SC-401 Study Guide

Before you can protect data, you need to know what counts as sensitive in your organization. This skill is about translating business and regulatory requirements (things like credit card numbers, health records, or an internal project code) into something Purview can detect.

What you need to know

• Classification is the foundation for every other protection: DLP, auto-labeling, retention, and insider risk all act on what the classifiers find
• Requirements usually come from regulations (PCI, HIPAA, GDPR), contracts, and internal policy
• Microsoft Purview finds sensitive data three ways: manually by users, with automated pattern matching (sensitive information types), and with machine learning (trainable classifiers)
• Data is classified automatically as it is created or changed, using whatever sensitive information types are defined in the tenant

Microsoft Learn resource: Learn about sensitive information types (opens in a new tab)

A sensitive information type (SIT) is a pattern Purview looks for. Microsoft ships more than 200 built-in SITs, and you map your requirements to those first, only building custom ones when nothing fits.

What you need to know

• A SIT is made of a primary element (a regex, keyword list, keyword dictionary, or function), supporting elements, a confidence level, and a character proximity window
• Confidence level (High, Medium, Low) reflects how much supporting evidence was found near the primary element, not how "important" the data is
• Built-in SITs cover common identifiers like credit cards, passport numbers, and national IDs
• Named entity SITs (like "all full names" or "medical terms") are broad and are meant to be combined with other conditions, not used alone

Exam tip: Higher confidence means fewer false positives but more false negatives. Expect a scenario that asks you to raise confidence to cut noise, or lower it to catch more.

Microsoft Learn resource: Sensitive information type entity definitions (opens in a new tab)

When no built-in SIT matches, such as an internal employee ID format, you build a custom one from scratch or copy and modify an existing SIT.

What you need to know

• You create custom SITs in the Microsoft Purview portal under Information Protection > Classifiers > Sensitive info types
• Microsoft 365 uses the Boost regex engine, so patterns follow that syntax
• You can copy a built-in SIT and tune it, but some built-in SITs (several EU identity types) cannot be copied
• After you create or change a custom SIT, existing content must be recrawled before it is reclassified; new and edited content is evaluated automatically

Microsoft Learn resource: Create custom sensitive information types (opens in a new tab)

Document fingerprinting turns a standard form or template (a patent application, a government form, an employee agreement) into a SIT, so Purview can spot documents based on that template.

What you need to know

• You upload a blank template, and Purview creates a fingerprint from its structure
• Fingerprinting is best for fixed-layout, standardized documents
• You can require an exact match, or allow partial matching so lightly edited copies are still detected
• Fingerprint SITs are used in DLP policies the same way as any other SIT

Microsoft Learn resource: Document fingerprinting (opens in a new tab)

Exact Data Match (EDM) matches against your actual data, such as a table of real customer records, so it flags a match only when the value truly belongs to your organization. This dramatically cuts false positives.

What you need to know

• You define a schema, upload a sensitive information source table, and only a salted hash of the data is uploaded, so the real values never leave your control
• An EDM SIT has a primary element mapped to a strongly defined base SIT, plus supporting elements that raise confidence
• A schema can have up to ten fields marked as searchable, and at least one must be searchable
• Map the primary element to a tight SIT (like SSN), not a loose one (like "any number"), or the classifier throttles and misses matches

Exam tip: EDM is the answer when the requirement is "only match our real customers/employees, not any number that looks like an SSN."

Microsoft Learn resource: Learn about exact data match based sensitive information types (opens in a new tab)

Trainable classifiers use machine learning to recognize a category of content by example (contracts, resumes, source code) rather than by a fixed pattern. They are for content that has no reliable regex.

What you need to know

• Two kinds exist: pre-trained classifiers Microsoft provides, and custom classifiers you train with your own sample content
• A custom classifier is seeded with positive sample items, then tested against more items before you publish it
• Trainable classifiers work with sensitivity labels, auto-apply retention labels, DLP, and communication compliance
• They can misfire on content unlike the training set, so review results and give match or not-a-match feedback to improve accuracy

Microsoft Learn resource: Learn about trainable classifiers (opens in a new tab)

Once classification is running, you need to see what was found and what users are doing with it. That is the job of the explorers in the Microsoft Purview portal.

What you need to know

• Content explorer access is gated by two roles: one to see counts (Content Explorer List viewer) and one to open the actual items (Content Explorer Content viewer)
• Both explorers are found under Information Protection > Explorers in the Purview portal
• Classification runs before you create any policy, so you can see impact first (this is the "zero change management" idea)

Microsoft Learn resource: Get started with Content explorer (opens in a new tab)

OCR lets Purview read text inside images (screenshots, scanned documents, photos of a whiteboard) so your SITs and trainable classifiers can find sensitive data in pictures, not just documents and email.

What you need to know

• OCR is optional and off by default; you turn it on at the tenant level under Settings in the Purview portal
• It requires pay-as-you-go billing through Microsoft Syntex in Azure (you do not have to set up Syntex itself)
• Once on, every SIT, EDM SIT, trainable classifier, and fingerprint SIT can scan images, with no separate classifiers to create
• Supported locations include Exchange, SharePoint, OneDrive, Teams, and Windows and macOS devices; each image scanned is one billed transaction, and each PDF page counts separately

Exam tip: OCR is a Global admin task to enable billing, then a Compliance admin task to configure, and it applies to DLP, auto-labeling, records management, and insider risk at once.

Microsoft Learn resource: Learn about optical character recognition in Microsoft Purview (opens in a new tab)

Managing labels is a privileged task, so Purview separates who can create labels from who can use them.

What you need to know

• Label administration is granted through role groups such as Information Protection Admin, plus Compliance Administrator and Compliance Data Administrator
• Creating and publishing labels, applying labels, and reading label analytics are separate permissions
• Follow least privilege: give people the narrowest role group that lets them do their job
• Some container and PowerShell-only settings need additional admin roles (for example, SharePoint or Exchange admin)

Microsoft Learn resource: Learn about sensitivity labels (opens in a new tab)

A sensitivity label records how sensitive an item is and can enforce protection. The first decision is the label's scope.

What you need to know

• Scope decides what a label can do and where it appears: Items (files, emails, meetings), Groups & sites (containers), and Schematized data assets
• An item-scoped label can encrypt and mark content; a container-scoped label controls the container's privacy and access but does not label the items inside
• Labels have a priority order, and only one sensitivity label can be applied to an item at a time
• You organize labels top to bottom from least to most sensitive, and can group them into sublabels

Microsoft Learn resource: Create and configure sensitivity labels and their policies (opens in a new tab)

This is where a label stops being a tag and starts enforcing protection: encryption and visual markings.

What you need to know

• Encryption uses Azure Rights Management and can assign permissions (like Do Not Forward or a custom set), and it travels with the file wherever it goes
• Content marking adds headers, footers, and watermarks, and can include variables like the current user or date
• Permissions can be assigned now (admin-defined) or let the user choose at apply time
• Encryption settings can allow offline access for a set number of days and can set content expiration

Exam tip: Content marking is visible and easy to strip; encryption is the setting that actually restricts access. Know which a scenario needs.

Microsoft Learn resource: Restrict access to content by using sensitivity labels to apply encryption (opens in a new tab)

Labels do nothing until they are published to users through a label policy.

What you need to know

• A label policy publishes a set of labels to specific users and groups
• Policy settings include a default label, requiring a label (mandatory labeling), requiring justification to lower a label, and requiring a label on new items
• A user can be targeted by more than one label policy; policy order decides which default and settings win
• Publishing changes can take time to reach Office apps

Microsoft Learn resource: Create and configure sensitivity labels and their policies (opens in a new tab)

Auto-labeling applies a label without waiting for a user, based on the sensitive content Purview finds.

What you need to know

• There are two kinds: client-side auto-labeling (labels or recommends a label inside Office apps as the user works) and service-side auto-labeling policies (apply labels to data at rest in SharePoint, OneDrive, and Exchange)
• Service-side auto-labeling policies can run in simulation mode so you see what would be labeled before enforcing
• Auto-labeling conditions use sensitive information types and trainable classifiers
• A higher-priority label already applied by a user is not overwritten by auto-labeling

Microsoft Learn resource: Apply a sensitivity label to content automatically (opens in a new tab)

Container labels protect the workspace rather than the files in it, controlling who can get in and how they can share.

What you need to know

• You must first enable sensitivity labels for containers (a one-time tenant setup) before the group and site settings appear
• Container settings include privacy (public or private), external user access, external sharing, access from unmanaged devices, and private team discoverability
• Supported containers include Microsoft Teams, Microsoft 365 Groups, SharePoint sites, Viva Engage communities, and Loop workspaces
• Items in a labeled container do not inherit the container's label, so combine container labels with item labels and auto-labeling

Exam tip: If the question is about protecting the site or team (who can join, external sharing), it is a container label. If it is about the document itself (encryption), it is an item label.

Microsoft Learn resource: Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 Groups, and SharePoint sites (opens in a new tab)

Defender for Cloud Apps can reach into connected cloud apps and apply your Purview sensitivity labels to files it finds there.

What you need to know

• Defender for Cloud Apps uses file policies to find sensitive files in connected apps and take governance actions
• One governance action is Apply sensitivity label, which uses your existing Purview labels
• It uses the Data Classification Service, so detection is consistent with the rest of Purview
• Note that Defender for Cloud Apps file policies are being migrated toward Purview DLP and auto-labeling, so know both approaches

Microsoft Learn resource: File policies in Microsoft Defender for Cloud Apps (opens in a new tab)

The Information Protection client extends labeling to Windows outside of the built-in Office experience, so you can label and protect a wider range of file types from File Explorer and PowerShell.

What you need to know

• It runs on Windows only and replaces the older Azure Information Protection (AIP) unified labeling client
• Its components are the information protection scanner, the file labeler (File Explorer), the viewer (for encrypted files), and a PowerShell module
• It requires a minimum of Microsoft .NET Framework 4.7.2
• Labeling built into Office apps is separate; use the client for File Explorer, PowerShell, and file types Office does not cover

Microsoft Learn resource: Extend sensitivity labeling on Windows (Information Protection client) (opens in a new tab)

With the client installed, admins and users can label and encrypt files directly on Windows.

What you need to know

• From File Explorer, right-click a file to apply or remove a label, or to view a protected file
• The PowerShell module (Set-FileLabel and related cmdlets) labels files in bulk in scripts
• The client can label the wider set of file types the scanner supports, not just Office documents
• Users need Microsoft Entra authentication, and single sign-on and multifactor authentication are supported

Microsoft Learn resource: Extend sensitivity labeling on Windows (Information Protection client) (opens in a new tab)

The scanner discovers and labels sensitive files that sit on-premises, in file shares and SharePoint Server libraries, so on-premises data is protected the same way as cloud data.

What you need to know

• The scanner is a component of the Information Protection client and uses the same labels and detection
• It crawls file shares (UNC paths) and SharePoint Server document libraries; it does not scan OneDrive as a repository
• Discovery mode reports what would be labeled without changing anything; enforcement mode applies labels and protection
• It uses IFilters installed on the scanner machine and can run as a multi-node cluster for scale; scanning is scheduled, not real time

Exam tip: For on-premises file servers, the scanner is the answer; for cloud apps like Box or Google Workspace, Defender for Cloud Apps is the answer.

Microsoft Learn resource: Learn about the information protection scanner (opens in a new tab)

Message Encryption protects email so that only the intended recipient can read it, even when the recipient is outside your organization on Gmail or Yahoo.

What you need to know

• It is built on Azure Rights Management and is triggered by mail flow (transport) rules in Exchange
• Users can also apply protection manually with Encrypt-only and Do Not Forward options in Outlook
• Microsoft 365 recipients get an inline reading experience; other recipients use a one-time passcode or a branded web portal
• You can customize the branding of encrypted messages and the portal

Microsoft Learn resource: Message encryption (opens in a new tab)

Advanced Message Encryption adds control over encrypted mail after it is sent to external recipients, which is what compliance obligations often require.

What you need to know

• It adds message revocation, message expiration, multiple branding templates, and encrypted portal activity logs on top of Message Encryption
• Revocation and expiration only work for external recipients who read mail through the encrypted web portal (a branded template forces the portal experience)
• You cannot revoke a message a Microsoft 365 recipient read inline in Outlook
• Admins configure the automatic policies in the Exchange admin center under Mail flow > Rules, and can revoke with the Set-OMEMessageRevocation cmdlet

Exam tip: Revoke or expire an external email means Advanced Message Encryption plus a custom branding template, not plain Message Encryption.

Microsoft Learn resource: Advanced Message Encryption (opens in a new tab)

DLP detects and protects sensitive items in use, in motion, and at rest. Good design starts from a requirement and picks the right locations and actions.

What you need to know

• DLP protects content across Exchange, SharePoint, OneDrive, Teams, Windows and macOS devices, on-premises repositories, Fabric and Power BI, and Defender for Cloud Apps
• A policy contains one or more rules; each rule has conditions (what to detect) and actions (what to do)
• Actions include blocking, blocking with override, restricting access, encrypting, and notifying with policy tips
• Start in simulation or test mode and tune before you enforce, to avoid blocking legitimate work

Microsoft Learn resource: Learn about data loss prevention (opens in a new tab)

Creating and viewing DLP policies and alerts are controlled by role groups, and you can split policy authors from alert investigators.

What you need to know

• Role groups such as Compliance Administrator, Compliance Data Administrator, and Information Protection Admin can manage DLP
• Viewing DLP alerts and the data they contain can be granted separately from creating policies
• The DLP alerts view can restrict who sees the sensitive content in a match
• Apply least privilege and use dedicated role groups for investigators

Microsoft Learn resource: Create and deploy data loss prevention policies (opens in a new tab)

This is the core build task: turning a design into a working policy with the right scope, conditions, and actions.

What you need to know

• You can start from a template (for common regulations) or build a custom policy
• Conditions can combine SITs, sensitivity labels, trainable classifiers, and other predicates with AND or OR logic
• Policy tips warn or educate users in the app when a rule matches, and can allow a business-justification override
• Use simulation mode with sample results before turning a policy on

Microsoft Learn resource: Create and deploy data loss prevention policies (opens in a new tab)

Adaptive Protection makes DLP dynamic: instead of one rule for everyone, it tightens controls automatically for users who are behaving riskily.

What you need to know

• Adaptive Protection connects Insider Risk Management risk levels (Minor, Moderate, Elevated) to DLP policy conditions
• A DLP rule can use the condition that the user's insider risk level is elevated, so only risky users get the stricter action
• Low-risk users keep working normally while the same policy blocks or restricts high-risk users
• It is configured in the Insider Risk Management area and then referenced by DLP

Exam tip: Adaptive Protection is the answer when the requirement is to apply stronger DLP only to risky users, automatically, without an admin editing policies.

Microsoft Learn resource: Help dynamically mitigate risks with Adaptive Protection (opens in a new tab)

When several rules or policies could act on the same item, you need to know which one wins.

What you need to know

• Within a policy, rules are evaluated in priority order (0 is highest), and the first matching rule's actions apply for that outcome
• The most restrictive action generally takes effect across matching rules
• Reorder rules to control which one fires first
• The DLP policy reference documents the conditions, exceptions, and actions available per location

Microsoft Learn resource: Data Loss Prevention policy reference (opens in a new tab)

Defender for Cloud Apps file policies extend DLP-style detection and response to connected third-party cloud apps.

What you need to know

• A file policy in Defender for Cloud Apps scans files in connected apps and takes governance actions (remove external users, remove public access, apply a label, quarantine)
• The preferred inspection method is Data Classification Service, so it uses the same SITs as Purview
• File monitoring must be enabled, and at least one app connector must be connected
• Note the direction of travel: Microsoft is guiding customers to migrate file policies to Purview DLP and auto-labeling

Microsoft Learn resource: File policies in Microsoft Defender for Cloud Apps (opens in a new tab)

Endpoint DLP watches sensitive files on Windows and macOS devices. Before it works, devices must be onboarded and prepared.

What you need to know

• Devices must be onboarded to Microsoft Purview; onboarding is shared with Microsoft Defender for Endpoint
• Supported devices are Windows 10, Windows 11, and the three most recent macOS versions
• To monitor web uploads, you deploy the Microsoft Purview browser extension for non-Edge browsers (Edge has it built in)
• Onboarding methods include Intune, Configuration Manager, and a local script

Microsoft Learn resource: Get started with endpoint data loss prevention (opens in a new tab)

Endpoint DLP rules control the specific device actions users can take with sensitive files.

What you need to know

• Device activities you can audit or block include copying to USB or removable media, copying to a network share, printing, copying over Bluetooth or RDP, and uploading to unallowed cloud services or browsers
• You define allowed and unallowed apps, browsers, and cloud service domains in the policy and settings
• Actions can be Audit, Block, or Block with override
• Rules can differ by whether the device is on a corporate network or off it

Microsoft Learn resource: Learn about Endpoint data loss prevention (opens in a new tab)

Endpoint DLP has global settings that apply across all device policies, separate from the per-policy rules.

What you need to know

• Global settings include file path exclusions, unallowed apps and app groups, unallowed and restricted browsers, network share coverage, and printer and removable-media groups
• File path exclusions here stop Endpoint DLP from classifying files in those folders entirely
• Settings also control evidence collection (saving a copy of a blocked file to Azure) and business justification text
• These settings live under Data loss prevention > Endpoint DLP settings in the Purview portal

Microsoft Learn resource: Configure endpoint data loss prevention settings (opens in a new tab)

Just-in-time (JIT) protection blocks a risky action on a file that has not been classified yet, holding it until evaluation finishes, so a brand-new file cannot slip out before DLP sees it.

What you need to know

• JIT audits or blocks egress activities (copy to removable media or network share, print, RDP copy, upload) while classification completes
• It needs a recent Defender antimalware client version on the device
• The fallback action when classification fails is either Allow users to complete actions or Block users from completing actions; start with Allow and test before blocking
• It applies to Windows 10, Windows 11, and the three most recent macOS versions

Exam tip: JIT is the answer when the concern is a new or never-evaluated file being exfiltrated before a policy has a chance to scan it.

Microsoft Learn resource: Learn about just-in-time protection (opens in a new tab)

Once Endpoint DLP is running, you watch what is happening on devices to tune policies and spot risk.

What you need to know

• Activity explorer shows endpoint activities such as file copies, prints, and uploads, alongside label and DLP events
• Endpoint events appear in activity explorer, and enforcement events on an offline device appear once it reconnects
• You can filter by activity, user, device, SIT, and label
• The same signals feed Insider Risk Management and Adaptive Protection

Microsoft Learn resource: Get started with Activity explorer (opens in a new tab)

Retention decides how long content is kept and what happens at the end. Retention labels apply retention at the item level and are the basis for records management.

What you need to know

• A retention label can retain content, delete it, or retain and then delete after a period
• Retention labels are applied to individual items and can start the retention period from creation, last modified, when labeled, or when an event occurs (event-based retention)
• Retention labels can mark an item as a record or regulatory record, which adds restrictions
• Unlike sensitivity labels, a retention label does not persist if content leaves Microsoft 365

Microsoft Learn resource: Learn about retention policies and retention labels (opens in a new tab)

A scope decides which locations or users a retention policy or label policy applies to. Adaptive scopes update themselves automatically.

What you need to know

• A static scope is a fixed list of locations you pick and must maintain by hand
• An adaptive scope uses a query on user, group, or site attributes, so membership updates automatically as attributes change
• Adaptive scope types are User, Microsoft 365 Group, and Site
• You create the adaptive scope first, then select it when you create the retention or label policy

Exam tip: When a requirement says the policy must automatically follow a department or a set of sites as people and sites change, choose an adaptive scope.

Microsoft Learn resource: Configuration information for adaptive scopes (opens in a new tab)

You build retention labels centrally, then publish them so they can be applied.

What you need to know

• Retention labels are created under Data Lifecycle Management (or Records Management for records) in the Purview portal
• Each label defines the retention period, the start-of-period trigger, and the end action (retain, delete, or both)
• A label can mark content as a record, which blocks editing and deletion while the label applies
• Only one retention label can be applied to an item at a time

Microsoft Learn resource: Publish retention labels and apply them in apps (opens in a new tab)

A published label is one users (or default settings) can apply in apps like Outlook, SharePoint, and OneDrive.

What you need to know

• A retention label policy publishes labels to Exchange, SharePoint, OneDrive, and Microsoft 365 Groups
• Published labels can be applied manually by users, set as a default for a SharePoint library or folder, or applied by Outlook rules
• A label policy can use an adaptive or a static scope
• Publishing can take up to a day or more to appear for users

Microsoft Learn resource: Publish retention labels and apply them in apps (opens in a new tab)

Auto-apply retention labels remove the need for users to remember to tag content.

What you need to know

• Auto-apply conditions are sensitive information types, keywords or a KQL query, a match for a trainable classifier, or newly shared cloud attachments
• Trainable-classifier auto-apply requires a static scope and cannot use adaptive scopes
• An auto-apply label never replaces a retention label already on an item
• Auto-apply to SharePoint and OneDrive skips items older than six months for trainable classifiers

Microsoft Learn resource: Automatically apply a retention label to retain or delete content (opens in a new tab)

When multiple retention settings could apply to the same item, the principles of retention decide the outcome, and Policy lookup shows you which apply.

The principles of retention (in order):

1. Retention wins over deletion: if anything says to keep the item, it is kept even when another policy says to delete
2. The longest retention period wins: the item is kept for the longest period any applicable rule specifies
3. Explicit wins over implicit (for deletion): the delete action from a retention label takes precedence over the delete action from a retention policy
4. The shortest deletion period wins: among rules that only delete, the item is deleted at the earliest date

• Policy lookup, in the Data Lifecycle Management or Records Management solutions, shows which retention policies and retention label policies are assigned to a specific user, site, or Microsoft 365 group
• The exam expects you to reason through these four principles for a scenario

Exam tip: Retain always beats delete, and for the delete action a retention label beats a retention policy. Walk scenarios through the four principles in order.

Microsoft Learn resource: Learn about retention policies and retention labels (opens in a new tab)

Retention policies apply retention to whole locations without labeling each item, and they are the cornerstone of data lifecycle management.

What you need to know

• A retention policy targets locations such as Exchange, SharePoint, OneDrive, Teams, and Viva Engage, either all instances or specific ones
• It can retain, delete, or retain and then delete, with a single setting for the whole location
• The name, scope type (adaptive or static), and most retention settings cannot be changed after creation; the retention period can be changed
• It can take up to seven days for a new retention policy to fully apply

Microsoft Learn resource: Create and configure retention policies (opens in a new tab)

Retention keeps content even after a user deletes it, and recovery happens in the workload, not in Purview.

What you need to know

• Deleted-but-retained SharePoint and OneDrive content moves through the Recycle Bin and then a Preservation Hold library before it is purged
• Retained Exchange content is kept in the Recoverable Items folder
• Because retention preserves a copy, content stays discoverable through eDiscovery even after a user deletes it
• Recovery is done in each service's own tools, within the retention window

Microsoft Learn resource: Implement and manage Microsoft 365 retention and recovery (opens in a new tab)

Insider Risk Management (IRM) is built privacy-first, so who can see what is tightly controlled by role groups.

What you need to know

• IRM role groups include Insider Risk Management Admins (configure), Analysts (triage alerts), Investigators (open cases and see content), and Auditors
• Users are pseudonymized by default, so investigators see anonymized names unless that is turned off
• Role-based access control and an audit log keep every action accountable
• Assign the narrowest role group that fits each person's job

Microsoft Learn resource: Insider Risk Management permissions (opens in a new tab)

Connectors bring in outside signals, most importantly HR events, that make risk detection far more accurate.

What you need to know

• The Microsoft 365 HR connector imports events like resignations, terminations, job level changes, and performance notices from a CSV your HR system exports
• HR data powers templates like Data theft by departing users and the risky-user templates
• Other connectors include healthcare and physical badging connectors for specialized templates
• The connector runs a script on a schedule to upload the data and needs the Data Connector Admin role

Microsoft Learn resource: Set up a connector to import HR data (opens in a new tab)

Defender for Endpoint feeds device security signals into IRM so security policy violations count toward a user's risk.

What you need to know

• You enable the Defender for Endpoint integration with Insider Risk Management in the Defender settings
• Once integrated, IRM security policy violation templates use Defender for Endpoint alerts (malware, disabling security features)
• The security policy violation templates require an active Defender for Endpoint subscription, or they will not score
• This is separate from device onboarding for Endpoint DLP, though both rely on Defender for Endpoint

Microsoft Learn resource: Plan for Insider Risk Management (opens in a new tab)

Global settings apply across every IRM policy and are configured once.

What you need to know

• Settings include privacy (pseudonymization), policy indicators, intelligent detections, analytics, priority user groups, and priority physical assets
• Analytics scans your tenant to recommend where risk exists before you commit to policies
• Priority user groups let you score sensitive roles differently
• Global indicators must be turned on in settings before a policy can use them

Microsoft Learn resource: Get started with Insider Risk Management settings (opens in a new tab)

Indicators are the signals that raise a user's risk score, such as downloading a lot of files or copying to a USB drive.

What you need to know

• All global indicators are off by default; you must select the ones you want before a policy can score them
• Indicator categories include Office, device, cloud, browser, Defender for Endpoint, health record access, and physical access
• Some indicators depend on a connector or integration (for example, health record indicators need the healthcare and HR connectors)
• Risk score boosters increase the score when activity is unusual for that user or involves priority content

Microsoft Learn resource: Configure policy indicators in Insider Risk Management (opens in a new tab)

Every IRM policy is based on a template that predefines the indicators and scoring model, so picking the right one is the first design step.

What you need to know

• Each template lists its own prerequisites, such as an HR connector, a DLP policy, or Defender for Endpoint
• The template sets the indicators and risk-scoring model, so changing your mind later means creating a new policy on the right template
• IRM supports up to 100 policies per template

Microsoft Learn resource: Learn about Insider Risk Management policy templates (opens in a new tab)

With a template chosen, you scope the policy to users, pick triggers and indicators, and manage its health.

What you need to know

• A policy needs a triggering event (like a DLP high-severity alert or an HR resignation) to bring a user into scope
• You choose users and groups, the indicators to score, and any risk score boosters
• Policy health warnings tell you when a policy is not scoring, for example a missing HR connector or an over-broad trigger
• Data leaks policies require at least one DLP policy configured to send high-severity alerts

Microsoft Learn resource: Create and manage Insider Risk Management policies (opens in a new tab)

Forensic evidence adds optional visual capture of risky activity, with privacy controls built in.

What you need to know

• Forensic evidence is off by default and creating a policy for it requires dual authorization
• Capturing options are specific activities (only when a policy indicator fires) or all activities (continuous, for approved users)
• Usernames are pseudonymized by default, and clips are deleted 120 days after capture
• Devices must meet requirements and be onboarded for capture to work

Exam tip: Forensic evidence is opt-in, dual-authorized, and privacy-protected; expect a question that tests those guardrails, not just what it captures.

Microsoft Learn resource: Learn about Insider Risk Management forensic evidence (opens in a new tab)

Adaptive Protection turns IRM risk levels into automatic action across DLP and retention.

What you need to know

• The three insider risk levels are Minor, Moderate, and Elevated
• You choose the IRM policy that drives the levels, then define the conditions for each level (based on alerts or specific activity)
• DLP policies then apply stricter actions to Elevated users, and retention auto-applies a label to content deleted by elevated-risk users (retained 120 days)
• It reduces admin effort because controls follow the user's risk instead of being set per user

Microsoft Learn resource: Help dynamically mitigate risks with Adaptive Protection (opens in a new tab)

When a policy scores enough risk, it raises an alert; an alert you decide to act on becomes a case.

What you need to know

• Alerts are triaged (confirm, dismiss, or resolve) on the Alerts dashboard, and confirming an alert can create a case
• A case is the investigation workspace: user activity timeline, Content explorer for the involved files, and case notes
• Case actions include sending a notice, resolving as benign, sharing to ServiceNow or email, and escalating to eDiscovery (Premium)
• Creating and working cases requires the Investigators or Insider Risk Management role group

Microsoft Learn resource: Take action on Insider Risk Management cases (opens in a new tab)

The end of the workflow is acting on a case, often by reminding the user with a notice.

What you need to know

• Notice templates are pre-written emails you send to a user from a case, useful for inadvertent violations
• A template has a name, a from address, a subject, and a message body (text or HTML)
• Sending a notice does not close the case; you resolve the case separately
• Power Automate flows can automate steps like notifying a manager or opening a ServiceNow record

Microsoft Learn resource: Create Insider Risk Management notice templates (opens in a new tab)

Audit is the record of who did what. Premium adds longer retention and richer events, but only for correctly licensed users.

What you need to know

• Audit (Standard) is on by default and retains most logs for 180 days (90 days for logs generated before October 17, 2023)
• Audit (Premium) needs an E5 or equivalent add-on license, and you enable the Microsoft 365 Advanced Auditing app for each user
• Premium retains Microsoft Entra, Exchange, SharePoint, and OneDrive audit records for one year by default, with custom policies up to 10 years (add-on)
• Premium adds crucial events like MailItemsAccessed and higher Management Activity API bandwidth

Microsoft Learn resource: Learn about auditing solutions in Microsoft Purview (opens in a new tab)

The audit search tool is where you reconstruct what happened during an investigation.

What you need to know

• You search the unified audit log from the Audit solution in the Purview portal, filtering by activity, user, date range, and workload
• Results can be exported to CSV for deeper analysis
• Unified audit logging must be turned on (it is on by default for new tenants)
• Premium intelligent insights add context, such as the sensitivity label of a mail item that was accessed

Microsoft Learn resource: Search the audit log (opens in a new tab)

Audit log retention policies let you keep some audit records longer, or shorter, than the default.

What you need to know

• Retention policies are an Audit (Premium) capability and can keep records up to 10 years (with the add-on)
• You can scope a policy by service, by specific activities, and by user
• A priority value decides which policy wins when several apply
• A default policy keeps Entra, Exchange, SharePoint, and OneDrive records for one year and cannot be modified

Microsoft Learn resource: Manage audit log retention policies (opens in a new tab)

Activity explorer is the single view of actions taken on labeled and protected content across the estate.

What you need to know

• It shows label changes, label downgrades, DLP matches, and endpoint activities in one place
• You can filter by activity type, user, location, sensitivity or retention label, and SIT
• It reads from the last 30 days of activity by default
• Access needs a role group such as Information Protection Analyst or the content explorer roles

Microsoft Learn resource: Get started with Activity explorer (opens in a new tab)

DLP alerts tell you when a policy matched, and the Purview DLP alerts dashboard is where you triage them.

What you need to know

• The DLP alerts dashboard shows alert severity, the matched policy and rule, and the sensitive content (if you have permission)
• You investigate an alert, set its status (for example In progress or Resolved), and record the outcome
• Alerts are generated by rules configured to create an alert, with thresholds to reduce noise
• Investigating in Purview is one option; the same alerts also flow into Defender XDR

Microsoft Learn resource: Investigate and respond to Microsoft Purview Data Loss Prevention alerts (opens in a new tab)

Beyond alerts, you can investigate the underlying risky activity for a user.

What you need to know

• The Alerts dashboard and user activity reports show risky activity plotted over time and by risk level
• You confirm an alert and create a case to investigate in depth
• The user activity timeline and Content explorer within a case show the exact files and messages involved
• Pseudonymization keeps identities masked unless an investigator has rights to unmask

Microsoft Learn resource: Investigate Microsoft Purview Insider Risk Management activities (opens in a new tab)

DLP and other Purview alerts surface in Defender XDR, where they correlate with security alerts into incidents.

What you need to know

• DLP alerts appear in the Defender portal under Incidents & alerts, grouped into incidents
• Correlation links a DLP alert with related alerts from Defender for Endpoint, Defender for Office 365, and others
• You can take remediation actions on users, files, and devices, and hunt across compliance and security logs
• Be aware of alert tuning: a built-in rule can convert some DLP signals to behaviors rather than alerts, and you can disable it to keep seeing them as alerts

Microsoft Learn resource: Investigate data loss prevention alerts with Microsoft Defender XDR (opens in a new tab)

File policy alerts from Defender for Cloud Apps flag sensitive files in connected cloud apps.

What you need to know

• A file policy raises an alert and can run governance actions such as remove external users, remove public access, apply a label, or quarantine
• You respond from the Defender portal, reviewing the file, its sharing, and the match
• Defender for Cloud Apps can tell you when a file could not be inspected because it was encrypted or password protected
• Because file policies are being retired in favor of Purview DLP, understand the migration path as well

Microsoft Learn resource: File policies in Microsoft Defender for Cloud Apps (opens in a new tab)

eDiscovery finds and preserves content across Microsoft 365 for legal and investigative needs, and IRM cases can escalate into it.

What you need to know

• The eDiscovery workflow is cases, then searches (with holds to preserve content), then review sets, then export
• A hold preserves content so it cannot be permanently deleted while the investigation is open
• eDiscovery permissions are separate role groups, and every eDiscovery action is itself audited
• An Insider Risk Management case can escalate to an eDiscovery (Premium) case for legal review

Microsoft Learn resource: Learn about eDiscovery (opens in a new tab)

Purview protects the data that AI tools like Microsoft 365 Copilot can reach, so AI respects the same labels and policies as everything else.

What you need to know

• Sensitivity labels and their encryption are honored by Microsoft 365 Copilot: Copilot will not surface content the user is not allowed to open, and it inherits the label on content it references
• DLP policies can stop sensitive content from being pasted into or processed by AI where supported
• Insider Risk Management includes risky AI usage indicators and a Risky AI usage template
• Communication compliance can detect risky prompts and responses

Microsoft Learn resource: Microsoft Purview data security and compliance protections for AI (opens in a new tab)

Because Copilot reads from SharePoint, OneDrive, Teams, and Exchange, the controls on those workloads decide what AI can see.

What you need to know

• Copilot only returns content the user already has permission to access, so oversharing in SharePoint directly widens what Copilot can surface
• SharePoint Advanced Management and site access controls help reduce oversharing before you deploy Copilot
• Retention and records policies still govern AI-generated content and Copilot interactions
• Labeling and DLP on the underlying workloads carry through to AI experiences

Exam tip: The most common Copilot data-protection question is really a permissions question: fix oversharing, and you fix what Copilot can reach.

Microsoft Learn resource: Microsoft Purview data security and compliance protections for AI (opens in a new tab)

DSPM for AI is the central place to see and control how AI uses your data, but it needs a few things turned on first.

What you need to know

• Prerequisites include turning on Microsoft Purview Audit, and for third-party AI sites, installing the Purview browser extension and onboarding devices
• It automatically runs a weekly data risk assessment on the top SharePoint sites by usage
• You need appropriate compliance permissions, such as the Compliance Administrator role, to use it
• DSPM for AI works with Microsoft Copilots, agents, and third-party AI apps like ChatGPT and Gemini

Microsoft Learn resource: Prerequisites for Data Security Posture Management for AI (opens in a new tab)

Like the rest of Purview, DSPM for AI uses role-based access to control who can see AI activity and create policies.

What you need to know

• Using DSPM for AI needs an account with compliance permissions, such as a member of the Compliance Administrator role
• Creating the one-click policies that apply across all users needs an unrestricted administrator when administrative units are in use
• Permissions follow the standard Purview role groups (Information Protection, Compliance Administrator, and similar)
• Apply least privilege and separate who configures from who investigates

Microsoft Learn resource: Permissions for Microsoft Purview data security and compliance protections for AI (opens in a new tab)

DSPM for AI ships ready-to-use policies you can turn on with one click to start protecting AI data quickly.

What you need to know

• One-click policies cover things like detecting sensitive information in AI prompts and responses and discovering users visiting third-party AI sites
• Recommendations guide you to run a data risk assessment, create labels, and turn on default policies
• Allow at least 24 hours for a new policy to collect data and show results
• Policies from DSPM for AI are managed through the underlying solution (for example, DLP or communication compliance)

Microsoft Learn resource: Data Security Posture Management for AI (opens in a new tab)

Once policies run, DSPM for AI gives you dashboards and Activity explorer to watch AI use.

What you need to know

• Reports break down AI usage by Copilot experiences and agents, enterprise AI apps, and other AI apps
• Activity explorer inside DSPM for AI shows activity type, user, app, sensitive info types, and files referenced
• The Apps and agents view shows each AI app and agent and how it is protected
• Data risk assessments highlight potential oversharing so you can remediate before it becomes a problem

Microsoft Learn resource: Data Security Posture Management for AI (opens in a new tab)