2.3 Sensitivity Labels & Endorsement

Classification Is Not Access Control

Quick Answer: A sensitivity label (from Microsoft Purview Information Protection) classifies an item — for example, marks a semantic model as Confidential — and can enforce protections like encryption on exported data. It does not decide who can open the item; that is still done by permissions and RLS/CLS/OLS. Endorsement marks trust level: Promoted = recommended by a creator; Certified = formally reviewed and approved by an authorized reviewer.

The most common DP-600 trap is treating a sensitivity label as a security boundary. A label is governance metadata with optional protection, not a replacement for permissions. If a question asks "who can see the data," the answer involves permissions/RLS, never a label.

Sensitivity Labels (Microsoft Purview)

• Defined centrally in the Microsoft Purview compliance portal and published through label policies; applied to Fabric items such as semantic models, reports, lakehouses, dataflows, and notebooks.
• Travel with the data: when a labeled report's data is exported to Excel, PDF, or PowerPoint, the label and any associated encryption go with the file, so a Confidential export stays Confidential on the user's laptop.
• Can enforce protection (encryption, watermarking, usage rights) via the label's policy, but access to the Fabric item itself is still governed by workspace/item permissions and data-level security.
• Support inheritance and downstream flow — a child report can inherit the source semantic model's label, and admins can mandate default or required labels so no item ships unclassified.

Endorsement: Promoted vs Certified

Endorsement helps consumers find trustworthy content among the clutter of an active workspace.

Key distinctions tested on the exam:

• Certified is gated. Not everyone can certify; a Fabric administrator defines the controlled list of who may apply Certified. Promotion is open to any item author.
• Endorsement is not deployment. Endorsing an item does not move it between workspaces — that is a deployment pipeline's job.
• Endorsement is not security. A Certified model is still subject to RLS/CLS/OLS and permissions; certification only signals quality and authority.
• Master data hub and discovery surface Certified items first, so certification materially affects how easily users find the authoritative version.

Putting It Together

A mature governance posture combines all three layers, each answering a different question:

So the gold-standard enterprise model is Certified, labeled Confidential, and protected by RLS so each region sees only its rows. Recognizing that these are three independent layers — and not interchangeable — is exactly what the scenario questions reward.

Label Policies and Enforcement Options

Purview label policies give administrators several enforcement levers that the exam may reference:

• Mandatory labeling — items cannot be saved or published without a label, eliminating unclassified content.
• Default label — newly created items inherit a baseline classification (often General or Internal).
• Downgrade justification — a user lowering a label (e.g., Confidential → General) must record a reason, creating an audit trail.
• Encryption via the label — the most sensitive labels can encrypt the underlying export and bind usage rights (open, edit, print) to specific Entra users or groups.

Labels also feed data loss prevention (DLP) policies and the Purview audit log, so a labeled-and-exported file's movement can be tracked centrally. None of this changes who can open the Fabric item — that remains permissions and RLS — but it governs the data once it leaves the service.

Endorsement Governance and Discovery

Certified content is surfaced first in the OneLake data hub and in the Get data experiences, steering analysts toward the authoritative source and away from rogue duplicates. Administrators should keep the certifier list short and publish clear certification criteria, because the value of the Certified badge collapses if everyone can apply it. The progression most organizations adopt is: author Promotes a candidate model → governance team reviews → an authorized reviewer Certifies. The exam rewards knowing that this last step is gated and that an author cannot self-certify.

Quick Comparison

Memorize the bottom row: neither feature is an access-control boundary, which is the single most-tested misconception in this topic.