You have a Microsoft 365 subscription. You plan to enable Microsoft Azure Information Protection. You need to ensure that only the members of a group named PilotUsers can protect content What should y

The Set-AadrmOnboardingControlPolicy cmdlet controls which users can activate the Azure Rights Management service for the tenant, not who can protect content after the service is active.

Azure Information Protection (AIP) policies are used to define and control how content is classified, labeled, and protected. By creating a policy and configuring its scope to include only the 'PilotUsers' group, you can ensure that the labels and protection settings defined within that policy are only available to members of that specific group, thereby controlling who can protect content.

The Add-AadrmRoleBasedAdministrator cmdlet grants administrative permissions to manage the Azure Rights Management service, not end-user permissions to apply protection to content.

Configuring the protection activation status typically refers to enabling or disabling the Azure Rights Management service for the entire tenant, which does not provide granular control over which specific users can protect content.