Common settings for retention policies and retention label policies
Selecting Run a Power Automate flow enables moving labeled items to be moved to a certain location.
Reference:
https://learn.microsoft.com/en-us/purview/retention-settings

To meet the requirement that all administrative users must be able to create Microsoft 365 sensitivity labels, we need to assign the Sensitivity Label Administrator role to the correct users.
Sensitivity Label Administrator Role Responsibilities
This role allows users to:
*Create and manage sensitivity labels in Microsoft Purview.
*Publish and configure auto-labeling policies.
*Modify label encryption and content marking settings.
Review of Admin Roles from the Table:

Users that must be assigned the Sensitivity Label Administrator role:
*Admin2 (Compliance Data Administrator)
*Admin3 (Compliance Administrator)
*Admin1 (Global Reader) (should be assigned this role to fulfill the requirement that all admins can create labels).

Explanation:

Step 1 - Review scenario
You created a retention label policy Contoso_Policy.
Status shows Off (Error) with message: "It's taking longer than expected to deploy the policy." Requirement: Reinitiate the policy.
Step 2 - Correct PowerShell cmdlet
To manage retention label policies in Microsoft Purview (compliance), the cmdlet is:
Set-RetentionCompliancePolicy
Other cmdlets:
Set-RetentionPolicy # Legacy Exchange Online retention policies, not Purview label policies.
Start-EdgeSynchronization # Sync for Edge Transport servers, not retention.
Start-RetentionAutoTagLearning # Used for auto-tagging learning, not relevant here.
Step 3 - Correct parameter
To force redistribution of a retention label policy when deployment fails, the parameter is:
-RetryDistribution
Other options:
-ForceFullSync and -FullCrawl # Apply to search/crawl, not retention.
-Train # Related to auto-tagging learning models, not retention.
Final Verified Answer
Set-RetentionCompliancePolicy -id Contoso_Policy -RetryDistribution
Reference:
Set-RetentionCompliancePolicy (Microsoft Purview PowerShell)

Create and configure sensitivity labels
Step 1: From the Microsoft Purview compliance portal, select Solutions > Information protection > Labels Step 2: On the Labels page, select + Create a label to start the new sensitivity label configuration:

Step 3: On the Define the scope for this label page, the options selected determine the label's scope for the settings that you can configure and where they'll be visible when they're published.
In our case select: Items, Files, and select Word documents.

Note: If Items is selected, you can configure settings that apply to apps that support sensitivity labels, such as Office Word and Outlook. Optionally, you can extend these labels to include meetings from Teams and Outlook, and to protecting Teams meetings themselves by enforcing settings for Teams meetings and related chat.
Step 4: Follow the configuration prompts for the label settings. Use the help in the UI for individual settings.
Step 5: In the UI add a watermark of "Project Falcon" in red, size-12 font diagonally across the document.
Note: What sensitivity labels can do
After a sensitivity label is applied to an email, meeting invite, or document, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label to:
* Mark the content when you use Office apps, by adding watermarks, headers, or footers to email, meeting invites, or documents that have the label applied. Watermarks can be applied to documents but not email or meeting invites. Example header and watermark:

Step 6: Finish the Wizard
Reference:
https://learn.microsoft.com/en-us/purview/create-sensitivity-labels
https://answers.microsoft.com/en-us/msteams/forum/all/how-to-automatically-apply-sensitivity- labels-to/2482d1b2-1fe6-4a80-af4a-2b93b9c670de

When the sensitivity label applies encryption, the user must have the EXTRACT and VIEW usage rights for Copilot to summarize the data.
User1 - Yes
User1 is Co-Author.
Microsoft 365 co-authors typically have both view and extract permissions when working on documents collaboratively. Co-authors can view and edit the document, and also copy and extract content from it, depending on the specific permissions granted.
User2 - No
A "Reviewer" role generally has view permissions, but not necessarily extract permissions.
Reviewers can typically view the content of documents, files, or other resources, and often can add comments or make tracked changes (depending on the specific implementation and settings). However, they may not have the ability to download or export the content, unless explicitly granted those rights.
User3 - No
User3 has only view permission, not extract permissions.
Note:
If a user is the owner of a sensitivity label and that label is applied to a file, Microsoft 365 Copilot can summarize the file for that user, provided the user also has the necessary usage rights, specifically EXTRACT and VIEW, granted by the sensitivity label, according to Microsoft Learn. If the label includes encryption, these usage rights become crucial for Copilot's ability to access and summarize the content.
Reference:
https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-architecture-data- protection-auditing