Microsoft Information Security Administrator

You cannot protect what you have not found. You define sensitive information types with patterns and keywords, train classifiers, use exact data match for precise cases, and read where sensitive content sits.

• Built-in sensitive information types
• Custom types with patterns, keywords and dictionaries
• Exact data match for structured records
• Trainable classifiers
• Content explorer and activity explorer
• Testing a classifier for false positives

You build A custom sensitive information type and a trainable classifier, both tested against sample documents.

Labels are how classification becomes protection. You design a label taxonomy people can follow, set encryption and marking, publish with policies, and add automatic labeling for content users will not label themselves.

• A label taxonomy that people will actually use
• Encryption, access rights and content marking
• Label scopes: files, email, meetings and containers
• Label policies and mandatory labeling
• Automatic labeling on the client and in the service
• Labels for Teams, sites and groups

You build A published label set with encryption, a label policy and an auto-labeling rule for one data type.

Protection has to follow data to where it is kept. You apply labels on Windows endpoints, scan and label on-premises file shares, and secure email with Message Encryption and its branding and rights options.

• Applying and changing labels on Windows
• Scanning file shares with the information protection scanner
• Rights management and what encryption does to a file
• Microsoft Purview Message Encryption for email
• Branding and recipient experience for encrypted mail
• Recovering protected content when a user leaves

You build A protection plan covering a laptop, a file share and a mailbox, with the settings for each.

DLP watches the places data moves and stops the moves that should not happen. You build policies across Exchange, SharePoint, OneDrive and Teams, tune them in simulation, and shape alerts and tips that guide users instead of blocking work.

• Policy anatomy: locations, conditions and actions
• DLP for Exchange, SharePoint, OneDrive and Teams
• Policy tips, overrides and user notifications
• Simulation mode and staged rollout
• Alerts, incidents and investigation
• Reducing false positives

You build A DLP policy for one regulated data type, run in simulation with its results reviewed.

Much data leaves from the device itself, through USB, browsers and apps. You onboard endpoints, restrict risky actions, and apply just-in-time protection so controls tighten only when a user does something risky.

• Onboarding Windows and macOS devices for Endpoint DLP
• Restricting copy to USB, cloud and clipboard
• Browser and app restrictions
• Just-in-time protection
• Allowed apps, groups and authorized devices
• Reading endpoint activity

You build An Endpoint DLP policy set that blocks one risky action and audits another, tested on an enrolled device.

Keeping everything is a risk, and deleting too soon is a bigger one. You plan retention with policies and labels, scope them with adaptive scopes, and review what is disposed of at the end of its life.

• Retention policies and retention labels compared
• Adaptive scopes versus static scopes
• Publishing and auto-applying retention labels
• Records and regulatory records
• Disposition review
• Resolving conflicts when policies overlap

You build A retention schedule for four content types, built as labels with adaptive scopes.

Some of the largest losses come from people with legitimate access. You set up Insider Risk Management policies, tune indicators and thresholds, handle cases fairly, and link risk level to the controls that respond to it.

• Policy templates and the scenarios they cover
• Indicators, thresholds and triggering events
• Privacy: pseudonymization and who may see what
• Alerts, cases and investigation
• Adaptive Protection and linking risk to DLP
• Working with HR and legal

You build An Insider Risk policy for a departing-employee scenario, with an investigation workflow.

When something goes wrong you need a record of what happened. You search Purview Audit, set retention for audit data, read activity explorer, and build the alerts that tell you when a pattern appears.

• What Purview Audit records and for how long
• Searching and exporting audit logs
• Audit retention policies
• Activity explorer for labels and DLP events
• Alert policies for suspicious patterns

You build An investigation that reconstructs one user’s file activity from audit and activity explorer data.

AI assistants surface whatever a user can reach, which makes oversharing visible overnight. You use Data Security Posture Management for AI to see how data meets AI, and apply labels and DLP so assistants respect the same boundaries as people.

• How AI assistants reach organizational data
• Data Security Posture Management for AI
• Finding and fixing oversharing before rollout
• Labels and DLP that apply to AI interactions
• Auditing and reviewing AI activity

You build An AI readiness review that lists oversharing risks in a sample tenant and the controls that close them.

One scenario brings every control into a single program. You classify, label, protect, retain and monitor a company’s data, then explain how each control supports the others and where the gaps remain.

• Scoping the data and the regulations in play
• Classification and labeling design
• DLP, retention and insider risk controls
• Audit, reporting and AI protections
• Presenting the program and its open risks

You build A data protection program for a sample organization: labels, DLP, retention, insider risk and AI controls.