You are a Microsoft 365 administrator for a company. You need to ensure that company documents are marked as confidential. You must prevent employees from sharing documents with people outside the…

DKIM is an email authentication mechanism used to validate that outbound emails are not spoofed or tampered with; it does not classify documents or prevent external sharing.

Sensitive information types define patterns for detecting sensitive data (like credit card numbers or SSNs) but by themselves do not mark documents as confidential or prevent external sharing without being used within a DLP policy.

S/MIME provides email encryption and digital signing to ensure message integrity and confidentiality in transit, but it does not label documents as confidential or prevent sharing with external parties.

A data-loss prevention (DLP) policy can detect sensitive or confidential documents and enforce rules that block or restrict sharing with external recipients, directly preventing employees from sharing company documents outside the organization.

Sensitivity labels allow you to classify and mark documents as confidential, and they can enforce protection settings such as encryption and access restrictions that prevent external users from accessing the labeled content.