In this post we are going to cover sensitivity labels and Information Protection in Microsoft Purview: how you mark data as Public, General, Confidential or Highly Confidential, and what that label actually does. These are 7 real Purview interview questions, asked the way they come up on a real project, and the last one is a scenario where you roll out labels to ten thousand users in ninety days.
A sensitivity label says how sensitive an item is. It can be just a marker, or it can encrypt the file so only the right people can open it. Interviewers ask about labels because every company wants them, and because the details trip people up: what a label does in Office versus the Data Map, how it flows into Power BI, and which exports lose it.
Part 8 of the Real Time Microsoft Purview Interview Questions and Answers series on TechBrothersIT.
- The short answer
- Question 1: Legal wants every document and dataset marked Public, General, Confidential or Highly Confidential. What are sensitivity labels, and what can a label do?
- Question 2: Users forget to label files. What is the difference between default labels, mandatory labeling, client-side auto-labeling and service-side auto-labeling?
- Question 3: The data team asks: can we put sensitivity labels on Azure SQL columns and ADLS files? How do labels work in the Data Map, and what don't they do?
- Question 4: A lakehouse in Fabric holds HR data. How do labels flow from Fabric items to Power BI reports and exports?
- Question 5: Someone exported a Confidential Power BI report to Excel and emailed it out. What protection did the file keep, and which export keeps none?
- Question 6: Your manager asks for Highly Confidential to encrypt files so only HR can open them. How does label encryption work, and what can go wrong?
- Scenario 7: You are rolling out labels to ten thousand users. What is your plan for the first ninety days?
The short answer
A sensitivity label says how sensitive an item is and can encrypt, mark and protect it. Data Map labels (preview) are metadata only. In Fabric, labels flow downstream to Power BI; Excel, PDF and PowerPoint exports keep the label and protection, CSV keeps nothing, and inside the Power BI service a label alone doesn't control access.
Keep that in mind. Every question below is one piece of it.
Question 1: Legal wants every document and dataset marked Public, General, Confidential or Highly Confidential. What are sensitivity labels, and what can a label do?
A sensitivity label is a tag from Microsoft Purview Information Protection that says how sensitive something is. An item has one label, and the label stays with it.
First, the order. You list labels from least to most restrictive: Public, General, Confidential, then Highly Confidential at the bottom, with the highest priority. That order matters. It drives justification when someone downgrades a label, and it settles conflicts in auto-labeling.
Then, what a label can do. A label can:
- Encrypt the item.
- Add a watermark, header or footer.
- Protect a container like a team, a group or a SharePoint site.
- Auto-apply or recommend itself.
- Set the default sharing link.
- Classify only, with no protection at all.
Finally, the scope decides where the label shows up:
| Scope | Covers |
|---|---|
| FILES AND DATA ASSETS | Office, Power BI, Fabric, Data Map |
| EMAILS | Outlook messages |
| MEETINGS | calendar, Teams meetings |
| GROUPS AND SITES | the container, not the items |
Files and other data assets includes Power BI, Fabric items and Data Map assets. For groups and sites, the label protects the container itself, not the items inside it.
You publish labels to users and groups through label policies.
Stick to around five main labels. With more than that, users stop choosing carefully.
Question 2: Users forget to label files. What is the difference between default labels, mandatory labeling, client-side auto-labeling and service-side auto-labeling?
There are four ways to make sure files get a label, and they work at different points. Let's compare them first:
| What it does | Where | |
|---|---|---|
| DEFAULT LABEL | applied to new, unlabeled items | label policy; Power BI has its own |
| MANDATORY | the user must pick a label | save, send, groups, sites, Power BI |
| CLIENT-SIDE AUTO | recommend or apply; user can change it | Word, Excel, PowerPoint, Outlook |
| SERVICE-SIDE AUTO | policy labels it; simulation first | SharePoint, OneDrive, Exchange |
Now one at a time.
- Default label. A label policy setting: new and unlabeled documents get it. Power BI content has its own default. Microsoft warns against using an encrypting label as the default for documents.
- Mandatory labeling. The user must pick a label before they save a file, send an email, create a group or site, or use unlabeled Power BI content.
- Client-side auto-labeling. A setting on the label. Word, Excel, PowerPoint and Outlook spot sensitive information while the user works, and recommend or apply the label. The user can still change it.
- Service-side auto-labeling. A policy that runs in SharePoint, OneDrive and Exchange, without the app. It doesn't recommend, it labels. You must run a simulation first, it handles PDFs, and in Exchange it labels mail in transit, not mail already sitting in mailboxes.
E3 covers manual, default and mandatory labeling. Both kinds of auto-labeling need an E5-level license, like Microsoft 365 E5 or the Microsoft Purview Suite.
Question 3: The data team asks: can we put sensitivity labels on Azure SQL columns and ADLS files? How do labels work in the Data Map, and what don't they do?
Yes, with a big caveat: labeling in the Data Map is still in preview.
Let's walk through how it works. First, you extend your labels to Data Map assets using the files and other data assets scope. That covers things like Azure SQL columns and files in Azure Data Lake. Then the flow goes like this:
- A Data Map scan runs on Azure SQL or ADLS.
- The scan applies a classification, for example Credit Card Number.
- An auto-labeling policy maps that classification to a label.
- The label lands on the asset's metadata on the next scan.
You can't label by hand here, because manual labeling in the Data Map isn't supported. It is auto-labeling or nothing.
Now the part interviewers test. These labels are metadata only:
- They don't change the files or the columns.
- No encryption, no markings.
- No DLP in the Data Map.
- SQL's own sensitivity classification is a separate system.
So what if you need real enforcement on storage? Protection policies, also in preview, can deny access to labeled ADLS Gen2 and Blob data. They no longer support Azure SQL Database.
You also need at least one Microsoft 365 E5 license plus pay-as-you-go billing.
Question 4: A lakehouse in Fabric holds HR data. How do labels flow from Fabric items to Power BI reports and exports?
They flow downstream. Label the lakehouse Highly Confidential, and the items built on it inherit that label.
Let's follow it step by step:
- The lakehouse with the HR data is labeled Highly Confidential.
- Downstream inheritance is on by default, so the semantic model built on the lakehouse becomes Highly Confidential.
- The Power BI reports on that model become Highly Confidential too.
- On export to Excel, PDF or PowerPoint, the label is kept.
A notebook or pipeline created from the lakehouse takes its label as well. But inheritance only goes one way:
| Direction | Inherits? |
|---|---|
| Fabric to Fabric | Yes |
| Fabric to Power BI | Yes |
| Power BI to Power BI | Yes |
| Power BI to Fabric | No |
On export, only Power BI items keep the label, on supported paths. Other Fabric experiences don't carry the label out; they show a warning instead.
Here are the two gotchas I mention in an interview:
- Inheritance from data sources, like Azure SQL, works only for Power BI semantic models.
- Mandatory labeling is fully supported only for Power BI items, so a lakehouse can still be saved without a label.
Use the OneLake catalog to track label coverage across your Fabric items.
Question 5: Someone exported a Confidential Power BI report to Excel and emailed it out. What protection did the file keep, and which export keeps none?
The Excel file kept the label. And if Confidential applies encryption, it kept that too, so only the people the label allows can open it, wherever the email goes.
The same is true for the other supported export paths:
| Export path | Label | Encryption |
|---|---|---|
| EXCEL, ANALYZE IN EXCEL | kept | kept |
| kept | kept | |
| POWERPOINT (AS IMAGE) | kept | kept |
| PBIX DOWNLOAD | kept | kept |
| CSV | none | none |
A live PivotTable keeps it too. The export that keeps nothing is CSV: no label and no protection. The same goes for any other unsupported export path.
Now here is the trap. Inside the Power BI service, a label doesn't control access by itself. Power BI permissions decide who can view and export.
So it comes down to whether the label encrypts:
- Encrypting label: the protection travels with the file.
- Not encrypting: the file is only marked, and you rely on tenant export settings and DLP, for example in Exchange, to stop it leaving.
Question 6: Your manager asks for Highly Confidential to encrypt files so only HR can open them. How does label encryption work, and what can go wrong?
Label encryption uses the Azure Rights Management service. Let's set it up in order:
- Activate Azure Rights Management in the tenant.
- On the Highly Confidential label, choose assign permissions now.
- Add the HR security group and give it the rights it needs.
- The file is encrypted. The HR group opens it, and other users are blocked, wherever the file goes, with two exceptions we'll come to.
You can also set content expiry and offline access. For sensitive data, Microsoft suggests a short offline window, like seven days.
Now what goes wrong:
- If sensitivity labels for SharePoint and OneDrive aren't enabled, search and eDiscovery can't read encrypted files, and DLP only sees their metadata.
- Copilot needs the extract right, as well as view, to use encrypted content.
- Whoever applies the label is the Rights Management issuer, and always keeps full control, even if they are outside HR. That is the first exception.
- The super user feature is off by default. Enable it for a small, audited group, so you can always recover protected files. That is the second exception.
- Don't make this label the default for documents. Microsoft warns against encrypting defaults.
Scenario 7: You are rolling out labels to ten thousand users. What is your plan for the first ninety days?
Let's build it in three phases of thirty days.
Days 1-30: design
- Agree a short taxonomy with legal: Public, General, Confidential and Highly Confidential.
- Only the top labels encrypt.
- Activate Rights Management.
- Enable labels for SharePoint and OneDrive.
- Turn on the Fabric setting that lets users apply labels.
Days 31-60: pilot
- Publish the labels to champions from each department.
- Set General as the default.
- Require justification to downgrade.
- Run service-side auto-labeling in simulation. Simulation still raises alerts, so it isn't silent.
Days 61-90: expand
- Expand in waves, department by department.
- Turn on mandatory labeling, including Power BI.
- Switch on auto-labeling once the simulation results look right.
- Remember that policy changes can take up to 24 hours to arrive.
- Measure label coverage every week, show leadership the trend, then move on to DLP.
E3 users get manual, default and mandatory labeling, but auto-labeling needs E5-level licenses. Know who has what before you promise auto-labeling.
Key points to remember
- A label marks sensitivity and can encrypt and protect
- Auto-labeling: client-side or service-side, E5-level
- Data Map labels: preview, metadata only
- Fabric labels flow downstream to Power BI
- Excel, PDF, PowerPoint keep it; CSV keeps nothing
Part 9: DLP, Insider Risk, DSPM, Audit and eDiscovery
Part of the Real Time Microsoft Purview Interview Questions and Answers series on TechBrothersIT. Product names, features and their status (GA or preview) are current as of October 2026. Microsoft changes Purview every month, so check the Microsoft Learn page for anything you quote in an interview.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.