Purview Information Protection

Quick Answer: Microsoft Purview Information Protection classifies content with sensitivity labels that enforce encryption, watermarking, and access restrictions. Microsoft 365 Copilot honors those labels and will not surface content the signed-in user is not authorized to access.

Why This Domain Dominates AB-900

Data Protection and Governance for Microsoft 365 and Copilot is the largest AB-900 domain at 35–40% of scored content. Within it, Microsoft Purview Information Protection is the classification layer every other control builds on. If labels are missing or permissions are too broad, Data Loss Prevention (DLP), retention, and Copilot grounding all inherit the same exposure risk.

The AB-900 exam tests whether you understand what sensitivity labels do, how they publish to users, and — critically — how Copilot interacts with labeled content retrieved through Microsoft Graph and the semantic index.

Microsoft Purview as the Governance Hub

Microsoft Purview is the unified compliance and data governance platform for Microsoft 365. For AB-900, focus on the Information Protection workload:

On the Exam: Information Protection is about classification and access control, not retention duration. Retention labels live in Data Lifecycle Management — a different Purview workload tested in its own section.

Sensitivity Labels Explained

A sensitivity label is a classification tag applied to emails, documents, Teams messages, and meeting artifacts. Labels can be purely descriptive (for example, Internal) or enforce protection settings:

• Encryption — only authorized users or groups can open the content, even after download.
• Access restrictions — block external sharing or limit editing.
• Watermarking — overlay a visible mark such as Confidential – Contoso.
• Header/footer markings — remind recipients of handling requirements.
• Protection for containers — apply default labels to SharePoint sites, Teams, or groups.

Organizations typically define a label hierarchy such as Public → Internal → Confidential → Highly Confidential. The AB-900 scenario pattern is straightforward: a user asks Copilot to summarize a document labeled above their clearance. Copilot will not surface or summarize that content because label permissions are enforced at retrieval time.

Label Policies vs Auto-Labeling

Two publishing mechanisms appear frequently on the exam:

Label policies make labels visible in Office apps, Outlook, SharePoint, and Teams so users can classify consistently. Auto-labeling policies scale governance by detecting patterns such as credit card numbers, health records, or custom trainable classifiers trained on sample documents.

For Copilot readiness, auto-labeling is high leverage: unlabeled overshared files are a primary source of unintended AI exposure. Labeling them before broad Copilot rollout reduces the blast radius.

How Copilot Respects Information Protection

Microsoft 365 Copilot retrieves organizational content through Microsoft Graph using the signed-in user's existing permissions. It does not bypass SharePoint, OneDrive, or Exchange access controls. Sensitivity labels add a second gate:

1. User submits a prompt in Word, Teams, or Copilot Chat.
2. Copilot queries the semantic index for conceptually relevant content.
3. Graph returns only items the user can already access.
4. If a matched item carries a label the user is not authorized to use, Copilot excludes it from the response.

This is why AB-900 stresses permissions plus labels together. A file might be technically accessible through a broken inheritance link and carry a Highly Confidential label — Copilot should still refuse to summarize it for unauthorized users.

Common Trap: Sensitivity labels do not make Copilot faster, translate content, or automatically write DLP rules. They govern access and protection. DLP is a separate Purview policy type.

Prompt Logging and Purview Audit

Governance also requires visibility. Prompt logging means capturing user prompts and Copilot responses in Microsoft Purview unified audit logs for compliance investigation — not the personal chat history a user sees in the Copilot interface.

Compliance administrators search these logs in the Purview portal to investigate policy violations, respond to regulatory inquiries, and support eDiscovery holds. AB-900 may ask you to distinguish Viva Insights Copilot Dashboard (adoption metrics) from Purview Audit (forensic prompt capture).

Worked Scenario: Pre-Rollout Labeling

A healthcare tenant plans to enable Copilot for 2,000 clinicians. Compliance discovers thousands of SharePoint files containing patient identifiers with no classification. The correct sequence for an AB-900 mindset:

1. Define sensitivity labels with encryption for PHI (Protected Health Information).
2. Deploy auto-labeling detecting medical record sensitive information types.
3. Run Data Access Governance reports to find overshared libraries.
4. Enable Audit (Premium) so Copilot interactions are retained for investigations.
5. Pilot Copilot with a labeled, permission-hardened subset before tenant-wide rollout.

Skipping step 1–3 and licensing Copilot immediately is the wrong answer — Copilot respects permissions, so overshared PHI becomes easier to discover through natural-language queries.

Study Checklist

• Explain sensitivity label protection scope and how Copilot honors label permissions.
• Differentiate Audit Standard vs Premium retention and Copilot event coverage.