🎯 SharePoint Course · Module 6 of 7
Compliance, DLP & Sensitivity Labels
📂 Course: SharePoint Online Administration
📦 Module: 6 of 7
🎯 Exam: MS-102
⏱ Read time: ~24 min
📦 Module: 6 of 7
🎯 Exam: MS-102
⏱ Read time: ~24 min
MS-102 Exam Alignment
MS-102
- Know that sensitivity labels applied to SharePoint sites control external sharing capability, access from unmanaged devices, and private channel access for Microsoft Teams — separate from labels applied to files
- Know that retention policies on SharePoint preserve content for a minimum period and/or delete content after a maximum period — applied at the site or library level from the Microsoft Purview compliance portal
- Know that SharePoint DLP policies detect and protect sensitive information in documents stored in SharePoint and OneDrive
- Know that SharePoint audit logs are accessed from the Microsoft Purview compliance portal (not the SharePoint admin center)
Exam Tip: Sensitivity labels applied to a site or M365 Group control the site’s privacy setting, external sharing level, and unmanaged device access — these are container labels. Sensitivity labels applied to a file control encryption, access, and watermarking of the file itself — these are content labels. MS-102 tests both but distinguishes between them.
SharePoint Online stores sensitive corporate content — financial records, HR documents, legal contracts. Protecting this content requires layered controls: sensitivity labels restrict what happens at the site level, retention policies ensure content is kept (or deleted) according to governance requirements, DLP policies detect sensitive information and prevent leakage, and audit logs provide the evidence trail for compliance.
🏷️ Sensitivity Labels on SharePoint Sites
Sensitivity labels applied to SharePoint sites (and the backing M365 Groups) are called container labels — they control the site’s security settings, not individual file content.
| Site Label Setting | What It Controls |
|---|---|
| Privacy | Public (anyone in org can find and join) or Private (only invited members can access). Overrides the Teams/Group privacy setting |
| External user access | Controls whether guests can be added to the M365 Group and site — Allow or Block external users |
| External sharing | Controls the site’s maximum external sharing level — Anyone, New and existing guests, Existing guests, or Only org. Overrides per-site sharing settings |
| Unmanaged device access | Allow full access from unmanaged devices, allow limited web-only access, or block access from devices not enrolled in Intune or not hybrid joined |
| Teams settings | Control private channel creation, shared channel creation, and channel meeting recording for the backing Teams team |
💡 Applying Sensitivity Labels to Sites
Sensitivity labels must be enabled for M365 Groups and SharePoint sites by running Set-SPOTenant -EnableAIPIntegration $true. Once enabled, site owners can apply labels from Site Settings → Site information → Sensitivity, or admins can apply via PowerShell. The label’s configured policies are enforced immediately on the site.
📋 Retention Policies on SharePoint
Retention policies ensure that SharePoint content is preserved for a minimum period and/or deleted after a maximum period. Configured in the Microsoft Purview compliance portal → Data lifecycle management → Retention policies.
| Concept | Description |
|---|---|
| Retain only | Keep content for a specified period. Content cannot be permanently deleted during the retention period — it’s preserved in the Preservation Hold library |
| Delete only | Automatically delete content after a specified period. No retention hold — just automated deletion for data minimisation |
| Retain then delete | Retain for a period (e.g., 5 years) then automatically delete at the end of the retention period |
| Preservation Hold library | A hidden library in each SharePoint site that stores copies of deleted or modified items during a retention period. Users cannot see or access it; compliance admins can via eDiscovery |
| Scope | Applied to: all SharePoint sites, specific site URLs, or OneDrive accounts. Can also target specific document libraries within a site using retention labels (not policies) |
🔒 SharePoint DLP Policies
Data Loss Prevention (DLP) policies detect documents containing sensitive information types stored in SharePoint and OneDrive, then take protective actions.
| DLP Action | Description |
|---|---|
| Show policy tip to user | Displays a notification to the user when they open or share a file containing sensitive info — educates without blocking |
| Send incident report to admin | Sends an email alert to the compliance team when a policy match is detected |
| Restrict access or encrypt content | Blocks sharing of the document externally or applies encryption. The most restrictive DLP action for SharePoint |
| Auditing only | Logs the detection without taking any action — used to assess scope before enforcing a policy |
📊 SharePoint Audit Logs
SharePoint audit events are captured in the Microsoft 365 unified audit log, accessible from Microsoft Purview compliance portal → Audit. The SharePoint admin center does not have its own audit log viewer.
| Logged Event Category | Examples |
|---|---|
| File activities | FileAccessed, FileDownloaded, FileModified, FileDeleted, FileMoved, FileUploaded |
| Sharing activities | SharingInvitationCreated, SharingLinkCreated, AnonymousLinkCreated, SharingRevoked |
| Permission activities | PermissionLevelAdded, SiteCollectionAdminAdded, SharingPermissionChanged |
| Site administration | SiteCreated, SiteDeleted, SiteLockedChange, StorageQuotaUpdated |
PowerShell — Compliance & Audit
# Search unified audit log for SharePoint file downloads Connect-ExchangeOnline Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType SharePointFileOperation -Operations FileDownloaded | Select-Object CreationDate,UserIds,Operations,AuditData # Search for external sharing events in last 30 days Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -RecordType SharePoint -Operations SharingInvitationCreated,AnonymousLinkCreated | Select-Object CreationDate,UserIds,AuditData # Check sensitivity label applied to a specific site Connect-SPOService -Url https://your-tenant-admin.sharepoint.com Get-SPOSite -Identity https://your-tenant.sharepoint.com/sites/HRSite | Select-Object Url,SensitivityLabel
💡 Best Practices
- Apply sensitivity labels to all SharePoint sites and M365 Groups — even if the label only sets privacy to “Private” and blocks unmanaged devices, it establishes a consistent governance baseline
- Target retention policies at specific site URLs for high-value content (HR, Finance, Legal) rather than all SharePoint — blanket retention on all sites creates storage costs
- Run DLP policies in simulation (audit) mode first for at least two weeks — this reveals how many documents match the policy and identifies false positives before enforcement blocks legitimate sharing
- Configure audit log retention for at least 1 year to support compliance investigations that surface months after an incident
🎓 Interview Q&A
Q: A sensitivity label is applied to a SharePoint site with the setting “Block access from unmanaged devices.” A user on a personal laptop tries to access the site. What is their experience?
The user is blocked from accessing the site if their device is not managed (not enrolled in Intune or not hybrid Entra joined). Depending on the label configuration, they may receive a “You can’t access this resource” error, or they may be allowed browser-only limited access if the label is configured for limited web access rather than full block. The label enforces this via a Conditional Access policy that the SharePoint admin does not need to create manually — the label automatically creates the required CA policy when applied to the site.
🎯 MS-102 Mock Test
Module 6 — Compliance, DLP & Sensitivity Labels
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A sensitivity label applied to a SharePoint site is configured to block external sharing. A site owner tries to change the site’s sharing setting to “Anyone.” What happens?
AThe site owner can override the label setting from site settings
BThe site owner cannot change the sharing setting — the sensitivity label overrides and locks it. Only a compliance admin can change the label or its settings
CThe sharing setting changes but the label’s block is still enforced at the network level
DThe label is automatically removed from the site when the sharing setting changes
✅ B. Sensitivity labels applied to SharePoint sites override and lock the settings they control. If the label blocks external sharing, the site owner sees the sharing option greyed out or locked — they cannot override it. Only a compliance or SharePoint administrator who can change the label configuration or remove the label from the site can alter this setting.
Q2 of 5
A user deletes a document from a SharePoint library that has a retention policy set to “Retain for 7 years.” Where does the document go?
AThe document is permanently deleted — retention policies do not affect user deletions
BThe document goes to the site Recycle Bin for 93 days then is permanently deleted
CThe deletion is blocked — users cannot delete documents under retention
DThe document appears to be deleted to the user but a copy is preserved in the hidden Preservation Hold library for 7 years
✅ D. When a retention policy is active, SharePoint preserves a copy of the document in the hidden Preservation Hold library before completing the deletion. From the user’s perspective the document is deleted — it disappears from the library. But a compliance-preserved copy exists (hidden from regular users) and is accessible to compliance admins via eDiscovery for the full 7-year retention period.
Q3 of 5
Where are SharePoint Online audit logs accessed?
ASharePoint admin center → Reports → Audit
BMicrosoft 365 admin center → Reports → SharePoint activity
CMicrosoft Purview compliance portal → Audit — SharePoint events are part of the Microsoft 365 unified audit log
DEach SharePoint site → Site contents → Audit reports
✅ C. SharePoint audit events are captured in the Microsoft 365 unified audit log, accessed via the Microsoft Purview compliance portal → Audit. The SharePoint admin center does not have its own audit log viewer. Events logged include file access, downloads, shares, permission changes, and admin actions.
Q4 of 5
A DLP policy detects a SharePoint document containing credit card numbers that a user is trying to share externally. What is the recommended first action when deploying a new DLP policy?
ARun the policy in simulation/audit mode first to understand the scope of matches before enforcing it
BImmediately enforce the policy with block actions to protect data from the start
CApply the policy to only one test site first, then expand to all sites after 24 hours
DConfigure the policy to only show policy tips with no other actions
✅ A. Best practice is to run a new DLP policy in simulation (audit/test) mode first. This evaluates the policy against all current SharePoint and OneDrive content and reports matches without taking any blocking action. The compliance team reviews results to identify false positives and tune the policy before switching to enforcement mode.
Q5 of 5
What is the difference between a sensitivity label applied to a SharePoint site vs one applied to a file within that site?
AThere is no difference — both labels apply the same settings to all content in the site
BSite labels apply to files; file labels apply to the whole site
CA site label (container label) controls the site’s privacy, external sharing, and device access settings. A file label controls the file’s encryption, access rights, and watermarking — and travels with the file when it is downloaded or emailed
DFile labels are enforced by DLP policies; site labels are enforced by retention policies
✅ C. Container labels (site labels) control the site/group’s settings — privacy, external sharing level, and unmanaged device access. They do not encrypt the content. Content labels (file labels) are applied to individual documents and control encryption, access rights, and visual markings. File labels travel with the document when downloaded or shared by email — protection persists outside SharePoint.
🔒
Locked — Complete Module 5 first.