Four Purview settings that do less than their names suggest
Four Purview settings that do exactly what Microsoft documents, and a little less than their names suggest. All four are on the SC-401 skills list.
Label policy order
A user gets every sensitivity label and setting from every label policy that includes them. When two policies disagree on a setting, the policy with the highest order number wins, and that policy sits at the bottom of the list, not the top. Microsoft's page on sensitivity labels
Labels on sites and teams
A sensitivity label on a team, group or site controls the container: privacy, external user access and external sharing, access from unmanaged devices. The items inside don't inherit the label, so no encryption or content marking reaches them from it. Microsoft's page on labels for groups and sites
To label the files, a default sensitivity label on the SharePoint document library labels new files and files edited there. It doesn't apply to existing files at rest. Microsoft's page on a library's default label
Endpoint DLP scope
A DLP policy that includes the Devices location is enforced on an endpoint only when both the user and the device are in the policy's scope. A user in scope on a device out of scope gets no policy, and so does a device in scope with a user out of scope. Microsoft's DLP policy reference
Departing users
The Data theft by departing users template triggers on a resignation or termination date from the HR connector, or on the account's deletion in Microsoft Entra. A user in the policy with no triggering event isn't evaluated: the policy's indicators activate only after a triggering event, so the user's activity gets no risk score and raises no alert. Microsoft's page on the policy templates
Start scoring activity for users, on the Policies tab, brings a user into one or more policies for a set number of days without a triggering event. Microsoft's page on insider risk policies
The contract still there at year seven
A retention label deletes signed contracts seven years after creation. An org-wide retention policy keeps everything in SharePoint for eight years and then does nothing. At year seven the contract is still there, because retention wins over deletion. It goes at the end of year eight, by the label: the longest retention period wins, and the label's delete action was only suspended. Year eight by the policy is the tempting answer, with the right date and the wrong reason, since the policy has no delete action. Microsoft's page on retention
All four settings and the retention principles are on Microsoft's SC-401 skills list. Microsoft's SC-401 study guide
The SC-401 Administering Information Security in Microsoft 365 Complete Exam Guide works these as exam scenarios, the contract above among them. The card below links it.
The guide
SC-401 Administering Information Security in Microsoft 365 Complete Exam Guide
Prepare for Exam SC-401 by learning how Microsoft Purview controls interact, where the license line falls, and why a policy never fires.