SC-401 Information Security Administrator

Label taxonomy design: design a hierarchy appropriate for your data: Public → General → Confidential → Highly Confidential. Add sublabels under Confidential for different audiences (Confidential\All Employees vs Confidential\Finance Only). Each sublabel can have different encryption settings — Confidential\Finance Only encrypts and restricts to Finance security group only.

Auto-labeling: two modes — Client-side (applied when user creates/edits Office file, based on SITs or trainable classifiers, shows policy tip recommendation) and Service-side (runs in cloud on existing content in SharePoint/OneDrive/Exchange — finds and labels at scale without user interaction, simulate mode first). Auto-labeling requires AIP P2 license.

Trainable classifiers: ML models trained on your org's content. Two types: Pre-trained (Microsoft-supplied: resumes, source code, financial statements, healthcare records — 150+ built-in) and Custom (you seed with 50–500 sample documents, retrain until accuracy ≥70%). Use when SIT regex patterns are insufficient for complex content types.

Label scoping: Files & Emails (Word, Excel, PowerPoint, Outlook), Meetings (Teams meetings — apply label to meeting invite → controls recording access), Groups & Sites (Teams/M365 groups, SharePoint sites — controls external sharing, conditional access, container-level settings).

Double Key Encryption (DKE): content encrypted with two keys — Microsoft key + customer-held key. Microsoft cannot decrypt content. Required for highest-sensitivity government/defense content that must remain opaque even to Microsoft cloud infrastructure.

Endpoint DLP: agent-based (MDE sensor) policy enforcement on Windows 10/11 + macOS devices. Controls: upload to cloud service (block personal OneDrive/Google Drive, allow corporate OneDrive), copy to USB removable storage (block or audit), print (block sensitive content printing), clipboard copy (block sensitive content paste to non-compliant apps), remote desktop (block content transfer). Does NOT require internet connection for enforcement — policy cached locally.

SIT tuning: custom Sensitive Information Types built with regex pattern + keyword list + confidence levels (Low/Medium/High). Exact Data Match (EDM) SITs: fingerprint actual data records from a database (e.g., a CSV of actual customer IDs) → DLP matches exact customer IDs, not just any 10-digit number. Reduces false positives dramatically for structured data.

Adaptive Protection: Dynamic DLP severity that scales with a user's current Insider Risk score. Low risk user → standard DLP (audit only). Medium risk → add warning. High risk → block without override. Insider Risk score feeds DLP enforcement automatically — no separate policy needed. Requires IRM + DLP both enabled.

DLP alerts and investigation: DLP alerts surface in Microsoft Purview compliance portal + Defender XDR portal. Each alert: policy matched, user, content snippet (configurable — enable evidence collection for full file review), action taken. Activity Explorer: timeline of all DLP policy matches per user/device. Content Explorer: see all classified content in your tenant.

Retention policy scope: Adaptive scopes (dynamic — policy applies to all sites/mailboxes matching attribute rule, auto-updates as attributes change) vs Static scopes (fixed list of locations — simpler but requires manual updates). Use Adaptive scopes for large org with frequent structure changes.

Records management: mark content as a Record (label-based — immutable: cannot be edited, version-locked, deletion requires disposition workflow). Regulatory Record (highest: cannot be deleted even by admins or SharePoint site owners until retention expires — use for legal hold + regulatory compliance). File plan: manage all retention labels in a structured inventory with business classification codes.

Event-based retention: retention period triggered by a business event rather than content creation date. Example: Employee contracts retained for "7 years after termination date." When an employee terminates → trigger event (via Power Automate or API) → associated contracts start their 7-year clock at that point. Enables regulatory compliance without manual tracking.

Disposition review: when retention period expires, instead of auto-deleting → send to a designated reviewer for manual confirmation. Reviewer can: approve deletion, extend retention, relabel as permanent record. Creates an auditable deletion record (who approved, when). Required by some regulations before destroying records.

Microsoft Purview Data Map: automated data discovery across Azure data sources (Azure SQL, Blob Storage, Data Lake, Cosmos DB), on-prem SQL Server, and multi-cloud (AWS S3, RDS). Scan schedules discover schema + data types + sensitivity. Classification results shown in Data Map with lineage tracking (where data flows from source → transformation → sink).

Data Catalog (unified): searchable inventory of all discovered data assets. Business glossary integration: map technical column names to business terms (e.g., "cust_ssn" → "Customer Tax ID" → Sensitivity: Highly Confidential). Data stewards can annotate, certify, or request review of data assets. Enables data consumers to find trusted data without knowing technical details.

Defender for Cloud Apps — session control: proxy-based in-session control for cloud apps (requires Conditional Access App Control CA policy). Actions possible on each session: block download (user can view in browser but cannot save to device), block upload, watermark viewed documents (browser-rendered watermark invisible in screenshots — identifies leaks), block copy-paste. Applied to unmanaged/BYOD devices accessing SaaS apps.

Shadow IT discovery: analyze network traffic logs from firewalls/web proxies (Palo Alto, Cisco, generic CEF) → MDCA identifies cloud apps being used without IT approval. Risk score per app based on 90+ risk factors (encryption, GDPR compliance, data retention). Generate Cloud App Discovery report → sanctioned vs unsanctioned apps → block unsanctioned via proxy integration.