🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided SC-401 Domain 2
Domain 2 — Module 7 of 8 88%
15 of 25 overall

SC-401 Study Guide

Domain 1: Implement Information Protection

  • Know Your Data: Sensitive Info Types Free
  • Custom Sensitive Info Types: Build Your Own Free
  • EDM & Fingerprinting: Detect Exact Data
  • Trainable Classifiers: AI-Powered Detection Free
  • Sensitivity Labels: Create & Protect Free
  • Sensitivity Labels: Publish & Auto-Apply
  • Email Encryption: Lock Down Messages
  • Purview IP Client: Classify Files at Scale

Domain 2: Implement DLP and Retention

  • DLP Foundations: Stop Data Leaks
  • DLP Policies: Build, Manage & Extend
  • DLP: Precedence & Adaptive Protection
  • Endpoint DLP: Setup & Configuration
  • Endpoint DLP: Advanced Rules & Monitoring
  • Retention: Plan Your Data Lifecycle
  • Retention Labels: Publish & Auto-Apply
  • Retention: Policies, Precedence & Recovery

Domain 3: Manage Risks, Alerts, and Activities

  • Insider Risk: Foundations & Setup
  • Insider Risk: Policies & Indicators
  • Insider Risk: Investigate & Close Cases
  • Adaptive Protection: Risk Levels Meet DLP
  • Purview Audit: Investigate & Retain
  • Activity Explorer & Content Search
  • Alert Response: Purview, XDR & Cloud Apps
  • DSPM for AI: Setup & Controls
  • DSPM for AI: Policies & Monitoring

SC-401 Study Guide

Domain 1: Implement Information Protection

  • Know Your Data: Sensitive Info Types Free
  • Custom Sensitive Info Types: Build Your Own Free
  • EDM & Fingerprinting: Detect Exact Data
  • Trainable Classifiers: AI-Powered Detection Free
  • Sensitivity Labels: Create & Protect Free
  • Sensitivity Labels: Publish & Auto-Apply
  • Email Encryption: Lock Down Messages
  • Purview IP Client: Classify Files at Scale

Domain 2: Implement DLP and Retention

  • DLP Foundations: Stop Data Leaks
  • DLP Policies: Build, Manage & Extend
  • DLP: Precedence & Adaptive Protection
  • Endpoint DLP: Setup & Configuration
  • Endpoint DLP: Advanced Rules & Monitoring
  • Retention: Plan Your Data Lifecycle
  • Retention Labels: Publish & Auto-Apply
  • Retention: Policies, Precedence & Recovery

Domain 3: Manage Risks, Alerts, and Activities

  • Insider Risk: Foundations & Setup
  • Insider Risk: Policies & Indicators
  • Insider Risk: Investigate & Close Cases
  • Adaptive Protection: Risk Levels Meet DLP
  • Purview Audit: Investigate & Retain
  • Activity Explorer & Content Search
  • Alert Response: Purview, XDR & Cloud Apps
  • DSPM for AI: Setup & Controls
  • DSPM for AI: Policies & Monitoring
Domain 2: Implement DLP and Retention Premium ⏱ ~13 min read

Retention Labels: Publish & Auto-Apply

Publish retention labels so users can apply them, or configure auto-apply policies to classify content at scale. Use adaptive scopes to target specific users, sites, or mailboxes dynamically.

Getting retention labels to work

☕ Simple explanation

Creating a retention label is like printing a filing instruction. Publishing it puts it on everyone’s desk. Auto-applying it sends a robot to file everything for you.

Retention labels do nothing until they’re published (so users can apply them) or auto-applied (so Purview applies them automatically). Adaptive scopes make policies smarter — instead of targeting “all Exchange mailboxes,” they dynamically target “mailboxes of all employees in the Finance department.”

Retention labels require a label policy to take effect. Publish policies make labels available for manual user application. Auto-apply policies automatically classify content based on SIT matches, keywords, trainable classifiers, or cloud attachments. Adaptive scopes use dynamic queries (based on Entra ID attributes, site properties, or mailbox attributes) to automatically include or exclude locations — so policies stay current as your organisation changes.

Publishing retention labels

A publish policy makes retention labels visible in users’ apps:

SettingWhat It Configures
Labels to publishWhich retention labels appear in the label picker
Users and groupsWho can see and apply the labels
LocationsWhere labels are available — Exchange, SharePoint, OneDrive, M365 Groups
Default labelOptionally set a default retention label for the location

Where users apply retention labels

LocationHow Users Apply
OutlookRight-click email → Assign policy
SharePoint / OneDriveDocument library → Column “Retention label” → Select label
Microsoft 365 GroupsApplied at the group/site level by admins

Auto-apply retention label policies

Auto-apply removes the dependency on users to classify content correctly:

Auto-apply conditions

ConditionHow It WorksBest For
SIT matchApply when content matches a sensitive info typeFinancial records, patient data, PII
Keywords or searchable propertiesApply based on specific words or metadataProject names, document types
Trainable classifiersApply when AI classifies the contentContracts, resumes, source code
Cloud attachmentsApply to files shared as links in email or TeamsShared documents that need retention
💡 Scenario: Zara auto-applies retention at Atlas Global

Zara configures auto-apply policies at Atlas Global:

  1. Employee contracts: Trainable classifier detects contracts → auto-apply “Employment Record — 5 Year” label
  2. Financial reports: SIT matches for financial data + keyword “quarterly report” → auto-apply “Financial — 7 Year” label
  3. Project documents: Keyword query for “project deliverable” in document properties → auto-apply “Project — 3 Year” label

These run as background services, scanning SharePoint, OneDrive, and Exchange. Auto-apply takes 7 days to process existing content, then handles new content continuously.

Adaptive scopes

Traditional (static) scopes require you to manually select specific sites, users, or groups. Adaptive scopes use dynamic queries that automatically include or exclude locations based on attributes.

Adaptive scopes automatically adjust as your organisation changes
FeatureStatic ScopeAdaptive Scope
How targets are selectedAdmin manually adds specific users, sites, or groupsDynamic query based on attributes — automatically updates
MaintenanceMust manually update when users join, leave, or change rolesAutomatically reflects changes in Entra ID or site properties
Limit per policyUp to 1,000 individual locations per policyUnlimited — query can match any number of locations
ExamplesSpecific SharePoint sites: site1, site2, site3All SharePoint sites where Department = 'Finance'
Best forSmall, stable sets of locationsLarge, dynamic organisations where people move between departments

Types of adaptive scopes

Scope TypeAttributes AvailableExample Query
User scopeEntra ID attributes: department, city, country, company, titleDepartment = “Finance” AND Country = “US”
SharePoint site scopeSite URL, site name, refinable stringsSite URL contains “/finance/“
Mailbox scopeMailbox attributes: CustomAttribute1-15CustomAttribute1 = “Trading”

Creating an adaptive scope

  1. Microsoft Purview portal → Data lifecycle management → Adaptive scopes
  2. Name the scope (e.g., “All Finance Users”)
  3. Choose scope type — user, site, or mailbox
  4. Build the query — select attributes and values
  5. Save — the scope is now available for any retention policy or label policy
💡 Exam tip: adaptive scope advantages

The exam tests when to use adaptive vs static scopes. Key advantages of adaptive scopes:

  • No 1,000-location limit — static scopes cap at 1,000 individual locations per policy
  • Automatic updates — when a user changes department, the scope adjusts automatically
  • Supports attribute-based queries — target by department, country, job title, site URL, or custom attributes
  • Required for some features — certain retention features only work with adaptive scopes

If a question describes a large, dynamic organisation where employees frequently change roles, adaptive scopes are the answer.

💡 Scenario: Dr. Liam uses adaptive scopes

St. Harbour Health has 5,000 employees across 12 clinics. Staff frequently transfer between clinics. Dr. Liam needs a 6-year retention policy for all clinical mailboxes.

With static scopes, he would manually add each clinical staff mailbox — and update the list every time someone joins, leaves, or transfers. With 400+ clinical staff changes per year, this is unsustainable.

With adaptive scopes:

  • Scope type: User scope
  • Query: Department = “Clinical” OR Department = “Nursing” OR Department = “Physician”
  • Result: The scope automatically includes new clinical hires and excludes departing staff — zero manual maintenance.
Question

What is the difference between publishing a retention label and auto-applying it?

Click or press Enter to reveal answer

Answer

Publishing makes the label available for users to manually apply via Outlook, SharePoint, or OneDrive. Auto-applying uses conditions (SITs, keywords, classifiers, cloud attachments) to automatically apply labels to matching content without user action.

Click to flip back

Question

What is an adaptive scope and when should you use it?

Click or press Enter to reveal answer

Answer

An adaptive scope uses dynamic queries based on Entra ID or site attributes to automatically include/exclude locations in a policy. Use when you have a large, dynamic organisation where manual location management is impractical. Adaptive scopes have no 1,000-location limit and automatically update when attributes change.

Click to flip back

Question

How long does auto-apply take to process existing content?

Click or press Enter to reveal answer

Answer

Auto-apply retention label policies can take up to 7 days to process existing content in the targeted locations. New content is processed continuously after the initial scan.

Click to flip back

Knowledge Check

Atlas Global has 15,000 employees across 40 countries. Zara needs a retention policy that applies to all Finance department mailboxes. People move in and out of Finance frequently. What scope type should she use?

Knowledge Check

Dr. Liam configured an auto-apply retention label policy for patient records (SIT: patient health identifiers) on Monday. By Wednesday, he checks and finds that only a small fraction of existing patient records have been labelled. What is the most likely explanation?

🎬 Video coming soon


Next up: Retention: Policies, Precedence & Recovery — understand how retention policies work at scale, how precedence resolves conflicts, and how to recover deleted content.

← Previous

Retention: Plan Your Data Lifecycle

Next →

Retention: Policies, Precedence & Recovery

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.