To publish a retention label to specific locations, create the label first, then create a static retention label policy in the Microsoft Purview portal, select "Let me choose specific locations," and choose your Exchange mailboxes and SharePoint sites as the policy's scope. For Exchange, you can select "All Exchange mailboxes" or choose specific mailboxes. For SharePoint, you must add classic and communication sites one by one in the policy's settings.
Publish the label with a static policy
Step 1: In the Microsoft Purview portal, go to Data lifecycle management > Policies > Label policies.
Step 2: Click Publish labels and then Choose labels to publish to select the Product Retired label.
Step 3: In the Policy scope section, choose Static and click Next.
Step 4: In the Choose where to publish labels screen, select Let me choose specific locations.
Step 5: For Exchange:
Select Exchange mailboxes. You can choose to apply it to All Exchange mailboxes or select specific ones from the list.
Step 6: For SharePoint:
Select SharePoint sites. You'll need to manually add the specific site collection addresses for both your classic and communication sites. A checkmark will appear next to the sites you add, and you can search for them in the next screen.
Step 7: Click Next, provide a name and description for the policy, and click Submit to create the policy.
Reference:
https://learn.microsoft.com/en-us/purview/create-apply-retention-labels

Explanation:
Box 1: Yes
User1 is included in the JIT protection scope.
File1.docx has the file classification evaluation status of not evaluated, and is located on Device1.
Device1 is onboarded.
JIT will block the action.
Note: In a Microsoft 365 environment with Purview and Just-in-Time (JIT) protection, a file with a
"not evaluated" classification status will be protected by JIT. When JIT protection is enabled, Endpoint DLP will block all egress activities on monitored files while waiting for policy evaluation to complete, including when the evaluation status is "not evaluated".
Box 2: No
User2 is not within the JIT protection scope.
Box 3: No
User3 is included in the JIT protection scope.
File3.docx has the file classification evaluation status of not evaluated, and is located on Device3.
Device3 is not onbarded.
Reference:
https://learn.microsoft.com/en-us/purview/endpoint-dlp-get-started-jit

n Microsoft 365, sensitivity labels can be applied to various file types including Word (.docx, .docm), Excel (.xlsx, .xlsm, .xlsb), PowerPoint (.pptx, .ppsx), and PDF documents. These labels can be applied to files stored in OneDrive and SharePoint, as well as attachments in Outlook emails.
Reference:
https://support.microsoft.com/en-gb/office/apply-sensitivity-labels-to-your-files-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9

Create and configure sensitivity labels
Step 1: From the Microsoft Purview compliance portal, select Solutions > Information protection > Labels Step 2: On the Labels page, select + Create a label to start the new sensitivity label configuration:

Step 3: On the Define the scope for this label page, the options selected determine the label's scope for the settings that you can configure and where they'll be visible when they're published.
In our case select: Items, Files, and select Word documents.

Note: If Items is selected, you can configure settings that apply to apps that support sensitivity labels, such as Office Word and Outlook. Optionally, you can extend these labels to include meetings from Teams and Outlook, and to protecting Teams meetings themselves by enforcing settings for Teams meetings and related chat.
Step 4: Follow the configuration prompts for the label settings. Use the help in the UI for individual settings.
Step 5: In the UI add a watermark of "Project Falcon" in red, size-12 font diagonally across the document.
Note: What sensitivity labels can do
After a sensitivity label is applied to an email, meeting invite, or document, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label to:
* Mark the content when you use Office apps, by adding watermarks, headers, or footers to email, meeting invites, or documents that have the label applied. Watermarks can be applied to documents but not email or meeting invites. Example header and watermark:

Step 6: Finish the Wizard
Reference:
https://learn.microsoft.com/en-us/purview/create-sensitivity-labels
https://answers.microsoft.com/en-us/msteams/forum/all/how-to-automatically-apply-sensitivity- labels-to/2482d1b2-1fe6-4a80-af4a-2b93b9c670de

Explanation:
Box 1: EnableMIPLabels
Enable sensitivity label support in PowerShell
To apply published labels to groups, you must first enable the feature. These steps enable the feature in Microsoft Entra ID. The Microsoft Graph PowerShell SDK comes in two modules, Microsoft.Graph and Microsoft.Graph.Beta.
Box 2: Microsoft 365
Assign sensitivity labels to Microsoft 365 groups in Microsoft Entra ID Microsoft Entra ID supports applying sensitivity labels to Microsoft 365 groups when those labels are published in the Microsoft Purview portal or the Microsoft Purview compliance portal and the labels are configured for groups and sites.
Sensitivity labels can be applied to groups across apps and services such as Outlook, Microsoft Teams, and SharePoint.
Reference:
https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels