The official skills outline for SC-900 Domain 4 (20–25%) lists items with almost identical names side by side: "sensitivity labels and sensitivity label policies" and "retention policies, retention labels, and retention label policies." The questions test exactly that difference. If you cannot tell what a label decides versus what a label policy decides, or at what level a retention policy versus a retention label applies, all four answer choices start to look right.
This post organizes Microsoft Purview information protection and data lifecycle management in the order "know your data → protect it → retain and delete it." It covers sensitive information types and trainable classifiers, Content explorer and Activity explorer, sensitivity labels and label policies, retention policies and retention labels, records management, and data governance.
---
Data Classification: First Know What Is Sensitive
A library may hold a million books, but without call numbers nobody can tell where the rare editions are. Data works the same way. Before you attach any protection policy, you have to find which documents and emails contain sensitive information, and Purview offers three ways to classify it automatically.
| Method | How it finds matches | Best suited for | |------|------|------| | Sensitive information types (SITs) | Patterns such as regular expressions, keywords, and checksums | Credit card numbers, passport numbers, bank account numbers | | Exact data match (EDM) | Checks for an exact match with real values stored in an organization database | Employee IDs, patient record numbers, customer numbers | | Trainable classifiers | AI and machine learning decide what kind of document an item is | Contracts, résumés, invoices, source code |
How a Sensitive Information Type Decides
A sensitive information type does not declare every nine-digit number a Social Security number. It also checks whether a word such as "Social Security Number" appears nearby and sets a level of confidence accordingly.
| Component | Meaning | |------|------| | Primary element | The main pattern it looks for (regular expression, keyword list, function, and so on) | | Supporting elements | Corroborating evidence that makes a match more likely (related keywords nearby, for example) | | Confidence level | Low, medium, or high; higher means fewer false positives but possibly more missed matches | | Proximity | How many characters away from the primary element the supporting elements must be |
You can use the built-in types Microsoft maintains as they are, or copy one to create a custom type that fits your organization. The classifications you define are shared across DLP policies, auto-labeling for sensitivity and retention labels, insider risk management, and communication compliance.
Trainable Classifiers
Trainable classifiers judge by the nature of the content rather than by a pattern. There are pretrained classifiers that Microsoft has already trained and that you can use right away (résumés, financial documents, harassment, and more). If none fits, you train your own by seeding it with samples that definitely belong in the category and samples that definitely do not, then verify its accuracy and publish it. Remember that classifiers do not work on encrypted items.
Exam tip: "Information with a fixed format, like credit card numbers" is a sensitive information type, "an exact match with real values in a database" is EDM, and "a clear document type with no fixed pattern, like contracts" is a trainable classifier.
---
Content Explorer vs Activity Explorer
Once classification is done, you need a window to look at the results. A warehouse inventory shows "what is here right now, how many, and where," while an entry log shows "who carried what out." The two Purview explorers split these roles.
| Aspect | Content explorer | Activity explorer | |------|------|------| | What it shows | A current snapshot of items that have a sensitivity label or retention label, or are classified as a sensitive information type | The actions users take on content that was discovered or labeled | | Question it answers | What sensitive data do we have, how much, and where? | Who did what with that data? | | Typical example | Number of files containing credit card numbers in Exchange, SharePoint, and OneDrive | Label downgraded from Confidential to General, file copied to USB, document printed | | Access | Can show file contents, so only designated role groups get access | Filters show details by label, user, and activity |
Exam tip: "What is where" is Content explorer, and "what activity took place" is Activity explorer. Activity explorer also receives endpoint DLP signals, so it shows printing and USB copying on Windows and macOS devices too.
---
Sensitivity Labels: A Protection Stamp That Travels with the File
Picture the "Confidential" stamp on a paper document. Wherever the document goes, the stamp goes with it. A sensitivity label is stored in clear text in the metadata of a document or email, so it moves along with its protection settings even when the file is copied or attached to a message. An item can carry only one sensitivity label at a time.
| What a label can do | Example | |------|------| | Encryption | Only specified users and groups can open the content, with defined actions and duration | | Content marking | Adds watermarks, headers, or footers | | Automatic or recommended labeling | Applies the label automatically, or recommends it to the user, when a sensitive information type is found | | Container protection | Controls access settings for Teams, Microsoft 365 groups, and SharePoint sites | | Extension to third-party apps | Other apps can read labels and apply protection through the Microsoft Information Protection SDK | | Classification only | Adds a tag without encryption or marking, to report on usage |
Label Scopes
When you create a label, you choose its scope, which decides what kind of content it can be used on.
| Scope | Covers | |------|------| | Files & other data assets | Word, Excel, PowerPoint, and PDF files, plus Fabric and Power BI items | | Emails | Outlook messages | | Meetings | Calendar events, Teams meeting options, and Teams chat | | Groups & sites | SharePoint sites, Teams sites, and Microsoft 365 groups (files inside are not labeled automatically) |
Sensitivity Label Policies
Creating a label is not enough for anyone to use it. A label appears in a user's Office apps only after it is published through a sensitivity label policy. Here is what a label policy decides.
Which users and groups can see the labels A default label applied automatically to new documents and emails Whether users must give a justification to lower or remove a label Mandatory labeling, which makes users choose a label before saving or sending A link to a custom help page that explains what each label means
Exam tip: A label decides what to protect and how, while a label policy decides who sees it and under which rules. "Apply a default label to all new documents" and "require a justification when lowering a label" are settings of the label policy, not of the label.
Related post: Purview Compliance and Information Protection
---
Retention Policies vs Retention Labels vs Retention Label Policies
An apartment complex rule such as "every unit separates its recycling" applies equally to the whole complex. A "keep for 10 years" sticker on a moving box applies only to that box and goes with it when the box moves. A retention policy is the complex rule, and a retention label is the sticker.
Retention settings produce one of three outcomes: retain only (for a period or forever), delete only after a period, or retain for a period and then delete. Content with retention settings stays in its original location, and if a user edits or deletes it, a copy of the original is kept automatically in a secure location that users cannot see. Retention applies to Exchange, SharePoint, OneDrive, Teams, and Viva Engage.
| Aspect | Retention policy | Retention label | |------|------|------| | Level applied | Container level, such as a site or mailbox | Item level, such as a document, email, or folder | | Several on one item | Multiple policies can apply at the same time | Only one at a time | | When the item moves | Settings do not follow it (based on the original container) | Follows it within the same Microsoft 365 tenant | | How it is applied | Specify locations (sites, mailboxes, users) | Applied manually by users, automatically by conditions, or as a SharePoint default label | | Disposition review | Not supported | Reviewers can check items before deletion | | Record declaration | Not possible | Can mark items as records |
Retention Label Policies
Like sensitivity labels, retention labels must be published after you create them. A retention label policy defines which locations (Exchange mailboxes, SharePoint sites, OneDrive accounts) and which users can use the labels, and it can also be set to apply labels automatically to items that meet conditions.
What Wins When Settings Overlap
When several retention settings apply to one item, these principles decide the outcome.
Retention wins over deletion. The longest retention period wins. For the deletion date, a retention label's delete action takes precedence over a retention policy's, and under the same conditions the shortest deletion period wins.
For example, if every document in a SharePoint site must be kept for five years but some contracts must be kept for ten, apply a five-year retention policy to the site and a ten-year retention label to just the contracts.
!Labels decide what to apply; policies decide where and to whom
Exam tip: "The same rule for the whole site" is a retention policy, "a different period or record handling for specific documents" is a retention label, and "which locations and users can use the label" is a retention label policy.
---