An organisation has integrated Microsoft Purview with Microsoft Fabric and published sensitivity labels for use across the tenant. A data engineer applies the Confidential label to a Lakehouse, and another engineer later builds a semantic model and a report from that Lakehouse. The governance team wants to understand the prerequisites and behaviour of sensitivity labels for Fabric content. Which TWO statements about sensitivity labels in Microsoft Fabric are correct? Select TWO.
- ASensitivity labels can be applied to Fabric items only after a workspace administrator converts the workspace into a dedicated Purview compliance workspace first.
- BSensitivity labels must be created and published in Microsoft Purview and enabled for Fabric in the tenant before users can apply them to Fabric items. Correct
- CApplying a label to a Fabric item encrypts the underlying OneLake Parquet files so that even tenant administrators cannot read them without the label's key.
- DWhen a child item such as a semantic model is created from a labelled source, the label can be inherited downstream so classification follows the lineage. Correct
Why A is wrong: It is tempting because Purview governs the labels, but no special compliance workspace exists; labels are published in Purview and enabled tenant-wide for Fabric, then applied to ordinary items.
Why B is correct: Labels originate in the Purview compliance portal and require the Fabric tenant setting that allows applying labels, so this prerequisite chain is correct.
Why C is wrong: This overstates protection; labels classify items and can drive encryption on exports, but they do not encrypt the OneLake storage files themselves in this manner.
Why D is correct: Downstream inheritance propagates a source item's label to items built from it, so the classification follows the data lineage as described.