized
Highest security	No	Yes
Equality search	Yes	No
JOIN	Yes	No
GROUP BY	Yes	No
Index seek	Yes	No

Creating a Column Master Key

Example:

			
CREATE COLUMN MASTER KEY CMK1
WITH
(
KEY_STORE_PROVIDER_NAME =
'MSSQL_CERTIFICATE_STORE',
KEY_PATH =
'CurrentUser/My/123456789'
);

		

Creating a Column Encryption Key

			
CREATE COLUMN ENCRYPTION KEY CEK1
WITH VALUES
(
COLUMN_MASTER_KEY = CMK1,
ALGORITHM = 'RSA_OAEP',
ENCRYPTED_VALUE = ...
);

		

Encrypting a Column

			
CREATE TABLE Customers
(
CustomerID INT,
SSN CHAR(11)
COLLATE Latin1_General_BIN2
ENCRYPTED WITH
(
COLUMN_ENCRYPTION_KEY = CEK1,
ENCRYPTION_TYPE = DETERMINISTIC,
ALGORITHM =
'AEAD_AES_256_CBC_HMAC_SHA_256'
)
);

		

Secure Enclaves

Always Encrypted originally limited many SQL operations.

Secure Enclaves improve functionality by allowing protected computations within a secure hardware-based memory region.

Benefits:

Richer comparisons
Pattern matching
Range queries
In-place encryption
Better performance

Limitations of Always Encrypted

Developers should understand these limitations.

Not all SQL operations are supported.

Some restrictions include:

LIKE (without enclaves)
Pattern matching
Sorting randomized columns
Range comparisons
Certain aggregates
Some conversions

Client Driver Requirements

Always Encrypted requires supported drivers.

Examples:

Microsoft.Data.SqlClient
.NET Framework
ODBC Driver
JDBC Driver

Client drivers perform:

Encryption
Decryption
Key retrieval

Azure Key Vault Integration

A common enterprise deployment stores Column Master Keys inside Azure Key Vault.

Benefits:

Centralized key management
Hardware-backed security
Automatic auditing
Key rotation
Separation of duties

Performance Considerations

Always Encrypted introduces overhead because:

Client encrypts data
Client decrypts data
Keys must be managed
Network payloads increase

However, it provides much stronger protection than standard encryption.

Best Practices

Microsoft recommends:

Encrypt only sensitive columns.
Store CMKs outside SQL Server.
Use Azure Key Vault when possible.
Use deterministic encryption only when querying is required.
Use randomized encryption for maximum confidentiality.
Rotate encryption keys regularly.
Use TLS together with Always Encrypted.
Monitor application performance after enabling encryption.
Test query compatibility before production deployment.

DP-800 Exam Tips

Be prepared to distinguish:

TDE vs Always Encrypted
Column-Level Encryption vs Always Encrypted
Deterministic vs Randomized encryption
CMK vs CEK
Encryption at rest vs in transit vs in use
Azure Key Vault integration
Secure Enclaves
Encryption hierarchy
Performance implications
Client-side versus server-side encryption

Practice Exam Questions

Question 1

A company wants to ensure that database administrators cannot view customers’ Social Security numbers while still allowing applications to access the data. Which encryption technology should be implemented?

A. Transparent Data Encryption (TDE)

B. Dynamic Data Masking

C. Row-Level Security

D. Always Encrypted

Answer: D

Explanation: Always Encrypted performs encryption and decryption on the client side, preventing SQL Server and database administrators from viewing plaintext data.

Question 2

Which key encrypts the actual column data in Always Encrypted?

A. Column Encryption Key

B. Database Master Key

C. Service Master Key

D. Column Master Key

Answer: A

Explanation: The Column Encryption Key (CEK) encrypts the column values. The Column Master Key (CMK) protects the CEK.

Question 3

Which encryption type should you choose if users must frequently search by exact Social Security number?

A. Randomized encryption

B. Transparent Data Encryption

C. Deterministic encryption

D. Dynamic Data Masking

Answer: C

Explanation: Deterministic encryption produces the same ciphertext for identical values, enabling equality searches and index usage.

Question 4

Which SQL Server feature encrypts entire database files and backup files without requiring application changes?

A. Always Encrypted

B. Column-Level Encryption

C. Dynamic Data Masking

D. Transparent Data Encryption

Answer: D

Explanation: Transparent Data Encryption (TDE) encrypts database and backup files, protecting data at rest.

Question 5

Where is the Column Master Key typically stored?

A. Azure Storage Account

B. SQL Server system database

C. TempDB

D. Azure Key Vault or Windows Certificate Store

Answer: D

Explanation: Microsoft recommends storing Column Master Keys outside SQL Server, commonly in Azure Key Vault or the Windows Certificate Store.

Question 6

Which encryption method provides the highest confidentiality for sensitive columns?

A. Deterministic encryption

B. Randomized encryption

C. Transparent Data Encryption

D. TLS encryption

Answer: B

Explanation: Randomized encryption produces different ciphertext for identical values, making frequency analysis much more difficult.

Question 7

A developer wants to encrypt only the CreditCardNumber column while leaving the remainder of the table unchanged. Which approach is most appropriate?

A. Column-Level Encryption

B. Transparent Data Encryption

C. Database snapshots

D. Always On Availability Groups

Answer: A

Explanation: Column-level encryption targets individual columns rather than the entire database.

Question 8

Which SQL Server feature enhances Always Encrypted by allowing additional query operations on encrypted columns?

A. Secure Enclaves

B. Dynamic Data Masking

C. PolyBase

D. Stretch Database

Answer: A

Explanation: Secure Enclaves enable richer computations on encrypted data, including some range and pattern-matching operations.

Question 9

Which data state is protected by TLS encryption?

A. Data at rest

B. Data in transit

C. Data in use

D. Archived data

Answer: B

Explanation: TLS encrypts network communications between clients and SQL Server, protecting data while it is being transmitted.

Question 10

Why is Always Encrypted considered more secure than traditional column-level encryption?

A. It automatically compresses encrypted data.

B. It encrypts entire databases.

C. SQL Server never has access to plaintext values because encryption occurs on the client side.

D. It eliminates the need for encryption keys.

Answer: C

Explanation: Always Encrypted keeps encryption keys and plaintext data outside SQL Server, ensuring that even highly privileged users cannot view sensitive information.

Go to the DP-800 Exam Prep Hub main page

AB-900, AI Governance, AI Security, Data Governance, Data Security, Microsoft Certification June 27, 2026

Understand features and capabilities of SharePoint Advanced Management, including restricted site access (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Understand features and capabilities of SharePoint Advanced Management, including restricted site access

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly rely on Microsoft 365, SharePoint Online, Microsoft Teams, and Microsoft 365 Copilot, protecting organizational data has become more important than ever. While collaboration is essential, unrestricted sharing can expose confidential information to unintended users.

To help organizations better govern SharePoint content, Microsoft offers SharePoint Advanced Management (SAM), a collection of advanced governance, reporting, security, and lifecycle management capabilities designed to improve the security of SharePoint and OneDrive environments.

One of its most important features is Restricted Site Access, which allows administrators to temporarily limit access to specific SharePoint sites that may contain highly sensitive or potentially overshared information.

For the AB-900 exam, you should understand the purpose of SharePoint Advanced Management, its major capabilities, and how Restricted Site Access helps reduce data exposure.

What is SharePoint Advanced Management?

SharePoint Advanced Management is a set of administrative capabilities that extends the standard SharePoint Online administration experience.

Its goals include:

Improving governance
Reducing oversharing
Enhancing visibility into permissions
Strengthening data protection
Supporting Microsoft 365 Copilot readiness
Helping organizations adopt Zero Trust security principles

Rather than replacing Microsoft Purview or Microsoft Defender, SharePoint Advanced Management complements these services by focusing specifically on SharePoint and OneDrive administration.

Why SharePoint Advanced Management Is Important

Organizations often have:

Thousands of SharePoint sites
Millions of documents
Numerous external users
Complex permission structures
Years of accumulated sharing links

As these environments grow, administrators face challenges such as:

Overshared files
Forgotten external sharing
Stale permissions
Sensitive documents accessible by too many users
Inactive or abandoned sites

SharePoint Advanced Management provides tools to identify and address these issues before they become security incidents.

Key Capabilities of SharePoint Advanced Management

SharePoint Advanced Management includes several capabilities designed to improve governance.

1. Data Access Governance Reporting

Administrators can:

Identify overshared sites
Review sharing activity
Analyze permission configurations
Discover external access
Locate high-risk collaboration sites

These reports provide visibility into who can access organizational content.

2. Site Lifecycle Management

Organizations frequently create project sites that remain active long after projects end.

SharePoint Advanced Management helps administrators:

Identify inactive sites
Review site ownership
Archive or delete unused sites
Reduce unnecessary content exposure

Proper lifecycle management reduces security risks while improving overall governance.

3. Oversharing Insights

Administrators can identify:

Sites shared broadly
Anonymous sharing links
Guest access
Sensitive sites with excessive permissions
Large-scale permission inheritance issues

These insights are particularly valuable before deploying Microsoft 365 Copilot.

4. Site Ownership Management

SharePoint sites require responsible owners.

Advanced Management helps administrators identify:

Sites without owners
Inactive owners
Ownership inconsistencies

Proper ownership improves accountability and ensures permissions are reviewed regularly.

5. Sharing Governance

Administrators can evaluate:

External sharing
Anonymous links
Organization-wide access
Sharing policies
Guest permissions

This helps organizations reduce unnecessary collaboration risks.

6. Restricted Site Access

One of the most important SharePoint Advanced Management capabilities is Restricted Site Access.

What is Restricted Site Access?

Restricted Site Access allows administrators to temporarily limit access to a SharePoint site.

When enabled:

Most users lose access to the site.
Only designated administrators or approved users can access the content.
Copilot and Microsoft Search continue to respect the updated permissions because they always honor Microsoft 365 security trimming.

This feature is useful when a site contains highly sensitive information or requires investigation.

Why Use Restricted Site Access?

Organizations may need to immediately reduce access when:

Sensitive information has been overshared.
A security investigation is underway.
Legal or regulatory reviews are occurring.
Confidential merger or acquisition documents are stored.
Human Resources investigations are active.
Executive leadership documents require additional protection.
Sensitive intellectual property is being reviewed.

Rather than deleting the site, administrators can quickly restrict access while remediation occurs.

How Restricted Site Access Works

The feature temporarily changes access behavior by allowing only explicitly authorized users to access the site.

Typical workflow:

Administrator identifies a high-risk site.
Restricted Site Access is enabled.
Only approved users retain access.
Administrators investigate permissions.
Oversharing issues are corrected.
Normal access is restored when appropriate.

Benefits of Restricted Site Access

Organizations gain several advantages:

Rapid Risk Reduction

Potential data exposure is reduced immediately.

Supports Investigations

Investigators can examine permissions without widespread user access.

Improves Governance

Administrators gain time to review sharing settings before reopening access.

Protects Sensitive Information

Highly confidential documents remain accessible only to authorized personnel.

Supports Compliance

Temporary restrictions can assist with legal, regulatory, or internal compliance reviews.

Relationship with Microsoft 365 Copilot

Microsoft 365 Copilot respects Microsoft 365 permissions.

If a site becomes restricted:

Copilot cannot retrieve information from that site for users who no longer have permission.
Microsoft Search also honors the updated permissions.
Other Microsoft 365 services continue using the same security model.

Restricted Site Access therefore reduces the likelihood that Copilot will surface sensitive content from that site.

Relationship with Microsoft Purview

SharePoint Advanced Management and Microsoft Purview work together.

Microsoft Purview focuses on:

Data classification
Sensitivity labels
Data Loss Prevention (DLP)
Insider Risk Management
Data Lifecycle Management
Compliance

SharePoint Advanced Management focuses on:

Site governance
Permissions
Oversharing
Site administration
Access analysis
Restricted Site Access

Together they provide comprehensive protection for Microsoft 365 data.

Relationship with Microsoft Defender

Microsoft Defender identifies threats such as:

Compromised accounts
Suspicious user activity
Malware
Phishing attacks

If Defender identifies suspicious activity involving a SharePoint site, administrators may choose to enable Restricted Site Access while investigating the incident.

Best Practices

Microsoft recommends the following practices:

Regularly review Data Access Governance reports.
Minimize broad “Everyone” permissions.
Review external sharing frequently.
Assign active site owners.
Archive inactive sites.
Apply sensitivity labels to sensitive content.
Use Restricted Site Access only when necessary.
Review restricted sites periodically and restore normal access when appropriate.
Combine SharePoint Advanced Management with Microsoft Purview and Microsoft Defender for layered protection.
Follow the principle of least privilege.

Exam Tips

Remember these key points for the AB-900 exam:

SharePoint Advanced Management focuses on governance and security for SharePoint and OneDrive.
It helps identify and remediate oversharing.
Restricted Site Access temporarily limits access to sensitive SharePoint sites.
Copilot always respects SharePoint permissions, including restricted sites.
Restricted Site Access is useful during investigations or when sensitive information has been overshared.
SharePoint Advanced Management complements Microsoft Purview rather than replacing it.
Proper site ownership and lifecycle management reduce long-term security risks.

Practice Exam Questions

Question 1

Which primary problem does SharePoint Advanced Management help organizations address?

A. Windows operating system updates

B. Oversharing and governance of SharePoint content

C. SQL Server performance tuning

D. Microsoft Teams meeting scheduling

Correct Answer: B

Explanation: SharePoint Advanced Management provides governance tools that help identify oversharing, manage permissions, and improve the security of SharePoint and OneDrive environments.

Question 2

What is the purpose of Restricted Site Access?

A. Permanently delete SharePoint sites

B. Encrypt every document within a site

C. Temporarily limit access to a SharePoint site for authorized users only

D. Automatically archive inactive sites

Correct Answer: C

Explanation: Restricted Site Access allows administrators to temporarily restrict access to a site while investigating or protecting sensitive information.

Question 3

Why is SharePoint Advanced Management valuable before deploying Microsoft 365 Copilot?

A. It increases Copilot response speed.

B. It upgrades Microsoft Graph.

C. It removes all external users automatically.

D. It helps identify overshared content that Copilot could otherwise access based on existing permissions.

Correct Answer: D

Explanation: Since Copilot honors existing permissions, reducing oversharing before deployment helps minimize the risk of exposing sensitive information.

Question 4

Which capability is included in SharePoint Advanced Management?

A. Azure virtual machine backup

B. Microsoft Intune device enrollment

C. Data Access Governance reporting

D. Windows Server patch management

Correct Answer: C

Explanation: Data Access Governance reporting is a core capability that helps administrators analyze permissions and identify overshared content.

Question 5

What happens when Restricted Site Access is enabled?

A. Microsoft 365 Copilot ignores the restriction.

B. Only approved users and administrators retain access to the site.

C. All SharePoint sites become read-only.

D. External sharing is permanently disabled across the tenant.

Correct Answer: B

Explanation: Restricted Site Access limits access to authorized users, and Copilot continues to respect those permissions.

Question 6

Which Microsoft service primarily complements SharePoint Advanced Management by classifying and protecting sensitive information?

A. Microsoft Purview

B. Microsoft Paint

C. Windows Defender Firewall

D. Microsoft Project

Correct Answer: A

Explanation: Microsoft Purview provides data classification, labeling, DLP, and compliance capabilities that complement SharePoint governance features.

Question 7

Which scenario is an appropriate use case for Restricted Site Access?

A. Scheduling recurring Teams meetings

B. Updating Microsoft 365 licenses

C. Protecting a SharePoint site containing confidential merger documents during negotiations

D. Increasing SharePoint storage capacity

Correct Answer: C

Explanation: Restricting access to highly confidential content during sensitive business activities helps reduce the risk of accidental exposure.

Question 8

Which governance activity helps reduce long-term security risks in SharePoint?

A. Creating additional anonymous sharing links

B. Allowing all users full control of every site

C. Disabling Microsoft Search

D. Reviewing inactive sites and assigning active site owners

Correct Answer: D

Explanation: Proper site ownership and lifecycle management reduce abandoned sites and improve ongoing governance.

Question 9

How does Microsoft 365 Copilot interact with a site that has Restricted Site Access enabled?

A. Copilot bypasses the restriction for administrators only.

B. Copilot ignores SharePoint permissions.

C. Copilot respects the updated permissions and cannot retrieve content for unauthorized users.

D. Copilot copies restricted files into Microsoft Graph.

Correct Answer: C

Explanation: Copilot always honors Microsoft 365 permissions. If a user cannot access a restricted site, Copilot cannot use its content in responses for that user.

Question 10

Which statement best describes SharePoint Advanced Management?

A. It replaces Microsoft Purview entirely.

B. It is focused on SharePoint and OneDrive governance, permissions, lifecycle management, and oversharing protection.

C. It functions as an antivirus solution.

D. It manages Microsoft Entra ID authentication policies.

Correct Answer: B

Explanation: SharePoint Advanced Management provides advanced governance capabilities for SharePoint and OneDrive, including oversharing detection, site lifecycle management, permission analysis, and Restricted Site Access.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Governance, AI Security, Data Governance, Microsoft Certification, security June 27, 2026

Run a data access governance report in SharePoint (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Run a data access governance report in SharePoint

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

That is an excellent next topic for the AB-900 exam because it combines SharePoint governance, Microsoft Purview, and Copilot data security. Although the feature continues to evolve, the exam focuses on understanding what the report is, when to use it, and what problems it helps administrators solve, rather than memorizing every UI step.

Why Data Access Governance Matters

One of the largest security challenges in Microsoft 365 is oversharing. Over time, organizations accumulate millions of files, thousands of SharePoint sites, and numerous Microsoft Teams workspaces. Permissions often become increasingly complex as users:

Share files externally
Create anonymous sharing links
Grant access to “Everyone”
Add guests to Teams
Break inheritance on folders
Forget to remove temporary permissions

As organizations adopt Microsoft 365 Copilot, overshared content becomes an even greater concern because Copilot can surface information that a user already has permission to access—even if that access was unintentionally granted.

Microsoft provides Data Access Governance (DAG) capabilities in SharePoint to help administrators discover, understand, and remediate excessive access before it becomes a security issue.

What is Data Access Governance?

Data Access Governance is a collection of reporting and analysis capabilities within SharePoint Advanced Management that helps administrators answer questions such as:

Which sites are accessible by everyone?
Which files are overshared?
Which sites have external users?
Which sites contain highly sensitive information?
Which permissions may expose confidential content?
Which sites should be reviewed?

Rather than examining permissions one site at a time, administrators receive organization-wide visibility.

Primary Goals of Data Access Governance

Data Access Governance helps organizations:

Discover overshared sites
Review permissions
Reduce excessive access
Identify high-risk collaboration
Improve Microsoft 365 security posture
Prepare for Microsoft 365 Copilot deployment
Reduce accidental data exposure
Support compliance initiatives

Why It Is Important for Microsoft 365 Copilot

Microsoft 365 Copilot never ignores permissions.

Instead, it retrieves content using the same security model that governs Microsoft 365.

If a user has permission to open a document manually, Copilot can potentially reference that document when generating responses.

For example:

Suppose Human Resources accidentally grants the entire company read access to salary spreadsheets.

Without Copilot:

Most employees may never discover the files.

With Copilot:

A user might ask:

“Summarize employee compensation data.”

Because the files are already accessible, Copilot could retrieve them.

The problem is not Copilot—it is the underlying permissions.

Data Access Governance helps identify these permission problems before they become security risks.

What the Data Access Governance Report Shows

The report provides administrators with visibility into SharePoint permissions and sharing configurations across the tenant.

Common information includes:

Site owners
Site sensitivity
External sharing status
Number of members
Anonymous links
Organization-wide access
Guest access
Sharing activity
Permission inheritance
Access patterns
High-risk sites
Overshared content indicators

Rather than searching manually, administrators can prioritize the highest-risk locations.

Types of Oversharing That Can Be Identified

The report can identify situations such as:

Organization-wide access

Sites accessible by:

Everyone
Everyone except external users
Large security groups

These sites often expose more content than intended.

Anonymous Links

Files shared through links that require no authentication.

These links may remain active long after they are needed.

Guest Access

Sites containing:

External users
Partner accounts
Vendor accounts

Administrators can verify whether guest access is still appropriate.

Excessive Sharing

Examples include:

Large numbers of shared files
Broad sharing permissions
Public document libraries
Open collaboration spaces

Sensitive Sites

The report can identify sites that contain:

Financial information
HR records
Legal documents
Intellectual property
Customer information

Combined with Microsoft Purview sensitivity labels, administrators gain better visibility into where important information resides.

Typical Workflow

Administrators generally follow this process:

Step 1

Open SharePoint administration tools.

Step 2

Generate or review a Data Access Governance report.

Step 3

Review identified risks.

Examples:

Overshared sites
External sharing
Everyone permissions
Sensitive content

Step 4

Investigate high-risk sites.

Questions include:

Does this access need to exist?
Are guests still required?
Is inheritance broken?
Should permissions be reduced?

Step 5

Take corrective action.

Possible actions include:

Remove permissions
Restrict sharing
Apply sensitivity labels
Disable anonymous links
Reduce guest access
Educate site owners

Step 6

Run reports regularly to verify improvements.

Relationship with Microsoft Purview

Data Access Governance works alongside Microsoft Purview.

Purview answers questions such as:

What sensitive data exists?
How is it classified?
Which labels are applied?
Are DLP policies triggered?

SharePoint Data Access Governance answers:

Who can access the data?
Is the data overshared?
Which sites expose information?
Which permissions should be reviewed?

Together they provide both:

Content awareness
Permission awareness

Relationship with Microsoft 365 Copilot

Data Access Governance helps administrators prepare for Copilot by reducing permission-related risks.

Benefits include:

Finding overshared SharePoint sites
Identifying unnecessary permissions
Reducing broad access
Reviewing guest sharing
Protecting confidential information
Improving search security
Supporting Zero Trust principles

Best Practices

Microsoft recommends that organizations:

Review sharing reports regularly.
Audit external access periodically.
Minimize “Everyone” permissions.
Remove unused guest accounts.
Apply sensitivity labels to important sites.
Use Microsoft Purview DLP alongside SharePoint governance.
Educate site owners on responsible sharing.
Review high-risk collaboration sites before deploying Copilot broadly.
Follow the principle of least privilege.
Continuously monitor permission changes.

Common Exam Tips

Remember these key points:

Data Access Governance focuses on permissions and access, not document content.
It helps identify oversharing across SharePoint.
It is especially valuable before deploying Microsoft 365 Copilot.
Copilot respects existing Microsoft 365 permissions.
Oversharing is a permissions problem, not a Copilot problem.
Reports help administrators prioritize high-risk sites for remediation.
Data Access Governance complements Microsoft Purview rather than replacing it.

Practice Exam Questions

Question 1

Why would an administrator run a Data Access Governance report in SharePoint?

A. To update SharePoint servers

B. To identify overshared sites and permission risks

C. To encrypt all documents automatically

D. To generate Microsoft 365 licenses

Correct Answer: B

Explanation: Data Access Governance helps administrators identify sites with excessive permissions, external sharing, and other access-related risks.

Question 2

Which issue is Data Access Governance primarily designed to identify?

A. SQL database corruption

B. Printer failures

C. Oversharing of SharePoint content

D. Network latency

Correct Answer: C

Explanation: The primary purpose is to detect oversharing and excessive permissions across SharePoint.

Question 3

Why is Data Access Governance especially important before deploying Microsoft 365 Copilot?

A. Copilot automatically changes permissions.

B. Copilot ignores SharePoint security.

C. Copilot copies all SharePoint files.

D. Copilot can reference content users already have permission to access.

Correct Answer: D

Explanation: Copilot honors existing permissions. Overshared content may therefore appear in Copilot responses if users already have legitimate access.

Question 4

Which type of access represents a potential oversharing risk?

A. Anonymous sharing links

B. Azure subscription ownership

C. Exchange mailbox size

D. Microsoft Teams background images

Correct Answer: A

Explanation: Anonymous links allow access without authentication and should be reviewed carefully.

Question 5

What question does Data Access Governance primarily help answer?

A. Which users have excessive access to SharePoint content?

B. Which Windows updates are missing?

C. Which devices need antivirus software?

D. Which Microsoft 365 licenses should be purchased?

Correct Answer: A

Explanation: Data Access Governance focuses on permissions, sharing, and access to SharePoint content.

Question 6

Which Microsoft 365 principle is supported by regularly reviewing Data Access Governance reports?

A. Unlimited collaboration

B. Least privilege

C. Maximum storage allocation

D. Unlimited guest access

Correct Answer: B

Explanation: Regular reviews help ensure users have only the permissions necessary to perform their work.

Question 7

Which type of SharePoint site would likely appear as higher risk in a Data Access Governance report?

A. A private HR site with restricted access

B. A site shared with only one administrator

C. A site containing sensitive files that is accessible to everyone

D. A newly created empty site

Correct Answer: C

Explanation: Sensitive information combined with broad permissions represents a significant oversharing risk.

Question 8

How does Data Access Governance complement Microsoft Purview?

A. Both products only classify documents.

B. Data Access Governance focuses on permissions, while Purview focuses on data protection and governance.

C. They perform identical functions.

D. Purview replaces SharePoint permissions.

Correct Answer: B

Explanation: Purview governs and protects data, while Data Access Governance helps administrators understand who has access to that data.

Question 9

Which action should an administrator consider after identifying an overshared SharePoint site?

A. Delete all documents immediately.

B. Disable Microsoft 365 Copilot.

C. Purchase additional SharePoint storage.

D. Review and reduce unnecessary permissions.

Correct Answer: D

Explanation: The appropriate response is to evaluate existing permissions and remove excessive or unnecessary access while maintaining business needs.

Question 10

Which statement about Microsoft 365 Copilot and Data Access Governance is true?

A. Data Access Governance prevents all Copilot responses.

B. Copilot bypasses SharePoint permissions when generating answers.

C. Data Access Governance helps reduce the risk of Copilot surfacing overshared information by identifying excessive permissions.

D. Copilot encrypts all SharePoint documents before using them.

Correct Answer: C

Explanation: By identifying and remediating overshared permissions, Data Access Governance helps ensure Copilot only surfaces information that users are appropriately authorized to access.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Governance, Data Security, Microsoft Certification, security June 27, 2026

Identify policy violations generated by Communication Compliance (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify policy violations generated by Communication Compliance

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand how Microsoft Purview Communication Compliance helps organizations detect, investigate, and respond to inappropriate communications that may violate corporate policies, legal requirements, or regulatory standards. You should also understand how administrators review policy matches, investigate alerts, and take appropriate remediation actions.

What is Microsoft Purview Communication Compliance?

Microsoft Purview Communication Compliance is a Microsoft Purview solution that helps organizations detect and investigate inappropriate or risky communications across Microsoft 365 services.

Rather than preventing users from communicating, Communication Compliance monitors communications and alerts authorized reviewers when messages match organizational policies.

It helps organizations detect communications involving:

Harassment
Discrimination
Offensive language
Threats
Confidential information sharing
Regulatory violations
Inappropriate behavior
Insider risks

Communication Compliance is designed to reduce legal, compliance, and reputational risks while helping organizations meet industry regulations.

Why Communication Compliance Is Important

Organizations communicate constantly using:

Microsoft Teams chats
Teams channel messages
Outlook emails
Viva Engage (Yammer)
Third-party communication platforms (through supported connectors)

Without monitoring, inappropriate communications may:

Create hostile work environments
Lead to lawsuits
Violate government regulations
Expose confidential information
Damage an organization’s reputation

Communication Compliance provides visibility into these risks.

What Are Policy Violations?

A policy violation occurs when a communication matches conditions defined within a Communication Compliance policy.

Examples include:

Use of offensive language
Bullying or harassment
Sharing confidential customer information
Threatening another employee
Insider trading discussions
Regulatory compliance violations
Sharing protected intellectual property

A policy violation does not automatically mean misconduct occurred.

Instead, it means the communication requires human review.

How Communication Compliance Works

The workflow follows several stages.

Step 1: Create a Policy

Administrators create policies that define:

Users or groups to monitor
Communication locations
Types of violations
Detection conditions
Review workflow

Step 2: Monitor Communications

Communication Compliance continuously analyzes supported communications.

Examples include:

Teams messages
Emails
Viva Engage posts

Content is evaluated against policy conditions.

Step 3: Generate Alerts

If content matches a policy:

An alert is generated.
The alert appears in the Communication Compliance dashboard.
Reviewers receive notification.

Step 4: Human Review

Authorized reviewers investigate:

Original message
Conversation context
Users involved
Severity
Previous incidents

Reviewers determine whether the communication truly violated policy.

Step 5: Resolution

Reviewers choose an appropriate action, such as:

Resolve as compliant
Confirm violation
Escalate investigation
Notify HR
Notify legal
Train employee
Document findings

Common Types of Policy Violations

Harassment

Detects communications containing:

Insults
Bullying
Abusive language
Threats

Example:

“You’re completely useless and should quit.”

Discrimination

Detects language involving:

Race
Gender
Religion
Disability
Age
Protected characteristics

Offensive Language

Identifies:

Profanity
Hate speech
Offensive expressions

Sensitive Information Sharing

Detects messages containing:

Credit card numbers
Social Security numbers
Customer information
Financial records
Medical information

Regulatory Compliance Violations

Organizations in regulated industries monitor communications involving:

Insider trading
Market manipulation
Financial misconduct
Unauthorized disclosures

Confidential Information

Detects unauthorized sharing of:

Trade secrets
Product designs
Internal reports
Source code
Financial forecasts

Policy Alerts

A Communication Compliance alert contains information such as:

Policy name
Date and time
Severity
User involved
Communication type
Matched rule
Review status

Alerts help reviewers prioritize investigations.

Alert Severity

Organizations often classify alerts as:

Low

Minor language concerns.

Example:

A mildly inappropriate joke.

Medium

Behavior that may violate company policy.

Example:

Repeated offensive language.

High

Serious compliance concern.

Example:

Threats of violence or disclosure of confidential data.

Reviewing Policy Violations

Authorized reviewers access the Communication Compliance portal.

During review they can examine:

Conversation history
Message participants
Attachments
Policy triggered
Matching keywords
Previous incidents
Related alerts

Context is important because individual messages may appear harmless without surrounding conversation.

Investigation Workflow

A typical investigation includes:

Open the alert.
Review message details.
Examine conversation context.
Determine whether policy was actually violated.
Assign a review outcome.
Document findings.
Close or escalate the case.

Possible Review Outcomes

Reviewers may classify alerts as:

No violation
Violation confirmed
Needs escalation
False positive
Resolved

These outcomes help improve future policy effectiveness.

False Positives

Not every alert represents an actual violation.

Examples include:

Educational discussions
Medical terminology
Technical documentation
Quoted material
Sarcasm
Context misunderstood by automated analysis

Human review remains essential.

Improving Detection Accuracy

Organizations can improve policy effectiveness by:

Updating keyword dictionaries
Using machine learning classifiers
Adjusting policy thresholds
Creating separate policies for departments
Reviewing false positives
Refining monitored user groups

Who Reviews Violations?

Communication Compliance uses role-based access control.

Typical reviewers include:

Compliance administrators
Compliance officers
Human Resources
Legal teams
Risk investigators

Only authorized personnel can review sensitive communications.

Privacy Considerations

Communication Compliance is designed with privacy controls.

Organizations can:

Limit reviewer access
Use pseudonymization (where supported)
Restrict investigations
Audit reviewer actions
Follow regional privacy laws

Integration with Other Microsoft Security Solutions

Communication Compliance works alongside several Microsoft security solutions.

Microsoft Purview Insider Risk Management

Communication Compliance findings may support insider risk investigations involving suspicious employee behavior.

Microsoft Purview Data Loss Prevention (DLP)

DLP prevents unauthorized sharing of sensitive information, while Communication Compliance reviews the content and context of communications.

Microsoft Purview Information Protection

Sensitivity labels applied to documents help reviewers understand the sensitivity of shared information.

Microsoft Defender

Security incidents and user risk signals can complement Communication Compliance investigations.

Communication Compliance and Microsoft 365 Copilot

As organizations adopt Microsoft 365 Copilot, Communication Compliance remains important because users increasingly collaborate through Teams, Outlook, and other Microsoft 365 services that Copilot can reference based on existing permissions.

If inappropriate communications occur, Communication Compliance can:

Detect policy violations
Assist investigations
Support regulatory compliance
Help protect organizational reputation
Complement broader Microsoft Purview governance capabilities

Best Practices

For the AB-900 exam, remember these best practices:

Monitor communications using clearly defined policies.
Review alerts promptly.
Always investigate message context before making decisions.
Use authorized reviewers only.
Tune policies to reduce false positives.
Protect employee privacy while maintaining compliance.
Integrate Communication Compliance with broader Microsoft Purview governance.

AB-900 Exam Tips

Remember these key points:

Communication Compliance monitors communications—it does not block them.
Policy violations generate alerts, not automatic disciplinary actions.
Human reviewers determine whether a true violation occurred.
Context matters when reviewing communications.
Communication Compliance supports compliance, legal, HR, and risk management teams.
Alerts can detect harassment, discrimination, offensive language, regulatory violations, and sensitive information sharing.
Communication Compliance works together with Insider Risk Management, DLP, Information Protection, and Microsoft Defender.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Communication Compliance?

A. Encrypt all Microsoft Teams messages

B. Detect and investigate communications that may violate organizational policies

C. Prevent users from sending emails

D. Back up Microsoft 365 communications

Correct Answer: B

Explanation: Communication Compliance monitors supported communications and generates alerts when messages match configured compliance policies.

Question 2

A Communication Compliance alert indicates that a Teams message matched a harassment policy. What should happen next?

A. The user account is automatically disabled.

B. The message is permanently deleted.

C. An authorized reviewer investigates the communication.

D. The policy is automatically removed.

Correct Answer: C

Explanation: Communication Compliance generates alerts for human review rather than taking automatic disciplinary actions.

Question 3

Which type of communication can Microsoft Purview Communication Compliance monitor?

A. BIOS startup messages

B. Local Windows Event Logs

C. Microsoft Teams chats

D. Printer configuration files

Correct Answer: C

Explanation: Teams chats are one of the primary communication sources monitored by Communication Compliance.

Question 4

Why is conversation context important when reviewing alerts?

A. It determines network bandwidth.

B. It identifies device drivers.

C. It encrypts communications.

D. It helps reviewers determine whether a message truly violates policy.

Correct Answer: D

Explanation: Individual messages may appear inappropriate when viewed alone but may be acceptable within the full conversation.

Question 5

Which activity is an example of a Communication Compliance policy violation?

A. Updating Windows patches

B. Sharing vacation schedules

C. Sending offensive or harassing messages to coworkers

D. Resetting a forgotten password

Correct Answer: C

Explanation: Offensive or harassing communications are common scenarios monitored by Communication Compliance.

Question 6

Who should review Communication Compliance alerts?

A. Any employee

B. Only authorized compliance reviewers

C. External customers

D. Guest users

Correct Answer: B

Explanation: Access to Communication Compliance investigations is limited through role-based access control.

Question 7

What is a false positive in Communication Compliance?

A. A communication incorrectly identified as violating policy

B. A deleted user account

C. An expired Microsoft 365 license

D. A successful malware scan

Correct Answer: A

Explanation: False positives occur when automated detection flags communications that are ultimately determined not to violate policy.

Question 8

Which Microsoft Purview solution focuses primarily on preventing sensitive information from leaving the organization?

A. Communication Compliance

B. Insider Risk Management

C. Data Loss Prevention (DLP)

D. Compliance Manager

Correct Answer: C

Explanation: DLP is designed to detect and prevent unauthorized sharing of sensitive information, while Communication Compliance focuses on reviewing communications.

Question 9

What does a Communication Compliance alert indicate?

A. A confirmed policy violation requiring disciplinary action

B. A communication matched a configured policy and should be reviewed

C. The user’s account has been compromised

D. Microsoft 365 licensing has expired

Correct Answer: B

Explanation: Alerts indicate potential policy matches that require investigation; they are not proof of wrongdoing.

Question 10

Which statement best describes Microsoft Purview Communication Compliance?

A. It replaces antivirus software.

B. It automatically blocks every risky message.

C. It permanently archives all Microsoft 365 files.

D. It helps organizations identify, investigate, and respond to inappropriate communications.

Correct Answer: D

Explanation: Communication Compliance helps organizations manage communication-related compliance risks through monitoring, alerting, investigation, and response.

Go to the AB-900 Exam Prep Hub main page

AB-900, Data Governance, Microsoft Certification, security June 27, 2026

Identify and respond to alerts generated by Microsoft Purview Data Loss Prevention (DLP) (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify and respond to alerts generated by Microsoft Purview Data Loss Prevention (DLP)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft Purview Data Loss Prevention (DLP) helps organizations prevent the accidental or intentional exposure of sensitive information. DLP continuously monitors user activities across Microsoft 365 services and generates alerts when users violate data protection policies.

For the AB-900 exam, you should understand:

What Microsoft Purview DLP alerts are
When DLP alerts are generated
How administrators review alerts
Alert severity and prioritization
Investigation workflows
How to respond to DLP alerts
Integration with other Microsoft Purview and Microsoft Defender solutions
Best practices for managing alerts

What Is Microsoft Purview Data Loss Prevention (DLP)?

Microsoft Purview Data Loss Prevention (DLP) is a Microsoft Purview solution that helps organizations identify, monitor, and protect sensitive information from unauthorized sharing or exposure.

DLP policies monitor data stored in Microsoft 365 services such as:

Microsoft Exchange Online
Microsoft SharePoint Online
Microsoft OneDrive for Business
Microsoft Teams
Microsoft Defender for Cloud Apps
Endpoint devices (with Endpoint DLP)
Power BI (supported scenarios)

When a user performs an action that violates a DLP policy, the system can generate an alert.

What Is a DLP Alert?

A DLP alert is a notification generated when a DLP policy detects activity that violates organizational data protection rules.

Alerts help administrators:

Detect risky user behavior
Investigate policy violations
Respond to incidents quickly
Reduce data leakage
Demonstrate compliance

Alerts are one of the primary tools compliance administrators use to monitor organizational data protection.

When Are DLP Alerts Generated?

Alerts are generated when users perform actions that violate configured DLP policies.

Examples include:

Emailing confidential documents externally
Uploading sensitive files to unauthorized cloud storage
Copying protected files to USB devices
Printing highly confidential documents
Sharing files publicly
Downloading sensitive files from SharePoint
Copying confidential information into unmanaged applications

Not every policy generates an alert. Alert generation depends on the configured policy actions.

How DLP Detects Sensitive Information

Before generating alerts, DLP identifies sensitive content using several methods.

Sensitive Information Types (SITs)

Built-in detectors identify information such as:

Credit card numbers
Social Security numbers
Passport numbers
Driver’s license numbers
Bank account numbers
Tax identification numbers
Healthcare identifiers

Sensitivity Labels

Microsoft Purview Information Protection labels can identify:

Public
General
Confidential
Highly Confidential

Policies can generate alerts whenever protected documents are shared improperly.

Trainable Classifiers

Machine learning can recognize documents such as:

Resumes
Contracts
Source code
Financial reports
Legal documents

Exact Data Match (EDM)

Organizations can detect exact records such as:

Customer databases
Employee IDs
Payroll records

Components of a DLP Alert

Each alert contains detailed information to help administrators investigate the incident.

Typical alert details include:

User involved
Date and time
Policy name
Rule triggered
Sensitive information detected
File name
File location
Service involved
Severity level
User activity
Recommended actions

Alert Severity

DLP alerts are assigned severity levels to help prioritize investigations.

Typical levels include:

Low

Examples:

Minor policy violations
First-time incidents
Low-risk data exposure

Medium

Examples:

Multiple policy violations
Larger quantities of sensitive information
Repeated risky behavior

High

Examples:

Large-scale data exfiltration
Highly confidential information
Repeated attempts to bypass policies
Executive or privileged account violations

Administrators generally investigate High severity alerts first.

Reviewing DLP Alerts

Administrators review alerts in the Microsoft Purview portal.

The alert dashboard allows administrators to:

View all active alerts
Filter alerts
Search alerts
Sort by severity
Review alert details
Assign alerts
Track investigation status

Information Available During Investigation

Selecting an alert provides additional information.

Examples include:

User Information

Username
Department
Device
Location

Activity Timeline

Investigators can review:

File creation
Downloads
Sharing
Email activity
Printing
USB transfers

Policy Information

The alert identifies:

Which DLP policy triggered
Which rule matched
Sensitive information detected
Confidence level

File Details

Investigators may see:

File name
Location
File owner
Label applied
Number of sensitive items detected

Responding to DLP Alerts

After reviewing an alert, administrators choose an appropriate response.

Possible actions include:

Close the Alert

If the activity is determined to be legitimate or a false positive.

Investigate Further

Review:

User behavior
Related alerts
Audit logs
Endpoint activities

Escalate

Escalate high-risk alerts to:

Security teams
Compliance officers
Legal departments
Human Resources

Adjust Policies

If alerts indicate:

Too many false positives
Policy gaps
Incorrect thresholds

Administrators can modify DLP policies accordingly.

Educate Users

Many violations are accidental.

Organizations often:

Notify users
Provide training
Improve awareness

User Notifications (Policy Tips)

Instead of immediately blocking users, DLP can display Policy Tips.

Policy Tips inform users that:

Sensitive information was detected
Their action violates policy
They should modify their behavior

Examples include:

“This email contains confidential information.”
“Sharing this document externally violates company policy.”

Policy Tips reduce accidental violations.

Alert Lifecycle

A typical DLP alert progresses through several stages.

Sensitive data is detected.
DLP policy evaluates the activity.
Alert is generated.
Administrator reviews the alert.
Investigation begins.
Response action is taken.
Alert is closed.

Integration with Microsoft Purview Solutions

DLP works closely with other Microsoft Purview capabilities.

Microsoft Purview Information Protection

Sensitivity labels provide additional context for DLP decisions.

Example:

A “Highly Confidential” document shared externally generates a higher-priority alert.

Microsoft Purview Insider Risk Management

Repeated DLP violations can contribute to insider risk investigations.

Example:

An employee repeatedly emailing confidential documents externally may trigger both DLP and Insider Risk Management alerts.

Microsoft Purview Audit

Audit logs provide additional evidence.

Investigators can review:

File access
Sharing history
Administrative changes
User activities

Microsoft Purview Compliance Manager

Compliance Manager helps organizations improve their compliance posture by recommending controls that reduce DLP-related risks.

Integration with Microsoft Defender

DLP integrates with Microsoft Defender solutions.

Examples include:

Endpoint DLP
Microsoft Defender for Endpoint
Microsoft Defender for Cloud Apps

These integrations provide additional context, including:

Device information
Endpoint activities
Application usage
USB activity
Browser uploads

Common DLP Alert Scenarios

Scenario 1

A user emails a spreadsheet containing hundreds of customer credit card numbers to a personal Gmail account.

Result:

A High severity DLP alert is generated.

Scenario 2

An employee uploads payroll records to an unauthorized cloud storage provider.

Result:

A DLP alert identifies unauthorized data movement.

Scenario 3

A contractor copies confidential engineering documents onto a USB drive.

Result:

Endpoint DLP generates an alert.

Scenario 4

A user attempts to publicly share a SharePoint folder containing confidential HR records.

Result:

The sharing attempt triggers a DLP alert.

Best Practices

Organizations should:

Create well-designed DLP policies
Use sensitivity labels
Enable Policy Tips
Review alerts regularly
Prioritize High severity alerts
Investigate repeated violations
Reduce false positives through policy tuning
Integrate DLP with Insider Risk Management
Monitor trends over time
Train users on proper data handling

Exam Tips

For the AB-900 exam, remember the following:

DLP alerts are generated when users violate DLP policies.
Alerts help administrators detect potential data leakage.
Alerts contain details about users, files, policies, and detected sensitive information.
Severity levels help prioritize investigations.
Administrators can investigate, escalate, close, or remediate alerts.
DLP integrates with Microsoft Purview Information Protection, Insider Risk Management, Audit, Compliance Manager, and Microsoft Defender.
Policy Tips help reduce accidental policy violations.
Endpoint DLP extends protection to Windows devices.

10 Practice Exam Questions

Question 1

A user attempts to email a document containing multiple credit card numbers to an external recipient. A Microsoft Purview DLP policy blocks the email.

What additional action can the policy perform?

A. Remove the user’s Microsoft 365 license

B. Disable the user’s account

C. Delete the user’s mailbox

D. Automatically create a DLP alert for administrators

Correct Answer: D

Explanation: DLP policies can generate alerts whenever sensitive information triggers configured policy rules, allowing administrators to investigate the incident.

Question 2

Which information is typically included in a Microsoft Purview DLP alert?

A. The organization’s annual revenue

B. The user involved, policy triggered, sensitive information detected, and activity details

C. The user’s payroll information

D. The organization’s Active Directory schema

Correct Answer: B

Explanation: DLP alerts include detailed information such as the user, file, policy, rule, sensitive information detected, and the action that triggered the alert.

Question 3

An administrator wants to focus first on the most critical potential data leakage incidents.

Which alert characteristic should they prioritize?

A. Oldest alert

B. Alphabetical order

C. Alert severity

D. File size

Correct Answer: C

Explanation: Alert severity (Low, Medium, High) helps administrators prioritize investigations based on potential business impact.

Question 4

What is the primary purpose of Policy Tips in Microsoft Purview DLP?

A. Replace DLP policies

B. Notify users that their actions may violate data protection policies

C. Automatically encrypt all files

D. Prevent administrators from reviewing alerts

Correct Answer: B

Explanation: Policy Tips educate users in real time about potential policy violations, reducing accidental exposure of sensitive information.

Question 5

Which Microsoft Purview solution commonly works with DLP by applying sensitivity labels to documents?

A. Microsoft Purview Information Protection

B. Microsoft Intune

C. Microsoft Planner

D. Microsoft Bookings

Correct Answer: A

Explanation: Information Protection applies sensitivity labels that DLP can use when evaluating and protecting sensitive content.

Question 6

What is an appropriate response after reviewing a DLP alert that is determined to be a false positive?

A. Delete the user’s Microsoft account

B. Close the alert and, if necessary, refine the DLP policy

C. Block all external email permanently

D. Remove all DLP policies

Correct Answer: B

Explanation: Administrators should close false-positive alerts and may adjust policy conditions to reduce unnecessary alerts.

Question 7

Which scenario is most likely to generate a High severity DLP alert?

A. A user changes their Teams profile picture

B. A user updates a calendar meeting

C. A user downloads a public marketing brochure

D. A user sends a file containing hundreds of customer Social Security numbers to a personal email account

Correct Answer: D

Explanation: Attempting to send large amounts of highly sensitive personal information externally is a common High severity DLP event.

Question 8

Which Microsoft solution provides additional endpoint information, such as USB activity, that can complement DLP investigations?

A. Microsoft Defender for Endpoint

B. Microsoft Word

C. Microsoft Visio

D. Microsoft Lists

Correct Answer: A

Explanation: Microsoft Defender for Endpoint provides endpoint telemetry that enhances DLP investigations, especially for Endpoint DLP scenarios.

Question 9

What is the first event that typically occurs in the DLP alert lifecycle?

A. An administrator closes the alert

B. A DLP policy detects sensitive information during a monitored user activity

C. Human Resources opens an investigation

D. The user account is suspended

Correct Answer: B

Explanation: The process begins when DLP identifies sensitive information and evaluates the activity against configured policies. If a violation is detected, an alert can be generated.

Question 10

Why would an organization integrate Microsoft Purview Insider Risk Management with DLP?

A. To replace all DLP policies

B. To reduce Microsoft 365 licensing costs

C. To correlate repeated DLP violations with broader patterns of risky user behavior

D. To manage Windows software updates

Correct Answer: C

Explanation: Insider Risk Management can use repeated DLP incidents as signals when identifying users who may present elevated insider risks, helping investigators understand behavior patterns rather than isolated events.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Governance, Data Governance, Data Security, Microsoft Certification June 27, 2026

Identify sensitive information by using Microsoft Purview Data Explorer (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify sensitive information by using Microsoft Purview Data Explorer

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly rely on Microsoft 365 and Microsoft 365 Copilot, understanding where sensitive information resides has become a critical governance and security requirement. Sensitive data such as credit card numbers, Social Security numbers, health records, financial information, intellectual property, and confidential business documents can create significant compliance and security risks if not properly managed.

Microsoft Purview Data Explorer helps organizations discover, analyze, and understand sensitive information stored across Microsoft 365 services. It provides visibility into the location, volume, and classification of sensitive data, enabling administrators to make informed decisions about data protection, governance, compliance, and Copilot readiness.

For the AB-900 exam, you should understand the purpose of Data Explorer, how it identifies sensitive information, the types of information it can discover, and how organizations use its insights to reduce compliance and governance risks.

What Is Microsoft Purview Data Explorer?

Microsoft Purview Data Explorer is a reporting and investigation tool within Microsoft Purview that helps administrators visualize and analyze sensitive data across Microsoft 365 environments.

Data Explorer enables organizations to:

Discover sensitive information
Understand where sensitive data is stored
Analyze data classification results
Identify compliance risks
Support data governance initiatives
Validate Microsoft Purview policy effectiveness
Improve Microsoft 365 Copilot readiness

Rather than protecting data directly, Data Explorer provides visibility into an organization’s data landscape so administrators can take appropriate actions.

Why Data Discovery Is Important

Organizations often accumulate large amounts of data over time. Without visibility into that data, administrators may not know:

What sensitive information exists
Where the information is stored
Who has access to it
Whether it is properly protected
Whether regulatory requirements are being met

For example:

Customer records may contain personally identifiable information (PII).
Financial documents may contain account numbers.
Healthcare records may contain protected health information (PHI).
Contracts may contain confidential business information.

Data Explorer helps identify these risks before they become security or compliance issues.

How Data Explorer Works

Data Explorer analyzes Microsoft 365 content using classification technologies available in Microsoft Purview.

The system scans content stored in supported locations and identifies:

Sensitive information types
Sensitivity labels
Trainable classifiers
Retention labels
Data classifications

The results are then presented through visual dashboards and detailed reports.

Administrators can use these reports to understand the organization’s sensitive data footprint.

Data Sources Analyzed by Data Explorer

Data Explorer can analyze content across Microsoft 365 services, including:

SharePoint Online

Examples:

Documents
Team sites
Department sites
Project repositories

OneDrive for Business

Examples:

Personal work files
Shared documents
Business records

Exchange Online

Examples:

Email messages
Attachments
Mailbox content

Microsoft Teams

Examples:

Shared files
Team documents
Collaboration content

These locations often contain the information that Microsoft 365 Copilot accesses when generating responses.

Sensitive Information Types (SITs)

One of the primary ways Data Explorer identifies sensitive information is through Sensitive Information Types (SITs).

Sensitive Information Types are predefined patterns that identify specific categories of sensitive data.

Examples include:

Social Security Numbers
Credit Card Numbers
Driver’s License Numbers
Passport Numbers
Tax Identification Numbers
Bank Account Numbers
Healthcare Information

Microsoft provides hundreds of built-in sensitive information types.

Organizations can also create custom sensitive information types.

Trainable Classifiers

Data Explorer can also identify information using trainable classifiers.

Unlike pattern matching, trainable classifiers use machine learning to recognize content based on context.

Examples include:

Resumes
Contracts
Invoices
Financial documents
Source code
Intellectual property

This helps organizations classify content that may not contain obvious patterns such as account numbers or IDs.

Sensitivity Labels and Data Explorer

Organizations often use sensitivity labels to classify and protect information.

Examples of labels include:

Public
General
Confidential
Highly Confidential

Data Explorer can show:

Which files have sensitivity labels
Label distribution across the organization
Unlabeled sensitive content
Areas where additional labeling may be needed

This visibility helps improve data governance and security.

Retention Labels and Data Explorer

Retention labels determine how long content should be retained and when it should be deleted.

Data Explorer can help organizations understand:

Which files have retention labels
Which files lack retention labels
Data that may require retention controls
Potential records management gaps

Data Classification Overview

Data classification is the process of identifying and categorizing information according to its sensitivity and business value.

Data Explorer supports classification efforts by helping organizations:

Locate sensitive data
Understand risk exposure
Apply appropriate protections
Improve compliance programs

The classification process typically includes:

Discover data
Classify data
Protect data
Monitor data
Govern data

Data Explorer primarily supports the discovery and analysis phases.

Visualizations and Reporting

Data Explorer provides dashboards and reports that help administrators quickly understand sensitive data trends.

Reports can show:

Number of sensitive items
Sensitive information types detected
Label usage
Data locations
Content trends
Classification coverage

These visualizations help administrators identify areas requiring additional protection.

Data Explorer and Microsoft 365 Copilot

Data Explorer plays an important role in Copilot readiness assessments.

Because Microsoft 365 Copilot uses existing permissions and accesses organizational data through Microsoft Graph, organizations should understand what data exists before deploying Copilot broadly.

Data Explorer helps identify:

Overexposed sensitive data
Unclassified content
Excessively shared files
Confidential documents lacking protection
Data governance gaps

Administrators can use these insights to improve security before expanding Copilot adoption.

Common Governance Risks Identified by Data Explorer

Unlabeled Sensitive Data

Sensitive documents may exist without sensitivity labels.

Risk:

Users may accidentally share confidential information.

Recommended Action:

Apply sensitivity labels.

Excessive Data Exposure

Sensitive files may be accessible to too many users.

Risk:

Unauthorized access.

Recommended Action:

Review permissions and sharing settings.

Missing Retention Controls

Important records may lack retention policies.

Risk:

Regulatory violations.

Recommended Action:

Implement retention labels and policies.

Sensitive Data in Unexpected Locations

Data may be stored outside approved repositories.

Risk:

Governance challenges.

Recommended Action:

Review storage practices and apply controls.

Relationship with Other Microsoft Purview Solutions

Data Explorer works alongside other Microsoft Purview solutions.

Information Protection

Provides:

Sensitivity labels
Encryption
Classification

Data Explorer shows where protected and unprotected content exists.

Data Loss Prevention (DLP)

Provides:

Policy enforcement
Data movement restrictions

Data Explorer helps identify data that may require DLP protection.

Insider Risk Management

Provides:

Risk detection
Insider threat analysis

Data Explorer helps identify sensitive data that could be targeted.

Compliance Manager

Provides:

Compliance assessments
Risk reduction recommendations

Data Explorer provides visibility into the data that compliance programs are designed to protect.

Benefits of Using Data Explorer

Organizations use Data Explorer to:

Discover sensitive information
Improve data governance
Support regulatory compliance
Prepare for Copilot deployment
Validate classification strategies
Identify protection gaps
Reduce organizational risk
Improve visibility into data assets

Key Exam Tips

For the AB-900 exam, remember the following:

Data Explorer helps organizations discover and analyze sensitive information.
It provides visibility into sensitive data locations across Microsoft 365.
Sensitive Information Types identify structured sensitive data such as Social Security numbers and credit card numbers.
Trainable classifiers identify content based on context and machine learning.
Data Explorer supports governance, compliance, and Copilot readiness initiatives.
It helps identify unlabeled, unprotected, or overexposed sensitive information.
Data Explorer is primarily a discovery and analysis tool, not a protection or enforcement tool.
Data Explorer works with sensitivity labels, retention labels, DLP, and other Microsoft Purview solutions.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Data Explorer?

A. Generate AI responses for users

B. Discover and analyze sensitive information across Microsoft 365

C. Encrypt all organizational files

D. Replace Microsoft Defender

Answer: B

Explanation: Data Explorer is designed to help organizations discover, analyze, and understand sensitive information stored across Microsoft 365 services.

Question 2

Which Microsoft 365 service can be analyzed by Data Explorer?

A. SharePoint Online

B. Windows Server

C. Hyper-V

D. Microsoft Intune only

Answer: A

Explanation: Data Explorer can analyze content stored in SharePoint Online, OneDrive, Exchange Online, Teams, and other supported Microsoft 365 locations.

Question 3

What is a Sensitive Information Type (SIT)?

A. A method for creating Teams meetings

B. A licensing model for Microsoft Purview

C. A predefined pattern used to identify sensitive information

D. A backup technology

Answer: C

Explanation: Sensitive Information Types are predefined detectors that identify sensitive data such as Social Security numbers and credit card numbers.

Question 4

Which technology helps identify content such as contracts and resumes using context rather than pattern matching?

A. DLP policies

B. Retention labels

C. Sensitivity labels

D. Trainable classifiers

Answer: D

Explanation: Trainable classifiers use machine learning and contextual analysis to identify document types such as contracts, resumes, and invoices.

Question 5

An administrator wants to determine whether confidential files lack sensitivity labels. Which tool should they use?

A. Microsoft Planner

B. Microsoft Lists

C. Microsoft Purview Data Explorer

D. Microsoft Whiteboard

Answer: C

Explanation: Data Explorer can identify sensitive content and show whether appropriate sensitivity labels have been applied.

Question 6

Which statement best describes Data Explorer?

A. It automatically blocks all file sharing.

B. It discovers and reports on sensitive information.

C. It replaces retention policies.

D. It automatically deletes noncompliant content.

Answer: B

Explanation: Data Explorer focuses on visibility and analysis rather than directly enforcing protection actions.

Question 7

Why is Data Explorer valuable before deploying Microsoft 365 Copilot broadly?

A. It upgrades Copilot licenses.

B. It improves Teams meeting quality.

C. It increases mailbox storage.

D. It helps identify sensitive or overexposed data that Copilot could potentially access.

Answer: D

Explanation: Understanding data exposure and classification gaps helps organizations prepare for secure Copilot adoption.

Question 8

Which item would most likely be identified through a built-in Sensitive Information Type?

A. A company strategy presentation

B. A software design diagram

C. A credit card number

D. A project timeline

Answer: C

Explanation: Sensitive Information Types are designed to detect structured data such as credit card numbers, passport numbers, and Social Security numbers.

Question 9

What governance risk might Data Explorer help identify?

A. Unlabeled sensitive documents

B. Printer driver issues

C. Network latency

D. Browser compatibility problems

Answer: A

Explanation: Data Explorer helps identify sensitive content that lacks classification or protection controls.

Question 10

How does Data Explorer support data governance?

A. By replacing all security controls

B. By automatically enforcing compliance regulations

C. By eliminating the need for sensitivity labels

D. By providing visibility into sensitive data and classification coverage

Answer: D

Explanation: Data Explorer supports governance efforts by helping organizations understand where sensitive information exists and whether appropriate classifications and protections are in place.

Exam Summary

Microsoft Purview Data Explorer is a discovery and analysis tool that helps organizations identify sensitive information across Microsoft 365. It uses Sensitive Information Types, trainable classifiers, sensitivity labels, and retention labels to provide visibility into data risks and governance gaps. Data Explorer is particularly important for compliance initiatives and Microsoft 365 Copilot readiness because it helps organizations understand what sensitive information exists, where it is stored, and whether it is properly protected. Understanding how Data Explorer identifies and reports sensitive information is an important objective for the AB-900 certification exam.

Go to the AB-900 Exam Prep Hub main page

AI, AI Strategy, Analytics, Artificial Intelligence (AI), Business Intelligence, Data Engineering, Data Governance, Data Science, Natural Language Processing (NLP) April 25, 2026

How AI Is Changing Analytics (and How It Isn’t) — A Power BI and Modern Analytics Perspective

If you use Power BI or other modern data platforms today, you don’t have to look far to see AI everywhere:

Copilot inside Power BI and Fabric
Natural language Q&A visuals
Auto-generated DAX and measures
Smart narratives
Automated insights
Forecasting visuals
AutoML in Fabric
AI-assisted data prep

It may appear like analytics is becoming fully automated.

In reality, what’s happening is more nuanced.

AI is reshaping how analytics teams work — but it hasn’t replaced the fundamentals that actually make analytics valuable.

Let’s look at both sides through the lens of Power BI and today’s analytics stack.

How AI Is Changing Analytics

1. Power BI Is Becoming an “Analytics Co-Pilot”

With Copilot and built-in AI features, Power BI increasingly behaves like a smart assistant.

You can now:

Generate report pages from prompts
Create measures using natural language
Ask Copilot to explain DAX
Get auto-generated summaries of visuals
Build starter models and layouts

Instead of starting from a blank canvas, analysts can begin with a rough first draft produced by AI.

This doesn’t eliminate the need for modeling or design — but it dramatically reduces setup time.

The result: faster prototyping and quicker iteration.

2. Natural Language Q&A Is Expanding Self-Service Analytics

Power BI’s Q&A visual allows business users to type:

“Show total sales by region for last quarter.”

Power BI translates this into queries and visuals automatically.

This is part of a broader trend across platforms: conversational analytics.

Snowflake, Databricks, Fabric, and BI tools now all support some form of natural language interaction.

This lowers the barrier to entry for analytics and reduces dependency on data teams for simple questions.

However, this only works well when:

Tables are properly named
Relationships are correct
Measures are clearly defined

Which brings us back to fundamentals.

3. Built-In AI Makes Advanced Analytics Easier

Power BI and Fabric now include:

Forecasting visuals
Anomaly detection
AutoML models
Cognitive services
Predictive features

What once required data scientists can often be done directly inside the platform.

This enables analysts to:

Add predictions to reports
Detect unusual behavior
Cluster customers
Score records

All without building custom ML pipelines.

Advanced analytics is becoming part of everyday BI.

4. AI Is Improving Developer Productivity

For analytics professionals, AI has become a daily productivity tool:

Writing DAX measures
Generating SQL
Creating Power Query transformations
Explaining model errors
Drafting documentation

Instead of searching forums or writing everything from scratch, teams use AI to accelerate development.

This is especially powerful for:

Junior analysts learning faster
Senior engineers moving quicker
Teams standardizing patterns

AI acts as an always-available assistant.

How AI Isn’t Changing Analytics

Despite all of this, Power BI projects (and analytics project in general) still succeed or fail for the same reasons they always have.

1. Data Modeling Still Drives Everything

Copilot can generate visuals.

It cannot fix a broken model.

If your Power BI semantic model has:

Poor relationships
Ambiguous dimensions
Duplicate metrics
Inconsistent grain

Your reports will still be confusing — no matter how much AI you add.

Star schemas, clear measures, and well-designed semantic layers remain essential.

AI works on top of your model. It does not replace it.

2. Data Quality Still Determines Trust

AI-powered insights mean nothing if the data is wrong.

If, for example:

Sales numbers don’t match Finance
Customer definitions vary by report
Dates behave inconsistently

Users will stop trusting dashboards.

Modern platforms like Fabric emphasize data pipelines, lakehouses, governance, and lineage for a reason.

Analytics still starts with reliable data engineering.

3. Metrics Still Require Human Agreement

Power BI can calculate anything.

AI can suggest formulas.

But only people can agree on:

What “revenue” means
How churn is defined
Which KPIs matter
What targets are realistic

Metric alignment remains a business process, not a technical one.

No AI can resolve organizational ambiguity.

4. Dashboards Don’t Drive Action — People Do

Smart narratives and AI summaries are useful.

But decisions still depend on:

Context
Priorities
Risk tolerance
Strategy

A Power BI report becomes valuable only when someone uses it to change behavior.

That requires storytelling, persuasion, and leadership — not just algorithms.

What This Means for Power BI and Analytics Professionals

AI is changing the workflow, not the purpose of analytics.

Less time spent on:

Boilerplate DAX
First-pass visuals
Manual exploration

More time spent on:

Understanding business problems
Designing models
Interpreting results
Influencing decisions

The role evolves from “report builder” to:

Analytics translator
Business partner
Insight driver

Power BI professionals who thrive will combine:

Strong modeling skills
Business understanding
Communication
Strategic thinking
AI-assisted productivity

The Bottom Line

Power BI and modern analytics platforms are becoming AI-powered.

But analytics is not becoming automatic.

AI accelerates:

Report creation
Exploration
Advanced analytics
Developer productivity

It does not replace:

Data modeling
Data quality
Business context
Metric alignment
Human judgment

AI amplifies good analytics practices — and exposes bad ones faster.

Organizations that succeed will be the ones that invest in:

Solid data foundations
Clear semantic models
Skilled analytics teams
Thoughtful AI adoption

Not just shiny features.

Thanks for reading and good luck on your data journey!