A global enterprise wants to automatically label and protect documents containing PII in SharePoint Online and OneDrive, and encrypt emails in Exchange Online based on content. External recipients must be able to read but not print or download protected files. Users should see and apply labels in Office apps, and on-prem file shares must also be scanned and labeled. What should you implement?

The correct solution involves Microsoft Purview Information Protection sensitivity labels because they offer encryption, usage restrictions (like view-only for external recipients), and visual labeling in Office apps. Publishing label policies makes them available to users. Auto-labeling policies for Exchange Online and SharePoint Online automate the process based on content, fulfilling the requirement for PII. The Purview Information Protection (AIP Unified Labeling) scanner extends this capability to on-premises file shares. Incorrect options: Azure Rights Management with classic labels is an older technology largely superseded by sensitivity labels, which provide more comprehensive features and integration. Azure Policy is for managing Azure resources, not for applying sensitivity labels to content within SharePoint libraries. Purview retention labels are for data governance (retention and deletion), not for content encryption or usage restrictions. They do not encrypt content by default. SharePoint Information Rights Management (IRM) is specific to SharePoint and does not auto-label or encrypt emails in Exchange Online.