Tag: Microsoft Purview

AB-900, AI Governance, AI Security, Microsoft Certification June 27, 2026

Identify compliance risks and recommendations by using Microsoft Purview Compliance Manager (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify compliance risks and recommendations by using Microsoft Purview Compliance Manager

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Organizations today face increasing regulatory and compliance requirements related to data privacy, security, records management, and governance. Regulations such as GDPR, HIPAA, ISO 27001, NIST, PCI DSS, and many others require organizations to implement controls that protect sensitive information and demonstrate compliance.

Microsoft Purview Compliance Manager is a solution within Microsoft Purview that helps organizations assess, manage, and improve their compliance posture. It provides a risk-based approach to compliance by measuring how well an organization has implemented controls and by offering actionable recommendations to reduce compliance risks.

For the AB-900 exam, you should understand the purpose of Compliance Manager, how it identifies compliance risks, how compliance scores are calculated, and how organizations can use recommendations to improve their compliance posture.

What Is Microsoft Purview Compliance Manager?

Microsoft Purview Compliance Manager is a compliance management solution that helps organizations:

Assess compliance risks
Monitor compliance status
Track implementation of compliance controls
Improve regulatory compliance
Generate evidence for audits
Prioritize remediation efforts

Compliance Manager translates complex regulatory requirements into manageable improvement actions that administrators can implement within Microsoft 365.

Rather than simply reporting compliance status, Compliance Manager helps organizations actively improve compliance through continuous assessment and risk reduction.

Why Compliance Manager Is Important

Organizations must comply with numerous regulations and standards. Managing compliance manually can be difficult because:

Regulations frequently change
Multiple frameworks may apply simultaneously
Compliance controls span many systems
Evidence collection can be time-consuming
Auditors require documentation

Compliance Manager helps centralize compliance activities and provides visibility into compliance readiness.

Benefits include:

Reduced compliance risk
Improved governance
Simplified audit preparation
Better visibility into regulatory requirements
Continuous compliance monitoring
Prioritized remediation efforts

Understanding Compliance Risk

Compliance risk refers to the possibility that an organization fails to meet legal, regulatory, or internal policy requirements.

Examples include:

Improper handling of personal data
Missing security controls
Lack of retention policies
Inadequate access controls
Failure to encrypt sensitive information
Insufficient auditing and monitoring

Compliance Manager helps identify these risks by comparing organizational practices against compliance requirements.

Compliance Score

One of the most important concepts in Compliance Manager is the Compliance Score.

The Compliance Score is a measurement that reflects the organization’s progress toward meeting selected compliance requirements.

The score:

Is risk-based
Measures completed controls
Helps prioritize work
Changes as actions are completed

A higher score generally indicates that more compliance controls have been implemented.

However, the score does not guarantee compliance with a regulation. It serves as a management tool for tracking progress and reducing risk.

How Compliance Score Is Calculated

Compliance Manager assigns points to improvement actions.

Points are awarded when actions are completed.

Examples of actions include:

Enabling multifactor authentication
Configuring retention policies
Applying sensitivity labels
Enabling audit logging
Implementing access controls

Higher-risk controls typically receive more points because they contribute more significantly to risk reduction.

Assessments in Compliance Manager

An assessment measures compliance against a specific regulation, standard, or framework.

Examples include:

GDPR
ISO 27001
NIST
HIPAA
PCI DSS
Microsoft Data Protection Baseline

Each assessment contains:

Control objectives
Improvement actions
Testing guidance
Documentation requirements
Compliance status tracking

Organizations can use multiple assessments simultaneously.

Types of Controls

Compliance Manager evaluates different types of controls.

Microsoft-Managed Controls

These controls are implemented and managed by Microsoft.

Examples include:

Physical datacenter security
Infrastructure protections
Platform-level safeguards

Microsoft provides evidence showing how these controls are implemented.

Customer-Managed Controls

These controls are the responsibility of the organization.

Examples include:

MFA configuration
Retention policies
Access management
User training
Data classification

Administrators must implement and document these controls.

Shared Controls

Shared controls involve responsibilities divided between Microsoft and the customer.

Examples include:

Identity management
Security monitoring
Data protection configurations

Both parties contribute to compliance.

Improvement Actions

Improvement actions are recommendations that help organizations reduce compliance risk.

An improvement action typically includes:

Description of the requirement
Implementation guidance
Testing procedures
Documentation requirements
Risk impact

Examples include:

Enable multifactor authentication
Configure audit logging
Apply sensitivity labels
Restrict external sharing
Implement retention policies
Enable Data Loss Prevention policies

Completing improvement actions increases the compliance score.

Recommendations in Compliance Manager

Compliance Manager provides actionable recommendations that help organizations improve compliance.

Recommendations may involve:

Identity Security

Examples:

Enable MFA
Implement Conditional Access
Review privileged accounts
Use least-privilege access

Data Protection

Examples:

Configure sensitivity labels
Encrypt sensitive content
Implement DLP policies
Protect confidential information

Monitoring and Auditing

Examples:

Enable auditing
Review activity logs
Investigate suspicious behavior
Maintain audit records

Information Governance

Examples:

Create retention policies
Define retention labels
Manage records
Implement deletion schedules

Testing and Evidence Collection

Compliance Manager supports audit preparation through evidence collection.

Organizations can:

Upload documentation
Store screenshots
Attach policy documents
Record test results
Maintain audit evidence

This makes audits easier because evidence is stored alongside compliance controls.

Regulatory Templates

Compliance Manager includes built-in templates for many regulations and standards.

Examples include:

GDPR
HIPAA
ISO 27001
NIST CSF
SOC 2
PCI DSS

Templates reduce the effort required to build compliance programs from scratch.

Monitoring Compliance Over Time

Compliance is not a one-time activity.

Compliance Manager supports continuous monitoring by:

Tracking score changes
Updating assessment status
Identifying new risks
Monitoring action completion
Highlighting outstanding requirements

Organizations can regularly review their compliance posture and address gaps.

Compliance Manager and Microsoft 365 Copilot

As organizations adopt Microsoft 365 Copilot, governance and compliance become increasingly important.

Compliance Manager can help organizations:

Evaluate data protection readiness
Review access controls
Verify sensitivity label deployment
Assess retention policies
Confirm audit logging is enabled
Measure compliance maturity

These controls help ensure Copilot operates within established governance and compliance frameworks.

Key Exam Tips

For the AB-900 exam, remember:

Compliance Manager helps assess and improve compliance posture.
Compliance Score measures progress toward implementing controls.
Improvement actions provide recommendations for reducing risk.
Assessments measure compliance against regulations and standards.
Controls may be Microsoft-managed, customer-managed, or shared.
Compliance Manager supports evidence collection and audit readiness.
A higher Compliance Score indicates improved compliance posture but does not guarantee regulatory compliance.
Compliance Manager helps organizations identify and prioritize compliance risks.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Compliance Manager?

A. Create SharePoint sites automatically

B. Assess and improve an organization’s compliance posture

C. Replace Microsoft Defender

D. Manage Windows updates

Answer: B

Explanation: Compliance Manager helps organizations assess compliance risks, track controls, and improve compliance posture through assessments and recommendations.

Question 2

What does the Compliance Score primarily represent?

A. The number of licensed users

B. The percentage of completed support tickets

C. Progress toward implementing compliance controls

D. The amount of storage consumed

Answer: C

Explanation: Compliance Score measures the organization’s progress in implementing controls that reduce compliance risk.

Question 3

Which type of control is managed entirely by Microsoft?

A. Customer-managed control

B. Shared control

C. Administrative control

D. Microsoft-managed control

Answer: D

Explanation: Microsoft-managed controls are implemented and maintained by Microsoft, such as datacenter security and infrastructure protections.

Question 4

An administrator wants to increase the organization’s Compliance Score. What should they do?

A. Purchase more Microsoft licenses

B. Increase mailbox storage limits

C. Complete improvement actions

D. Delete old assessments

Answer: C

Explanation: Improvement actions contribute points to the Compliance Score and help reduce compliance risk.

Question 5

Which feature helps organizations prepare for audits?

A. Microsoft Forms

B. Evidence collection and documentation storage

C. Viva Engage

D. Power Automate approvals

Answer: B

Explanation: Compliance Manager allows organizations to upload documentation, screenshots, and evidence needed for audits.

Question 6

Which of the following is an example of a customer-managed control?

A. Physical datacenter security

B. Network backbone management

C. Global infrastructure redundancy

D. Configuring multifactor authentication

Answer: D

Explanation: Customers are responsible for implementing controls such as MFA, retention policies, and access controls.

Question 7

What is an assessment in Compliance Manager?

A. A financial audit report

B. A measurement of compliance against a regulation or standard

C. A SharePoint permission review

D. A Microsoft support case

Answer: B

Explanation: Assessments evaluate compliance requirements associated with regulations, standards, or frameworks.

Question 8

Which compliance framework could be evaluated using Compliance Manager?

A. HIPAA

B. DHCP

C. SMTP

D. DNS

Answer: A

Explanation: Compliance Manager includes templates and assessments for frameworks such as HIPAA, GDPR, ISO 27001, and NIST.

Question 9

What is the purpose of improvement actions?

A. To reduce compliance risk and guide remediation efforts

B. To create Teams channels automatically

C. To increase internet bandwidth

D. To manage printer deployments

Answer: A

Explanation: Improvement actions provide guidance for implementing controls that reduce compliance risk and improve compliance posture.

Question 10

Which statement about Compliance Score is correct?

A. A perfect score guarantees regulatory compliance.

B. The score measures storage utilization.

C. The score reflects progress toward implementing compliance controls but does not guarantee compliance.

D. The score only applies to Microsoft-managed controls.

Answer: C

Explanation: Compliance Score is a risk-based measurement of implemented controls and progress, but it does not guarantee compliance with any specific regulation.

Exam Summary

Microsoft Purview Compliance Manager is a risk-based compliance management solution that helps organizations assess regulatory requirements, identify compliance gaps, implement recommended controls, collect audit evidence, and continuously improve compliance posture. Understanding Compliance Score, assessments, improvement actions, and risk reduction recommendations is essential for success on the AB-900 exam and for administering Microsoft 365 and Copilot environments responsibly.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Microsoft Certification June 27, 2026

Understand how Copilot uses permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender to protect against risks (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand data security implications of Copilot
      --> Understand how Copilot uses permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender to protect against risks

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important security concepts for the AB-900 exam is understanding how Microsoft 365 Copilot protects organizational data. Because Copilot can access and summarize information from across Microsoft 365, organizations must ensure that sensitive information remains protected and that users only receive information they are authorized to access.

Microsoft 365 Copilot does not operate independently of an organization’s security framework. Instead, it inherits and respects the security, compliance, governance, and protection controls already configured in Microsoft 365. These controls come primarily from:

Microsoft 365 permissions
Microsoft Entra ID
Microsoft Purview
Microsoft Defender
SharePoint and OneDrive security
Teams security controls

Together, these technologies ensure that Copilot delivers useful responses while minimizing the risk of unauthorized access, data leakage, compliance violations, and insider threats.

The Security Foundation of Copilot

Microsoft 365 Copilot is built on three key principles:

Access only authorized data
Respect existing security controls
Apply compliance and governance policies automatically

Copilot does not create new permissions.

Instead, it uses the permissions already assigned to users and resources throughout Microsoft 365.

This means that if a user cannot access a file directly, they also cannot access that file through Copilot.

Permission Trimming: The Core Security Mechanism

The most important security concept related to Copilot is permission trimming.

Permission trimming ensures that Copilot only retrieves information the user is authorized to access.

When a user submits a prompt:

Microsoft Graph searches organizational data.
Existing permissions are evaluated.
Unauthorized content is excluded.
Only authorized information is sent to the large language model.

For example:

HR files are accessible only to HR employees.
Finance reports are accessible only to finance personnel.
Confidential legal documents remain restricted to legal teams.

If another employee asks Copilot about those documents, the information is not included in the response.

How Microsoft 365 Permissions Protect Data

Microsoft 365 permissions form the first layer of Copilot security.

Permissions are inherited from services such as:

SharePoint Online
OneDrive for Business
Microsoft Teams
Exchange Online
Microsoft Loop

Examples include:

SharePoint Permissions

Users can only access sites, libraries, folders, and files for which they have permissions.

OneDrive Permissions

Users can access their own files and content explicitly shared with them.

Teams Permissions

Copilot respects team membership and channel access.

Exchange Permissions

Emails and calendar data are only available to authorized users.

Because Copilot uses Microsoft Graph, these permissions are automatically enforced.

Role of Microsoft Entra ID

Microsoft Entra ID provides identity and access management for Microsoft 365.

Copilot relies on Entra ID to verify:

User identity
Group membership
Role assignments
Conditional Access policies
Authentication status

Entra ID ensures that only authenticated and authorized users can access Microsoft 365 resources.

Examples

A Conditional Access policy may require:

Multifactor authentication (MFA)
Compliant devices
Approved locations

If requirements are not met, users may be blocked from accessing Microsoft 365 resources and Copilot.

How Microsoft Purview Protects Data Used by Copilot

Microsoft Purview provides compliance, governance, and data protection controls.

Because Copilot works with organizational content, Purview protections automatically apply to data used by Copilot.

Sensitivity Labels

Sensitivity labels classify and protect content.

Common labels include:

Public
General
Confidential
Highly Confidential

Labels can enforce:

Encryption
Access restrictions
Watermarking
Content markings

If a document is protected by a sensitivity label, Copilot respects those protections.

Data Loss Prevention (DLP)

DLP policies help prevent sensitive information from being exposed.

Examples include:

Credit card numbers
Social Security numbers
Healthcare records
Financial information

DLP policies can:

Detect sensitive data
Block sharing
Generate alerts
Notify administrators

Copilot interactions remain subject to DLP protections.

Data Classification

Microsoft Purview can automatically classify content based on:

Sensitive information types
Trainable classifiers
Custom classifications

This classification helps organizations understand what information exists and where risks may be present.

Retention Policies

Retention policies ensure information is retained or deleted according to organizational requirements.

Copilot only works with content that remains available within Microsoft 365 according to retention settings.

Data Security Posture Management (DSPM) for AI

DSPM for AI helps organizations identify and reduce AI-related risks.

DSPM can:

Discover overshared content
Identify risky permissions
Detect exposure of sensitive data
Recommend remediation actions

This is especially important because Copilot may reveal risks that already exist due to improper permissions.

How Microsoft Defender Protects Copilot Environments

Microsoft Defender provides threat detection, prevention, and response capabilities.

Defender helps protect both the data Copilot accesses and the users interacting with Copilot.

Microsoft Defender XDR

Microsoft Defender XDR provides:

Cross-domain threat detection
Incident correlation
Security investigation
Automated response

It helps security teams identify attacks that may affect Copilot-accessible data.

Identity Protection

Microsoft Defender and Entra ID can detect:

Risky sign-ins
Credential theft
Impossible travel events
Suspicious account activity

Compromised identities can be blocked before attackers access Copilot.

Endpoint Protection

Microsoft Defender for Endpoint protects devices used to access Copilot.

It helps detect:

Malware
Ransomware
Unauthorized access attempts
Device compromise

Threat Intelligence

Microsoft Defender uses global threat intelligence to identify:

Known malicious actors
Emerging threats
Attack techniques

This helps reduce the likelihood that attackers gain access to sensitive organizational information.

Oversharing Risks and Copilot

Copilot does not create oversharing problems.

However, it can expose existing oversharing issues more efficiently.

For example:

If a confidential SharePoint folder has accidentally been shared with all employees:

Employees may not discover the folder manually.
Copilot may locate relevant content and summarize it.

Because of this, organizations should regularly review:

File permissions
Site permissions
Group memberships
Sharing settings

DSPM for AI helps identify these risks.

Security Controls Working Together

The protection of Copilot data relies on multiple layers:

Security Layer	Purpose
Microsoft Entra ID	Identity verification and access control
Conditional Access	Restrict access based on risk and conditions
Microsoft 365 Permissions	Control resource access
Microsoft Graph	Applies permission trimming
Microsoft Purview	Governance, compliance, and data protection
Microsoft Defender	Threat detection and response
DSPM for AI	AI-specific risk identification

These controls work together to create a secure AI environment.

Key Exam Tips

For the AB-900 exam, remember the following:

Copilot does not bypass existing permissions.
Permission trimming ensures users only see authorized content.
Microsoft Graph enforces access controls during data retrieval.
Microsoft Entra ID provides identity and access management.
Conditional Access can restrict Copilot access based on organizational policies.
Microsoft Purview protects data through sensitivity labels, DLP, classification, retention, and DSPM for AI.
Microsoft Defender protects identities, endpoints, and organizational resources from threats.
Copilot may reveal existing oversharing risks but does not create them.
DSPM for AI helps organizations identify and remediate AI-related data exposure risks.

Practice Exam Questions

Question 1

What security mechanism ensures that Copilot only retrieves information a user is authorized to access?

A. Endpoint isolation
B. Data retention
C. Data replication
D. Permission trimming

Answer: D

Explanation: Permission trimming evaluates a user’s permissions and excludes unauthorized content from Copilot responses.

Question 2

A user asks Copilot about a confidential HR document they do not have permission to view. What will happen?

A. Copilot summarizes the document anyway
B. Copilot requests administrator approval automatically
C. The document is excluded from the response due to permission trimming
D. The document is copied into the user’s OneDrive

Answer: C

Explanation: Copilot respects existing permissions and cannot retrieve content users are not authorized to access.

Question 3

Which Microsoft service provides the identity platform that Copilot relies on for authentication and authorization?

A. Microsoft Defender XDR
B. Microsoft Entra ID
C. Microsoft Purview Insider Risk Management
D. Microsoft Intune

Answer: B

Explanation: Microsoft Entra ID manages identities, authentication, authorization, and access controls for Microsoft 365 services.

Question 4

Which Microsoft Purview capability helps prevent sensitive information such as credit card numbers from being improperly shared?

A. Retention policies
B. Conditional Access
C. Privileged Identity Management
D. Data Loss Prevention (DLP)

Answer: D

Explanation: DLP policies detect and protect sensitive information by blocking or monitoring risky sharing activities.

Question 5

What is the primary purpose of sensitivity labels in Microsoft Purview?

A. Manage operating system updates
B. Monitor network performance
C. Classify and protect content based on sensitivity levels
D. Create backup copies of documents

Answer: C

Explanation: Sensitivity labels classify content and can apply protections such as encryption and access restrictions.

Question 6

Which Microsoft Purview solution helps organizations discover overshared content that may present AI-related risks?

A. Data Security Posture Management (DSPM) for AI
B. Microsoft Planner
C. Exchange Online Protection
D. Windows Defender Firewall

Answer: A

Explanation: DSPM for AI identifies sensitive data exposure risks and recommends remediation actions.

Question 7

How does Microsoft Defender help protect environments that use Copilot?

A. By creating user accounts automatically
B. By replacing Microsoft Entra ID permissions
C. By detecting threats, compromised identities, and suspicious activities
D. By bypassing DLP policies

Answer: C

Explanation: Microsoft Defender provides threat detection, investigation, and response capabilities that protect organizational resources.

Question 8

Which statement best describes the relationship between Copilot and oversharing?

A. Copilot automatically fixes overshared content
B. Copilot creates oversharing by default
C. Copilot ignores shared permissions entirely
D. Copilot may reveal existing oversharing issues because it can efficiently locate accessible content

Answer: D

Explanation: Copilot does not create oversharing problems but can make improperly shared content easier to discover.

Question 9

Which security control can require multifactor authentication before a user accesses Microsoft 365 resources and Copilot?

A. SharePoint version history
B. Conditional Access
C. Retention labels
D. Exchange journaling

Answer: B

Explanation: Conditional Access policies can require MFA, compliant devices, or other conditions before granting access.

Question 10

Which statement about Copilot security is correct?

A. Copilot has unrestricted access to all tenant data.
B. Copilot ignores Microsoft Purview protections.
C. Copilot only follows Microsoft Defender policies.
D. Copilot inherits existing Microsoft 365 permissions and compliance controls.

Answer: D

Explanation: Copilot respects permissions, security settings, compliance policies, and governance controls already configured within Microsoft 365.

Go to the AB-900 Exam Prep Hub main page

AB-900, Cybersecurity, Microsoft Certification June 27, 2026

Understand retention in Microsoft Purview (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand Microsoft Purview
      --> Understand retention

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Data is one of an organization’s most valuable assets. However, organizations must not only protect data but also manage how long it is kept and when it should be deleted. Regulatory requirements, legal obligations, business needs, and security concerns all influence data retention decisions.

Microsoft Purview provides comprehensive retention capabilities that help organizations retain, preserve, review, and dispose of information across Microsoft 365 services. Retention is a key component of information governance and records management.

For the AB-900 exam, it is important to understand the purpose of retention, the difference between retention policies and retention labels, and how Microsoft Purview helps organizations meet compliance and governance requirements.

What Is Retention?

Retention refers to the process of determining:

How long information should be kept
Whether information must be preserved
When information should be deleted
How organizations comply with legal, regulatory, and business requirements

Retention ensures that important information remains available when needed while reducing risks associated with keeping unnecessary data indefinitely.

Examples include:

Retaining financial records for seven years
Preserving employee communications during legal investigations
Automatically deleting outdated project documents
Maintaining business records for compliance purposes

Why Retention Matters

Organizations use retention solutions to achieve several goals:

Regulatory Compliance

Many industries have laws requiring data to be retained for specific periods.

Examples include:

Financial records
Healthcare records
Tax documentation
Legal contracts

Legal Protection

Organizations may need to preserve information for:

Litigation
Audits
Investigations
Regulatory reviews

Information Governance

Retention helps organizations:

Reduce data sprawl
Improve information quality
Eliminate outdated content
Manage storage costs

Security Improvement

Keeping unnecessary data increases risk.

Proper retention practices help:

Minimize exposure to breaches
Reduce attack surfaces
Remove outdated sensitive information

Retention in Microsoft Purview

Microsoft Purview provides retention solutions that work across Microsoft 365 services such as:

Exchange Online
SharePoint Online
OneDrive
Microsoft Teams
Microsoft 365 Groups
Viva Engage
Copilot-related content stored in Microsoft 365

Purview allows organizations to automatically:

Retain content
Delete content
Retain and then delete content

Retention Policies

A retention policy automatically applies retention settings to locations across Microsoft 365.

Administrators create policies that specify:

Where the policy applies
How long content is retained
What happens after the retention period ends

Example

A policy might:

Retain all Teams chat messages for 5 years
Automatically delete them afterward

Advantages

Retention policies:

Apply automatically
Require little user involvement
Work at scale
Provide consistent compliance

Retention Labels

Retention labels provide more granular control than retention policies.

A retention label can be assigned to individual items such as:

Documents
Emails
Files
Records

Labels can be applied:

Manually by users
Automatically by policies
Through sensitive information detection
Through trainable classifiers

Example

A document labeled “Financial Record” could:

Be retained for 7 years
Be declared a record
Be deleted after the retention period expires

Retention Policies vs. Retention Labels

Feature	Retention Policy	Retention Label
Scope	Broad locations	Individual items
User involvement	Usually none	May require user action
Granularity	Location level	Item level
Flexibility	Moderate	High
Records management	Limited	Strong

A useful exam tip is:

Retention policies manage locations, while retention labels manage individual content items.

Retain, Delete, or Retain and Delete

Microsoft Purview supports three primary retention actions.

Retain Only

Content remains available throughout the retention period.

Example:

Retain employee records for seven years.

Delete Only

Content is automatically removed after a specified period.

Example:

Delete temporary files after one year.

Retain and Then Delete

Content is preserved for a retention period and then automatically removed.

Example:

Retain project documents for five years and delete afterward.

Records Management

Records management builds on retention by treating important information as official records.

Organizations can:

Declare content as records
Restrict modifications
Track lifecycle events
Preserve compliance evidence

Examples of records:

Legal contracts
Corporate policies
Regulatory filings
Financial statements

Retention labels are commonly used to manage records.

Retention and Microsoft Teams

Organizations increasingly need to manage communication data.

Purview retention can manage:

Teams chat messages
Channel messages
Meeting content
Shared files

Example:

An organization may retain all Teams conversations for three years to satisfy compliance requirements.

Retention and Exchange Online

Retention can be applied to:

Emails
Mailboxes
Calendar items
Contacts

Example:

All employee email messages are retained for seven years and deleted afterward.

Retention and SharePoint/OneDrive

Retention supports:

Documents
Libraries
Files
Collaboration content

Example:

Project documentation is retained for five years after project completion.

Retention and Microsoft 365 Copilot

Microsoft 365 Copilot uses organizational data stored in Microsoft 365.

Because Copilot accesses existing organizational content:

Retention policies continue to govern underlying data.
Retention labels remain effective.
Information governance policies still apply.
Deleted content generally becomes unavailable after retention requirements are fulfilled.

Organizations should ensure retention strategies are aligned with Copilot usage to maintain compliance and data governance.

Adaptive Scopes

Large organizations often need dynamic retention assignments.

Adaptive scopes allow administrators to target retention policies based on attributes such as:

Department
Geography
User type
Business unit

This reduces administrative effort and improves policy accuracy.

Retention and eDiscovery

Retention supports eDiscovery by ensuring content remains available during investigations.

Benefits include:

Preserving evidence
Supporting legal holds
Maintaining compliance records
Simplifying investigations

Retained content can remain available even if users attempt to delete it.

Retention Best Practices

Organizations should:

Identify regulatory requirements.
Define retention schedules.
Use retention policies for broad coverage.
Use retention labels for specific content.
Regularly review retention settings.
Apply least-privilege administration.
Align retention with records management processes.
Test policies before large-scale deployment.

Key Exam Takeaways

For the AB-900 exam, remember these important concepts:

Retention determines how long data is kept and when it is deleted.
Microsoft Purview provides retention policies and retention labels.
Retention policies apply broadly to locations and workloads.
Retention labels apply to individual content items.
Organizations can retain content, delete content, or retain and then delete content.
Retention supports compliance, governance, security, and legal requirements.
Records management relies heavily on retention labels.
Retention applies across Exchange Online, SharePoint, OneDrive, Teams, and other Microsoft 365 services.
Copilot content governance relies on the retention controls applied to underlying Microsoft 365 data.

Practice Exam Questions

Question 1

An organization wants all Teams chat messages retained for five years and then automatically deleted. Which Microsoft Purview capability should be used?

A. Sensitivity labels
B. Retention policy
C. Conditional Access
D. Insider Risk Management

Answer: B

Explanation: Retention policies can apply retention settings broadly across Microsoft 365 workloads such as Teams chats and automatically delete content after the retention period expires.

Question 2

What is the primary purpose of retention in Microsoft Purview?

A. Encrypt all files in Microsoft 365
B. Prevent users from sharing documents externally
C. Control how long information is preserved and when it is deleted
D. Monitor user productivity

Answer: C

Explanation: Retention helps organizations manage the lifecycle of information by determining how long content is kept and when it should be removed.

Question 3

Which statement best describes a retention label?

A. It applies retention settings to individual items such as emails and documents.
B. It blocks external access to files.
C. It enforces multifactor authentication.
D. It manages network security rules.

Answer: A

Explanation: Retention labels provide item-level retention management and can be applied to specific documents, emails, and records.

Question 4

A company wants users to classify certain documents as official records that cannot be easily altered. Which solution is most appropriate?

A. Adaptive scopes
B. Conditional Access policies
C. Microsoft Defender XDR
D. Retention labels with records management capabilities

Answer: D

Explanation: Retention labels can declare documents as records and enforce records management requirements.

Question 5

Which retention action preserves content during a specified period and then removes it automatically?

A. Retain only
B. Delete only
C. Retain and then delete
D. Archive only

Answer: C

Explanation: Retain and then delete ensures content remains available during the retention period before automatic deletion occurs.

Question 6

What is a key difference between retention policies and retention labels?

A. Retention policies only work with Exchange Online.
B. Retention labels apply to individual content items.
C. Retention labels cannot be automated.
D. Retention policies require user assignment.

Answer: B

Explanation: Retention labels provide item-level control, while retention policies generally apply to locations or workloads.

Question 7

An administrator wants a retention policy to automatically target users based on department membership. Which feature should be used?

A. Data Loss Prevention
B. eDiscovery
C. Sensitivity labeling
D. Adaptive scopes

Answer: D

Explanation: Adaptive scopes dynamically assign retention policies using organizational attributes such as department or location.

Question 8

Why is retention important for eDiscovery investigations?

A. It automatically encrypts evidence.
B. It prevents users from signing in.
C. It helps ensure relevant information remains available for review.
D. It removes all old content immediately.

Answer: C

Explanation: Retention preserves information that may be required for legal or regulatory investigations.

Question 9

Which Microsoft 365 workload can be governed by Microsoft Purview retention policies?

A. Microsoft Teams only
B. SharePoint Online only
C. Exchange Online only
D. Exchange Online, SharePoint Online, OneDrive, and Teams

Answer: D

Explanation: Retention policies support multiple Microsoft 365 workloads, including Exchange, SharePoint, OneDrive, and Teams.

Question 10

How does Microsoft 365 Copilot relate to retention policies?

A. Copilot bypasses all retention settings.
B. Copilot replaces retention labels.
C. Copilot uses underlying Microsoft 365 content that remains governed by retention controls.
D. Copilot automatically creates retention policies.

Answer: C

Explanation: Copilot accesses organizational data stored in Microsoft 365, and existing retention policies and labels continue to govern that content.

Go to the AB-900 Exam Prep Hub main page

AB-900, Cybersecurity, Microsoft Certification, security June 27, 2026

Understand data classification in Microsoft Purview (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand Microsoft Purview
      --> Understand data classification in Microsoft Purview

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Data is one of an organization’s most valuable assets. However, not all data carries the same level of sensitivity or business value. Some information can be shared publicly, while other information must be protected because it contains financial records, intellectual property, customer data, healthcare information, or confidential business plans.

Microsoft Purview Data Classification helps organizations identify, categorize, and protect sensitive information throughout Microsoft 365. Data classification is a foundational capability that enables organizations to understand their data landscape, apply appropriate protections, meet compliance requirements, and securely adopt AI technologies such as Microsoft 365 Copilot.

For the AB-900 exam, it is important to understand how Microsoft Purview classifies data, the tools involved, and how classification supports security, compliance, governance, and AI readiness.

What Is Data Classification?

Data classification is the process of identifying and categorizing information based on its:

Sensitivity
Confidentiality
Regulatory requirements
Business value
Risk level

Classification allows organizations to answer questions such as:

Which files contain sensitive information?
Where is confidential data stored?
Who can access regulated data?
Which content should be protected or retained?
What data can Copilot safely access?

Microsoft Purview automates much of this process through built-in detection technologies.

Why Data Classification Is Important

Without data classification, organizations often struggle to:

Identify sensitive information
Apply consistent protections
Meet compliance requirements
Prevent data loss
Govern AI access to information

Benefits of data classification include:

Improved data visibility
Better security controls
Regulatory compliance
Reduced risk of data breaches
More effective data governance
Safer use of Microsoft 365 Copilot

Microsoft Purview Data Classification Components

Microsoft Purview uses several components to classify information.

Sensitive Information Types (SITs)

Sensitive Information Types are predefined patterns used to identify sensitive data.

Examples include:

Credit card numbers
Social Security numbers
Passport numbers
Driver’s license numbers
Bank account numbers
Tax identification numbers

Microsoft provides hundreds of built-in SITs covering numerous countries and regions.

Example

A document containing a U.S. Social Security Number may automatically be detected and classified as sensitive content.

Trainable Classifiers

Trainable classifiers use machine learning to identify content based on context rather than exact patterns.

Examples include:

Resumes
Source code
Contracts
Financial documents
Healthcare records
Intellectual property

Unlike SITs, trainable classifiers examine the meaning and context of content.

Example

A contract may be identified even if it does not contain a specific keyword or sensitive number.

Content Explorer

Content Explorer allows administrators to:

View classified content
See where sensitive data exists
Investigate data locations
Analyze classification results

This tool helps organizations understand their data environment.

Activity Explorer

Activity Explorer provides visibility into:

Labeling activities
Classification actions
DLP events
User interactions with sensitive data

Administrators can investigate how classified information is being used.

Types of Data Classification

Organizations typically classify data into categories such as:

Classification	Description
Public	Information intended for everyone
General	Everyday business information
Internal	Information for employees only
Confidential	Sensitive business information
Highly Confidential	Critical or restricted information

Organizations can customize classifications based on their requirements.

Classification and Sensitivity Labels

Data classification often works together with Sensitivity Labels.

Classification identifies the data.

Sensitivity labels protect the data.

Example

Microsoft Purview detects:

Credit card information
Customer account numbers

A sensitivity label is then automatically applied:

Confidential
Highly Confidential

The label can then:

Encrypt the file
Restrict access
Apply watermarks
Block unauthorized sharing

Automatic Data Classification

Microsoft Purview can automatically classify information using:

Pattern Matching

Detects predefined sensitive information.

Examples:

Credit card numbers
Social Security numbers
Passport numbers

Machine Learning

Uses trainable classifiers to recognize content types.

Examples:

Contracts
Legal documents
Source code

Keyword Detection

Identifies content based on specific words or phrases.

Examples:

Confidential
Internal Use Only
Proprietary Information

Data Classification and Microsoft 365 Copilot

Data classification is particularly important for Copilot deployments.

Organizations often ask:

What information can Copilot access?

Copilot respects:

User permissions
Sensitivity labels
Compliance controls

Proper data classification helps organizations:

Understand their data
Identify overshared content
Protect confidential information
Reduce AI-related risks

Classification improves confidence when deploying AI solutions.

Data Classification and Compliance

Many regulations require organizations to identify and protect sensitive information.

Examples include:

GDPR
HIPAA
PCI DSS
SOX
Various privacy laws

Microsoft Purview classification helps organizations:

Locate regulated data
Apply protections
Support audits
Demonstrate compliance

Data Classification and Data Loss Prevention (DLP)

Data classification works closely with DLP policies.

Process

Purview identifies sensitive content.
Content is classified.
DLP policies evaluate the classification.
Protective actions occur.

Examples:

Block file sharing
Restrict email transmission
Alert administrators
Notify users

Without classification, DLP cannot effectively identify sensitive content.

Data Classification and Insider Risk Management

Classified data helps Insider Risk Management identify risky activities involving:

Financial records
Intellectual property
Customer information
Confidential business data

This improves risk detection and investigation capabilities.

Common Data Classification Use Cases

Financial Information Protection

Detect:

Credit card numbers
Banking information
Tax records

Apply protection automatically.

Human Resources Data

Identify:

Employee records
Salary information
Performance reviews

Restrict access to authorized personnel.

Healthcare Information

Classify:

Patient records
Medical identifiers

Support HIPAA compliance.

Legal Documents

Detect:

Contracts
Legal agreements

Apply confidentiality protections.

Intellectual Property Protection

Identify:

Product designs
Research data
Source code

Prevent unauthorized sharing.

Key Exam Concepts

For the AB-900 exam, remember:

Data classification identifies and categorizes information.
Sensitive Information Types detect specific data patterns.
Trainable classifiers use machine learning and context.
Classification supports sensitivity labels and DLP.
Content Explorer helps locate classified content.
Activity Explorer helps investigate classification activity.
Classification is essential for compliance and governance.
Microsoft 365 Copilot benefits from proper data classification.
Classification enables automated protection policies.
Data classification improves organizational visibility into sensitive information.

Practice Exam Questions

Question 1

What is the primary purpose of data classification in Microsoft Purview?

A. To improve internet connectivity
B. To categorize information based on sensitivity and business value
C. To manage Windows updates
D. To configure virtual machines

Answer: B

Explanation: Data classification identifies and categorizes information so organizations can apply appropriate protections and governance controls.

Question 2

Which Microsoft Purview feature identifies information such as Social Security numbers and credit card numbers?

A. Activity Explorer
B. Sensitive Information Types
C. Compliance Manager
D. Insider Risk Management

Answer: B

Explanation: Sensitive Information Types (SITs) are designed to detect structured sensitive data using predefined patterns.

Question 3

Which technology enables Microsoft Purview to recognize contracts and resumes based on context?

A. Firewall policies
B. Sensitivity labels
C. Trainable classifiers
D. Conditional Access

Answer: C

Explanation: Trainable classifiers use machine learning and contextual analysis to identify content types.

Question 4

An administrator wants to see where sensitive information exists across Microsoft 365. Which tool should they use?

A. Microsoft Defender Portal
B. Teams Admin Center
C. Content Explorer
D. Exchange Admin Center

Answer: C

Explanation: Content Explorer provides visibility into classified content and its locations.

Question 5

What is the relationship between data classification and sensitivity labels?

A. They are unrelated technologies
B. Sensitivity labels identify data while classification encrypts it
C. Classification identifies data and labels protect it
D. Classification replaces sensitivity labels

Answer: C

Explanation: Classification discovers and categorizes information, while sensitivity labels apply protection settings.

Question 6

Which statement about Microsoft 365 Copilot is correct?

A. Copilot ignores classified information
B. Copilot respects permissions and protection controls associated with classified data
C. Copilot automatically removes sensitivity labels
D. Copilot bypasses governance policies

Answer: B

Explanation: Copilot honors existing permissions, labels, and compliance controls.

Question 7

Which Microsoft Purview feature allows administrators to investigate labeling and classification events?

A. Activity Explorer
B. Endpoint Manager
C. SharePoint Admin Center
D. Azure Monitor

Answer: A

Explanation: Activity Explorer provides visibility into classification-related activities and events.

Question 8

Which compliance-related benefit does data classification provide?

A. Faster network performance
B. Reduced storage costs only
C. Automatic hardware replacement
D. Easier identification and protection of regulated data

Answer: D

Explanation: Classification helps organizations locate and protect regulated information to support compliance requirements.

Question 9

A Data Loss Prevention (DLP) policy blocks sharing of files containing credit card numbers. What enables the DLP policy to identify those files?

A. Exchange transport rules only
B. Sensitive Information Types and data classification
C. Network firewalls
D. Device encryption

Answer: B

Explanation: DLP relies on classification mechanisms such as Sensitive Information Types to identify protected content.

Question 10

Which statement best describes trainable classifiers?

A. They only detect file names
B. They require manual review of every document
C. They identify information using contextual machine learning models
D. They replace all sensitivity labels

Answer: C

Explanation: Trainable classifiers use machine learning to recognize content such as contracts, source code, and resumes based on context rather than simple pattern matching.

Go to the AB-900 Exam Prep Hub main page

AB-900, Microsoft Certification, security June 27, 2026

Identify the use cases for sensitivity labels in Microsoft Purview (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand Microsoft Purview
      --> Identify the use cases for sensitivity labels in Microsoft Purview

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction to Microsoft Purview Sensitivity Labels

Microsoft Purview Sensitivity Labels are classification and protection mechanisms that help organizations secure sensitive information across Microsoft 365. Labels enable organizations to identify important data and apply protections automatically or manually.

Sensitivity labels are part of Microsoft Purview Information Protection and support the principles of:

Data classification
Data protection
Compliance
Governance
Secure collaboration
AI readiness for Microsoft 365 Copilot

Instead of securing locations only, sensitivity labels secure the data itself, allowing protections to remain with content wherever it travels.

Why Sensitivity Labels Matter

Organizations often handle information with varying levels of confidentiality:

Public documents
Internal business data
Financial records
Human resources information
Customer data
Intellectual property
Legal documents

Sensitivity labels provide a consistent method for:

Identifying content sensitivity
Applying encryption
Restricting access
Adding visual markings
Preventing accidental exposure
Supporting compliance requirements

How Sensitivity Labels Work

A sensitivity label can be applied to:

Documents
Emails
Microsoft Teams
Microsoft 365 Groups
SharePoint sites
OneDrive content

Labels can be:

Manually applied

Users choose the appropriate label.

Automatically applied

Microsoft Purview detects sensitive information and assigns labels automatically.

Common Label Hierarchies

Organizations frequently create labels such as:

Label	Intended Audience
Public	Anyone
General	Employees
Internal	Internal users only
Confidential	Specific departments
Highly Confidential	Restricted users

Labels are customizable and vary by organization.

Core Protection Capabilities

A sensitivity label may configure:

Encryption

Controls who can open content and what actions they can perform.

Examples:

View only
Edit allowed
Print blocked
Copy restricted

Content Markings

Visual indicators help users recognize sensitivity.

Examples:

Headers
Footers
Watermarks

Access Restrictions

Limits content access to:

Individuals
Groups
Departments
External users

Expiration Settings

Content access can expire after a specified period.

Major Use Cases for Sensitivity Labels

1. Protecting Confidential Documents

Organizations can label:

Financial statements
Contracts
Product designs
Strategic plans

Example:

A “Highly Confidential” label encrypts a document and restricts access to executives only.

2. Protecting Email Messages

Labels can secure email communication.

Example:

An HR manager sends salary information using a “Confidential – HR” label that:

Encrypts the email
Restricts forwarding
Prevents printing

3. Supporting Microsoft 365 Copilot

Copilot respects existing permissions and sensitivity labels.

If a document is labeled:

Confidential
Highly Confidential
Executive Only

Copilot only uses content that the user already has permission to access.

Sensitivity labels therefore help organizations prepare data safely for AI experiences.

4. Securing External Collaboration

Organizations can share files externally while maintaining protection.

Example:

A company sends a proposal to a partner:

External recipients can read it.
Forwarding is blocked.
Printing is disabled.

Protection travels with the document.

5. Meeting Regulatory Compliance Requirements

Sensitivity labels help support:

GDPR
HIPAA
Financial regulations
Privacy laws
Industry-specific requirements

Organizations can demonstrate that sensitive information receives appropriate protection.

6. Preventing Accidental Data Exposure

Users sometimes unintentionally send sensitive information.

Labels provide:

Classification awareness
Visual reminders
Automated protection

Example:

A user sending customer data receives an automatic recommendation to apply a Confidential label.

7. Protecting Intellectual Property

Engineering designs, research documents, and proprietary information can be restricted.

Example:

Only members of the Research department can access files labeled “R&D Confidential.”

8. Applying Visual Classification

Headers, footers, and watermarks immediately show sensitivity.

Examples:

INTERNAL USE ONLY
CONFIDENTIAL
HIGHLY CONFIDENTIAL

These markings help employees recognize handling requirements.

9. Labeling Containers

Sensitivity labels can be applied to:

Microsoft Teams
Microsoft 365 Groups
SharePoint sites

Container labels can control:

Guest access
Privacy settings
External sharing
Unmanaged device access

Example:

A Team labeled “Confidential Project” automatically disables guest access.

10. Supporting Data Loss Prevention (DLP)

Sensitivity labels integrate with Microsoft Purview DLP.

Example:

A DLP policy may block external sharing of content labeled “Highly Confidential.”

Labels and DLP together provide layered protection.

Manual vs Automatic Labeling

Method	Description
Manual labeling	User chooses the label
Recommended labeling	System suggests labels
Automatic labeling	Purview assigns labels automatically

Automatic labeling reduces reliance on users and improves consistency.

Supported Workloads

Sensitivity labels work across:

Microsoft Word
Excel
PowerPoint
Outlook
Teams
SharePoint Online
OneDrive
Microsoft 365 Groups

Relationship Between Sensitivity Labels and Retention Labels

These labels serve different purposes:

Label Type	Purpose
Sensitivity label	Protect and classify data
Retention label	Govern how long data is kept

Sensitivity labels answer:

“Who can access this?”

Retention labels answer:

“How long should we keep this?”

Benefits of Sensitivity Labels

Organizations gain:

Stronger data protection
Better compliance
Secure AI adoption
Reduced data leakage
Improved collaboration
Consistent classification
User awareness of sensitive data

AB-900 Exam Tips

Remember these key points:

Sensitivity labels protect the content itself, not just the storage location.
Labels can apply encryption, markings, and access restrictions.
Labels work across Microsoft 365 workloads.
Microsoft 365 Copilot honors sensitivity labels and permissions.
Labels can be manually or automatically applied.
Sensitivity labels and retention labels serve different purposes.
Labels integrate with DLP policies for additional protection.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview sensitivity labels?

A. Monitor network traffic
B. Protect and classify data based on sensitivity
C. Manage software updates
D. Create backups

Answer: B

Explanation: Sensitivity labels classify information and apply protections such as encryption and access restrictions.

Question 2

Which Microsoft 365 service respects sensitivity labels when generating responses?

A. Microsoft DHCP
B. Windows Update
C. Hyper-V
D. Microsoft 365 Copilot

Answer: D

Explanation: Copilot honors both user permissions and sensitivity labels.

Question 3

Which capability can sensitivity labels provide?

A. Device firmware updates
B. Password resets
C. Encryption and access control
D. Network routing

Answer: C

Explanation: Labels can encrypt content and define who can access it.

Question 4

A company wants documents to display “CONFIDENTIAL” across every page. Which sensitivity label feature supports this?

A. Authentication logs
B. Retention policies
C. Device compliance
D. Watermarks and content markings

Answer: D

Explanation: Labels can add headers, footers, and watermarks.

Question 5

What type of information is commonly protected with sensitivity labels?

A. Product designs and financial reports
B. Printer drivers only
C. Operating system files only
D. DNS records

Answer: A

Explanation: Sensitive business information is a common use case.

Question 6

Which statement about automatic labeling is correct?

A. Users must always choose labels manually.
B. Labels only work with Outlook.
C. Purview can automatically apply labels based on detected sensitive information.
D. Automatic labeling disables encryption.

Answer: C

Explanation: Purview can detect sensitive content and assign labels automatically.

Question 7

Which object can receive a sensitivity label?

A. Microsoft Teams
B. Documents
C. Emails
D. All of the above

Answer: D

Explanation: Labels support files, emails, Teams, groups, and SharePoint sites.

Question 8

How do sensitivity labels differ from retention labels?

A. They are identical.
B. Sensitivity labels protect data, while retention labels control how long data is kept.
C. Retention labels encrypt content.
D. Sensitivity labels manage software deployment.

Answer: B

Explanation: Protection and lifecycle management are separate functions.

Question 9

Which Microsoft Purview feature commonly works together with sensitivity labels to prevent data leakage?

A. Windows Firewall
B. Azure Virtual Machines
C. Data Loss Prevention (DLP)
D. Active Directory Sites and Services

Answer: C

Explanation: DLP policies can use sensitivity labels to enforce protection rules.

Question 10

Why are sensitivity labels important for Microsoft 365 Copilot adoption?

A. They increase processor speed.
B. They replace permissions.
C. They eliminate identity management.
D. They help ensure AI accesses data according to existing protections.

Answer: D

Explanation: Copilot follows permissions and sensitivity labels, helping organizations safely enable AI experiences.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification, security June 27, 2026

Understand features and capabilities of Microsoft Purview Information Protection, Microsoft Purview Data Loss Prevention (DLP), Microsoft Purview Insider Risk Management, Microsoft Purview Communication Compliance, Microsoft Purview Data Security Posture Management (DSPM) for AI, and Microsoft Purview Data Lifecycle Management (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand Microsoft Purview
      --> Understand features and capabilities of Microsoft Purview Information Protection, Microsoft Purview Data Loss Prevention (DLP), Microsoft Purview Insider Risk Management, Microsoft Purview Communication Compliance, Microsoft Purview Data Security Posture Management (DSPM) for AI, and Microsoft Purview Data Lifecycle Management

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations adopt Microsoft 365, Copilot, and AI-powered solutions, protecting sensitive information becomes increasingly important. Microsoft provides a unified compliance and governance platform called Microsoft Purview.

Microsoft Purview helps organizations:

Protect sensitive information.
Prevent accidental or intentional data loss.
Manage records and retention.
Detect insider risks.
Monitor communications.
Strengthen AI data governance.
Meet regulatory and compliance requirements.

For the AB-900 exam, you should understand the purpose and capabilities of the major Microsoft Purview solutions rather than detailed implementation steps.

What Is Microsoft Purview?

Microsoft Purview is Microsoft’s unified data governance, compliance, and risk management platform.

Purview enables organizations to:

Discover and classify data.
Protect sensitive information.
Govern information throughout its lifecycle.
Reduce insider threats.
Monitor AI-related risks.
Meet legal and regulatory obligations.

Purview works across:

Microsoft 365
Exchange Online
SharePoint Online
OneDrive
Teams
Microsoft Copilot
Power Platform
Endpoint devices
Third-party cloud services

Microsoft Purview Information Protection

Purpose

Microsoft Purview Information Protection (MIP) helps organizations classify and protect sensitive information.

It enables organizations to:

Identify sensitive data.
Apply sensitivity labels.
Encrypt content.
Control sharing permissions.
Track and monitor protected content.

Sensitivity Labels

Sensitivity labels classify content based on its importance.

Examples:

Public
General
Confidential
Highly Confidential

Labels can be applied to:

Emails
Word documents
Excel files
PowerPoint presentations
SharePoint sites
Teams
Microsoft 365 Groups

Protection Actions

Sensitivity labels can:

Encrypt Data

Only authorized users can open content.

Restrict Access

Prevent forwarding, printing, or copying.

Apply Visual Markings

Add:

Headers
Footers
Watermarks

Protect Copilot Data

Copilot respects existing permissions and sensitivity labels.

Benefits

Information Protection helps organizations:

Reduce accidental exposure.
Meet compliance requirements.
Maintain consistent classification.
Protect confidential information.

Microsoft Purview Data Loss Prevention (DLP)

Purpose

Data Loss Prevention (DLP) helps prevent sensitive information from being shared improperly.

DLP identifies sensitive information and automatically applies protection actions.

Examples of Sensitive Information

Credit card numbers
Social Security numbers
Passport numbers
Healthcare records
Financial information

DLP Actions

Policies can:

Block email transmission.
Prevent file sharing.
Warn users before sending data.
Generate alerts.
Create audit records.

Locations Protected by DLP

DLP policies can protect:

Exchange Online
SharePoint Online
OneDrive
Microsoft Teams
Endpoint devices

Example

A user attempts to email customer credit card information outside the company.

DLP can:

Detect the information.
Display a warning.
Block the message.

Benefits

DLP helps:

Prevent accidental leaks.
Support compliance requirements.
Educate users with policy tips.
Reduce organizational risk.

Microsoft Purview Insider Risk Management

Purpose

Insider Risk Management helps detect risky behavior from internal users.

Risks may be:

Accidental
Negligent
Malicious

Examples of Risky Activities

Downloading large amounts of files.
Sending confidential information externally.
Copying data to USB devices.
Unusual file access patterns.
Data theft before leaving the company.

Risk Indicators

The solution uses:

User activities
Behavioral signals
Microsoft 365 audit logs

Investigation Capabilities

Administrators can:

Review alerts.
Analyze activities.
Escalate incidents.
Document investigations.

Benefits

Insider Risk Management helps:

Reduce insider threats.
Detect suspicious behavior early.
Protect intellectual property.

Microsoft Purview Communication Compliance

Purpose

Communication Compliance helps organizations monitor communications for policy violations.

Content Sources

Communication Compliance can monitor:

Microsoft Teams chats
Emails
Copilot interactions
Other communication channels

Violations It Can Detect

Examples include:

Harassment
Threatening language
Offensive content
Inappropriate sharing
Regulatory violations

Review Process

Flagged communications are:

Detected automatically.
Reviewed by authorized reviewers.
Investigated when necessary.

Benefits

Communication Compliance helps:

Promote workplace safety.
Meet industry regulations.
Reduce legal exposure.
Enforce organizational policies.

Microsoft Purview Data Security Posture Management (DSPM) for AI

Purpose

DSPM for AI helps organizations understand and secure how AI systems interact with organizational data.

As AI adoption grows, organizations need visibility into:

What data AI tools can access.
Which users have access to sensitive information.
Potential AI-related risks.

DSPM for AI Capabilities

DSPM for AI helps organizations:

Discover AI Usage

Identify where AI tools are being used.

Assess Data Exposure

Understand whether sensitive data may be exposed.

Monitor Copilot Activity

Gain visibility into AI interactions.

Identify Oversharing Risks

Locate files with excessive permissions.

Strengthen AI Governance

Improve controls around AI usage.

Example

DSPM for AI may discover:

A SharePoint site containing confidential files.
Excessive permissions on the site.
Potential exposure to Copilot responses.

Administrators can then reduce permissions and improve security.

Benefits

DSPM for AI supports:

Responsible AI adoption.
Reduced oversharing risks.
Better governance of AI systems.

Microsoft Purview Data Lifecycle Management

Purpose

Data Lifecycle Management governs information throughout its lifecycle.

It ensures that information is:

Retained when required.
Deleted when no longer needed.
Managed according to regulations.

Retention Policies

Retention policies determine how long content should be kept.

Examples:

Content Type	Retention Period
HR records	7 years
Financial documents	10 years
General emails	3 years

Retention Labels

Labels can assign different retention periods to individual documents.

Example:

Contract documents retained for 10 years.
Project files retained for 5 years.

Automatic Deletion

When retention periods expire, content can be deleted automatically.

Benefits include:

Reduced storage costs.
Reduced legal risk.
Better compliance.

Records Management

Organizations can designate records that must not be altered or deleted before their retention period ends.

How These Purview Solutions Work Together

Solution	Primary Goal
Information Protection	Classify and protect content
DLP	Prevent data leakage
Insider Risk Management	Detect risky user behavior
Communication Compliance	Monitor communications
DSPM for AI	Secure AI data access
Data Lifecycle Management	Retain and dispose of data appropriately

Together, these capabilities provide a comprehensive governance framework for Microsoft 365 and Copilot.

Importance for Microsoft 365 Copilot

Copilot respects existing Microsoft 365 permissions and compliance controls.

Purview solutions help ensure:

Sensitive content is labeled.
Oversharing risks are minimized.
AI interactions remain compliant.
Records are retained appropriately.
Users do not accidentally expose confidential data.

Key Exam Points

Remember these AB-900 concepts:

Information Protection uses sensitivity labels to classify and protect content.
DLP prevents inappropriate sharing of sensitive data.
Insider Risk Management detects risky user behavior.
Communication Compliance monitors communications for policy violations.
DSPM for AI helps organizations govern AI usage and identify oversharing risks.
Data Lifecycle Management controls retention and deletion of information.
Microsoft Purview supports Microsoft 365, Copilot, and AI governance.

Practice Exam Questions

Question 1

Which Microsoft Purview solution primarily uses sensitivity labels to classify and protect content?

A. Communication Compliance
B. Data Lifecycle Management
C. Information Protection
D. Insider Risk Management

Correct Answer: C

Explanation: Microsoft Purview Information Protection uses sensitivity labels to classify and secure content.

Question 2

Which Microsoft Purview capability helps prevent users from emailing credit card numbers outside the organization?

A. Insider Risk Management
B. Communication Compliance
C. Data Loss Prevention (DLP)
D. Records Management

Correct Answer: C

Explanation: DLP detects sensitive information and can block or warn users before sharing it.

Question 3

Which solution is designed to identify potentially malicious or risky behavior by internal users?

A. Information Protection
B. Sensitivity Labels
C. Data Lifecycle Management
D. Insider Risk Management

Correct Answer: D

Explanation: Insider Risk Management focuses on identifying risky activities performed by users inside the organization.

Question 4

A company wants to monitor Teams messages for harassment and inappropriate language. Which Microsoft Purview solution should they use?

A. DLP
B. Communication Compliance
C. DSPM for AI
D. Information Protection

Correct Answer: B

Explanation: Communication Compliance analyzes communications for policy violations.

Question 5

What is the primary purpose of Microsoft Purview DSPM for AI?

A. Manage mailbox permissions
B. Secure and govern AI-related data exposure
C. Encrypt documents automatically
D. Replace Conditional Access

Correct Answer: B

Explanation: DSPM for AI provides visibility into AI usage and helps identify oversharing risks.

Question 6

Which Microsoft Purview capability determines how long information should be retained?

A. Insider Risk Management
B. Communication Compliance
C. Data Lifecycle Management
D. Information Protection

Correct Answer: C

Explanation: Data Lifecycle Management uses retention policies and labels to manage content over time.

Question 7

Which action can a sensitivity label perform?

A. Create Teams channels automatically
B. Synchronize users with Active Directory
C. Configure Conditional Access policies
D. Encrypt documents and restrict access

Correct Answer: D

Explanation: Sensitivity labels can apply encryption and restrict how information is used.

Question 8

Which Microsoft Purview solution helps identify oversharing risks that may affect Microsoft Copilot responses?

A. DSPM for AI
B. Communication Compliance
C. Data Lifecycle Management
D. Exchange Online Protection

Correct Answer: A

Explanation: DSPM for AI helps organizations understand how AI systems interact with organizational data and identify excessive permissions.

Question 9

A company must retain financial documents for ten years to meet regulatory requirements. Which capability addresses this need?

A. DLP
B. Insider Risk Management
C. Data Lifecycle Management
D. Communication Compliance

Correct Answer: C

Explanation: Retention policies and labels within Data Lifecycle Management ensure information is preserved for required periods.

Question 10

Which statement best describes the relationship between Microsoft Purview and Microsoft 365 Copilot?

A. Copilot ignores Purview policies.
B. Purview replaces Copilot permissions.
C. Copilot stores all data outside Microsoft 365.
D. Copilot works with existing Purview protections and permissions.

Correct Answer: D

Explanation: Microsoft 365 Copilot honors existing permissions, sensitivity labels, and compliance controls established through Microsoft Purview.

Go to the AB-900 Exam Prep Hub main page