SC-401 Administering Information Security in Microsoft 365 Question and Answers

Current setup:

DLP1 (priority 0, Rule1) → Stop processing additional rules enabled → means if Rule1 matches, later rules (including Rule2 with Tip2) will never be evaluated.

Requirement: Ensure that if all rules match, the user sees Tip2 (Rule2’s policy tip).

To fix this: Move DLP2 above DLP1 in priority (i.e., set DLP2 = priority 0). Then Rule2 will be evaluated first, and its policy tip (Tip2) will be displayed.

Why not others?

B. Prevent additional processing of the policies if there is a match for Rule2: That would stop processing later, but DLP1 would still block earlier due to its higher priority.

C. Change the priority of DLP2 to 3: That pushes it even lower, making it worse.

D. Enable additional processing for Rule1: Rule1 already has stop processing enabled. Changing that does not ensure Rule2 runs before Rule1, because priority is evaluated first.

The requirement is:

You need to provide a user with the ability to view DLP alerts in the Microsoft Purview portal. The solution must use the principle of least privilege.

Step 1 – Understanding the roles

Compliance Administrator → Full access to compliance features, including creating/editing policies. This is more than needed (not least privilege).

Compliance Data Administrator → Can manage compliance features and data governance, but still more permissions than required.

Security Operator → Can view and respond to active security incidents and alerts, which is more than just viewing DLP alerts.

Security Reader → Read-only access to security-related features, including viewing DLP alerts, Microsoft Purview alerts, incidents, reports, and recommendations. This matches the requirement precisely.

Step 2 – Microsoft Documentation

Microsoft Learn states:

Security Reader role:

“Can view and investigate security events, reports, and alerts without the ability to make changes.”

📖 Reference: Microsoft Entra built-in roles - Security Reader

Step 3 – Apply the principle of least privilege

Since the user only needs to view DLP alerts (not create or manage policies), the Security Reader role is the minimal role with sufficient permissions.

The question is asking what item types can be retained when implementing Microsoft Teams retention policies in Microsoft 365 E5.

Retention policies in Teams can apply to:

Teams chat messages (1:1 or group chats)

Teams channel messages

Items within those messages, including text, links, and supported embedded objects.

Step 2 – Supported Teams retention items

According to Microsoft documentation:

Retention policies support Teams messages (chats and channel posts) and their associated attachments or in-line content such as:

Embedded images

Code snippets

Tables, links, and reactions

Retention policies do not support certain Teams items, including:

Voicemails

Calls and meetings recordings

Whiteboards

Message reactions (stored separately in Azure services)

Step 1 – Requirement

The scenario requires using Microsoft Purview Insider Risk Management to import HR data (such as employee hire dates, resignations, and department changes). HR data connectors allow insider risk policies to use workforce signals to detect risky user activities.

Step 2 – What to do first

Before importing HR data, you must configure Insider Risk Management settings in the Microsoft Purview compliance portal. This is a prerequisite step that enables HR data connectors and policies to be created.

Step 1 – Understand the scenario

We have a Microsoft 365 E5 subscription with Copilot available.

File1.docx has a sensitivity label applied.

The sensitivity label controls usage rights (Owner, Editor, Restricted Editor, Viewer).

The question: Which users can summarize File1 with Microsoft 365 Copilot?

Step 2 – Sensitivity labels and usage rights

When a sensitivity label is configured to apply encryption with usage rights, each role has different levels of access:

Owner: Full control (read, edit, reshare, extract, etc.).

Editor: Can read, edit, and copy content.

Restricted Editor: Can read and edit in place, but cannot copy, print, or extract content.

Viewer: Can only read (view) the content.

📖 Reference: Rights included in usage rights for sensitivity labels

Step 3 – Copilot’s requirements for summarization

Microsoft 365 Copilot requires that the user has the ability to read and extract text from the document in order to generate a summary.

Owners and Editors: ✅ Can both read and extract → Copilot works.

Restricted Editors: ❌ Cannot copy/extract text → Copilot cannot summarize.

Viewers: ❌ Can only view → Copilot cannot process content for summarization.

📖 Reference: Microsoft 365 Copilot and sensitivity labels

“Users must have extract and copy rights in order for Microsoft 365 Copilot to process and summarize labeled documents.”

Step 4 – Apply to the case

User1 (Owner) → Can summarize.

User2 (Editor) → Can summarize.

User3 (Restricted Editor) → Cannot summarize.

User4 (Viewer) → Cannot summarize.

Box 1: To include the sensitive info type detected for each DLP rule match, you need to add a custom column in Activity Explorer. This ensures that the exported file contains specific details about the detected sensitive information types.

Box 2: DLP activity exports from Activity Explorer are always in CSV (Comma-Separated Values) format. This format allows for easy data analysis and reporting in Excel or other data-processing tools.

The question is about Insider Risk Management forensic evidence collection in Microsoft 365 E5 (Microsoft Purview).

🔹 Step 1 – Which devices are supported?

According to Microsoft documentation, forensic evidence collection for insider risk investigations is supported only on:

Windows 10

Windows 11

It is not supported on:

macOS

Android

iOS

📖 Reference: Forensic evidence collection in Microsoft Purview Insider Risk Management

âž¡ So, only Device1 (Windows 11) and Device2 (Windows 10) qualify.

🔹 Step 2 – What preparation is needed?

For forensic evidence to be collected, supported devices must:

Be onboarded to Microsoft Purview (via Microsoft Defender for Endpoint integration).

Have the Microsoft Purview client installed.

This enables capture of user actions such as file copies, USB transfers, printing, etc., to provide forensic evidence for insider risk alerts.

âž¡ Correct option: Onboard the devices to Microsoft Purview and install the Microsoft Purview client

Step 1 – Scenario

You are creating an Exact Data Match (EDM) classifier in Microsoft Purview.

EDM requires preparing a sensitive information source table (such as employee IDs, customer account numbers).

This table must be hashed and uploaded into Microsoft Purview.

Only authorized users can perform this sensitive upload operation.

Step 2 – Required permissions for EDM upload

Microsoft’s documented process states:

To hash and upload EDM source data, you must assign users to the EDM Data Uploaders security group.

This group is a security group created in Microsoft Entra ID (formerly Azure AD).

Membership in this security group grants permission to perform the upload.

📖 Reference: Configure Exact Data Match (EDM) in Microsoft Purview

“To upload the hashed data file to Microsoft Purview, you must add users to a security group named EDM_DataUploaders. This group is required to give permissions for EDM uploads.”

Step 3 – Why not the other options?

A. Microsoft Entra enterprise application → Used for app integration, not EDM uploads.

B. Purview role group → Provides compliance portal permissions but not EDM upload rights.

D. Microsoft Entra app registration → Used for API access, not relevant here.

E. Microsoft 365 group → Collaboration group, not for secure upload rights.

To ensure User1 can perform insider risk management tasks only for the users and devices in Office1, the first step is to create an administrative unit in Microsoft Entra ID (formerly Azure AD).

Administrative units allow you to scope permissions to specific users, devices, and locations. By creating an administrative unit for Office1 and assigning User1 to the Insider Risk Management Admins role group within that unit, User1 will only have access to users and devices in Office1.

You need one Sensitive Information Type (SIT) per distinct information pattern. The minimum set that covers both SharePoint and Exchange is:

Credit Card Number (builtin) – used for documents and email.

UK National Health Service Number (builtin) – used for documents and email.

EU/UK Physical Address (builtin “EU PII: Physical address”).

User credentials (builtin “Credentials”/“User credentials”).

Custom keywordbased SIT for the sensitive project names (“Project Tailspin”, “Project Contoso”, “Project Falcon”) – can be one SIT using a keyword list.

SITs are reusable across locations, so you don’t count duplicates for email and documents.

Step 1 – Understand the scenario

The security manager is receiving an email every time a Data Loss Prevention (DLP) policy match occurs. The requirement is to reduce the number of unnecessary alerts and only notify for meaningful or actionable violations.

Step 2 – Analyze each option

A. From the Microsoft Defender portal, apply a filter to the alerts.

This action would only filter what is displayed in the portal. It does not prevent the security manager from receiving email notifications each time a DLP match occurs. This does not solve the problem.

B. From the Microsoft Purview portal, modify the Policy Tips settings of a DLP policy.

Policy Tips are intended for end users inside Outlook, Word, Excel, or PowerPoint to guide them about sensitive information before they send or share content. They do not change how or when admin alert notifications are triggered.

C. From the Microsoft Purview portal, modify the matched activities threshold of an alert policy.

DLP alert policies allow configuration of thresholds such as the number of matches, severity levels, and repeated activity counts. By adjusting the matched activities threshold, alerts can be generated only when a violation reaches a significant level, which reduces unnecessary alerts and ensures that notifications are sent only for actionable events. This matches the requirement.

D. From the Microsoft Purview portal, modify the User overrides settings of a DLP policy.

User override settings allow end users to bypass a DLP restriction if they provide a justification, but this does not impact the number of alert notifications sent to the security manager.

Step 3 – Microsoft Reference

According to Microsoft documentation: “You can configure alert policies with thresholds to reduce the number of alert notifications and focus only on actionable DLP events.”

Since you need to automatically apply a sensitivity label to resumes based on their content and structure (work experience, education, accomplishments), a trainable classifier is the best choice.

Trainable classifiers use machine learning to identify unstructured data, such as resumes, contracts, or legal documents. Instead of relying on predefined patterns (like keywords or regular expressions), a trainable classifier learns from sample documents and can accurately identify resumes even if they are formatted differently.

Final Approach:

● Train a trainable classifier using sample resumes.

● Deploy the classifier in Microsoft Purview.

● Configure a sensitivity label to be automatically applied when a document matches the classifier.

Box 1: Insider Risk Management policies in Microsoft Purview can be configured to detect risky behavior, such as accessing phishing websites. These policies monitor user activity, generate alerts, and help organizations investigate potential security threats.

Box 2: Microsoft Defender Browser Protection extension helps in detecting unsafe or phishing websites and integrating this detection with Insider Risk Management policies. This extension works with Microsoft Edge and Google Chrome to identify risky browsing activity and trigger alerts.

Comprehensive Detailed Explanation with References

Step 1 – Review File2 contents

File2 contains 3 IP addresses.

Step 2 – Review DLP rules and priorities

RuleConditionPolicy TipStop Processing?Priority

Rule11 or more IP addressesTip1No0

Rule23 or more IP addressesTip2Yes1

Rule32 or more IP addressesTip3No2

Step 3 – Rule evaluation order

Advanced DLP rules are processed by priority order (lowest number first).

Rule1 (Priority 0) will trigger because File2 has at least 1 IP address.

This applies Tip1.

However, Rule1 has Stop Processing = No, so evaluation continues.

Rule2 (Priority 1) will also trigger because File2 has 3 IP addresses (≥3).

This applies Tip2.

Rule2 has Stop Processing = Yes, so evaluation stops after this.

Rule3 (Priority 2) will not be evaluated because Rule2 stopped processing.

Step 4 – Final outcome

File2 matches Rule1 (Tip1), but since Rule2 fires afterward with Stop Processing = Yes, only Tip2 is applied.

Step 5 – Microsoft Reference

From Microsoft docs: “When a rule is configured to stop processing, subsequent rules are not evaluated and only the policy tip from the last triggered rule with stop processing applies.”

Retention policy tags (MRM) for Exchange Online are applied by the Managed Folder Assistant (MFA). To apply a newly created Exchange retention policy to mailbox items immediately, you manually invoke MFA with Start-ManagedFolderAssistant for the mailbox or set of mailboxes. Creating DLP policies or label policies in Purview does not accelerate MRM processing.

To create a trainable classifier that can be used in an auto-apply retention label policy, you need to follow these key steps:

1. Create the trainable classifier

This is the first step where you define the classifier, specifying the types of content it should identify.

2. Test the trainable classifier

Before using the classifier in production, you need to validate its accuracy by testing it against sample documents to ensure it correctly classifies the intended data.

3. Publish the trainable classifier

Once testing is successful, you must publish the classifier so that it can be used in policies like auto-apply retention labels in Microsoft Purview.

Step 1 – Scenario

Tenant domain = contoso.com

Encryption method = Microsoft Purview Advanced Message Encryption (AME) using branded, link-based emails.

Recipients:

Recipient1 → Contoso internal user (same tenant).

Recipient2 → External Microsoft 365 user (Fabrikam).

Recipient3 → Outlook.com consumer email.

Recipient4 → Gmail.com consumer email.

The question asks: For which recipients can User1 revoke the emails?

Step 2 – Revocation in Advanced Message Encryption

Microsoft Purview AME allows senders to:

Revoke sent encrypted emails.

Revoke applies to all recipients who receive a link-based branded encrypted message.

When revoked, the secure message link no longer works, regardless of whether the recipient is internal, external Microsoft 365, Outlook.com, Gmail, or another email provider.

This differs from traditional RMS-based encryption where revocation is tenant-specific. In AME, the revocation is possible because the recipient must open the message through a secure browser portal (Office 365 Message Encryption portal).

Step 3 – Evaluate each recipient

Recipient1 (contoso.com, internal) → Yes, message can be revoked.

Recipient2 (fabrikam.onmicrosoft.com, external Microsoft 365) → Yes, message can be revoked because AME link enforcement works across tenants.

Recipient3 (outlook.com, consumer) → Yes, message can be revoked, they use the secure OME portal.

Recipient4 (gmail.com, consumer) → Yes, message can be revoked, they also use the secure OME portal.

Step 4 – Microsoft Reference

From Microsoft Docs:

“With Advanced Message Encryption, admins can configure branding and revocation for encrypted email messages. Revocation applies to encrypted emails sent to both internal and external recipients, including those using Outlook.com, Gmail.com, and other email services.”

for each of the following you can have a retention policy

1.EXO, SPO, ODfB, M365 groups

2.Teams channel messages, teams chat

3.Teams private channel messages

To track interactions between users and generative AI websites in Microsoft Purview Audit, you need to deploy the Microsoft Purview browser extension to the devices. This extension enables tracking of user activities on web-based applications, including AI-related tools like ChatGPT, Microsoft Copilot, and other generative AI platforms.

Microsoft Purview extension provides visibility into browser-based activities, including AI tool usage, ensuring compliance and risk management within Microsoft Purview. This extension works with Microsoft Edge and Google Chrome to track and log user interactions.

The question asks about creating a Microsoft Defender for Cloud Apps (MCAS / MDA) policy that will detect Data Loss Prevention (DLP) violations.

Understanding the policy types in Defender for Cloud Apps:

File Policy

Used for monitoring and controlling files stored in cloud apps (e.g., SharePoint, OneDrive, Box, Google Drive).

Can detect sensitive information types (like credit cards, SSNs, SWIFT codes) and flag DLP violations.

Can apply governance actions (e.g., quarantine, remove sharing, notify user).

Correct for DLP violation detection.

Activity Policy

Monitors user activities (e.g., login attempts, mass downloads, suspicious behavior).

Not for file content DLP.

Session Policy

Applied through Conditional Access App Control for real-time monitoring/control during a user session.

Used for controlling actions (download, cut/paste) but not for broad DLP scanning of stored files.

Access Policy

Controls access to apps based on conditions (e.g., unmanaged device access).

Not designed for DLP content inspection.

Why File Policy is correct

Since the requirement is:

"detect DLP violations"

That means scanning file content for sensitive information. This is only possible with a File Policy in Microsoft Defender for Cloud Apps.

Step 1 – Review the configuration

Sensitivity label name: Contoso Confidential

Scope: Files and emails

Access control:

Encrypts documents/emails.

Permissions assigned to AuthenticatedUsers with Co-Author rights.

Offline access allowed only for 7 days.

Auto-labeling = None (not configured).

Content marking: Footer applied.

Step 2 – Analyze each statement

Statement 1: If a user account is disabled, the user will be immediately prevented from opening a file protected by Contoso Confidential.

Sensitivity labels with encryption enforce Azure AD authentication every time a user tries to access a file.

If the account is disabled in Azure AD, access is blocked immediately.

Answer: Yes

Statement 2: Guest users will be able to open documents protected by Contoso Confidential.

Access control was configured only for AuthenticatedUsers (internal users).

Guest or external users are not included in this group.

Therefore, guest users cannot open the protected documents.

Answer: No

Statement 3: Contoso Confidential will be applied automatically to the files stored in Microsoft SharePoint Online.

Auto-labeling for files and emails = None.

That means labeling must be applied manually by users, not automatically.

Answer: No

Final Verified Answers

If a user account is disabled, the user will be immediately prevented from opening a file protected by Contoso Confidential → Yes

Guest users will be able to open documents protected by Contoso Confidential → No

Contoso Confidential will be applied automatically to the files stored in Microsoft SharePoint Online → No

To review a Microsoft 365 Copilot usage report, you need to use Data Security Posture Management for AI (DSPM for AI) in the Microsoft Purview portal. DSPM for AI provides insights into AI-related activities, including Copilot usage, risk assessments, and data security posture related to AI interactions within Microsoft 365.

Step 1 – Requirement analysis

You need to prevent users from:

Pasting credit card numbers into ChatGPT/Google Gemini.

Uploading classified documents into ChatGPT/Google Gemini.

Both scenarios involve AI websites. Microsoft Purview provides Data Security Posture Management for AI and Endpoint DLP integrations that work through Data Loss Prevention (DLP) and Insider Risk Management policies.

Step 2 – Credit card numbers

Credit card numbers are structured sensitive information types (SITs).

DLP policies are the correct Microsoft Purview solution for detecting and blocking sensitive info (e.g., credit card, SSN, health ID) from being copied, pasted, or uploaded into restricted destinations like AI apps.

Therefore, Data Loss Prevention is the right choice.

📖 Reference: Learn about Endpoint DLP and AI sites

Step 3 – Documents

Documents containing classified or labeled data (via sensitivity labels) fall under insider risk activity detection when exfiltrated.

Insider Risk Management policies can monitor and block uploads of classified/labeled files to AI services such as ChatGPT or Gemini.

Therefore, Insider Risk Management is the right choice for preventing document uploads.

📖 Reference: Insider Risk Management – risky AI activity detection

The requirement states that all Microsoft 365 data for users must be retained for at least one year. In Microsoft 365, retention policies must be configured for each type of data storage.

Step 1: Identifying Where Data is Stored

From the case study, users store data in the following locations:

● SharePoint Online sites

● OneDrive accounts

● Exchange email

● Exchange public folders

● Teams chats

● Teams channel messages

Since these locations fall under two broad categories:

● Microsoft Exchange data (Emails, Public folders)

● SharePoint, OneDrive, and Teams data

Step 2: Required Retention Policies

1️. A single retention policy can cover:

● SharePoint Online

● OneDrive

● Microsoft Teams

2. A second retention policy is required for:

● Exchange (Emails & Public Folders)

Thus, the minimum number of retention policies required to meet the requirement is 2.

Microsoft 365 retention policies can be applied broadly across multiple services with just two policies:

● One for Exchange & Public Folders

● One for SharePoint, OneDrive, and Teams

There's no need for separate policies for each individual workload unless different retention durations are required, which is not stated in the requirement.

To detect and protect confidential documents, we need a custom rule to identify project codes that start with 999 (since they are classified as confidential).

Box 1: A Sensitive Info Type (SIT) allows Microsoft Purview DLP policies to recognize structured data (e.g., project codes). DLP policies require a sensitive info type to detect content based on patterns, keywords, or dictionary terms. A sensitivity label alone does not define detection logic—it is used for classification and protection after content is identified.

Box 2: Since project codes follow a structured 10-digit pattern, we should use a Regular Expression (Regex) to match project codes that start with 999.

Example Regex pattern:

999\d{7}

This pattern detects a 10-digit number starting with "999".

To meet the requirement that all administrative users must be able to create Microsoft 365 sensitivity labels, we need to assign the Sensitivity Label Administrator role to the correct users.

Sensitivity Label Administrator Role Responsibilities

This role allows users to:

● Create and manage sensitivity labels in Microsoft Purview.

● Publish and configure auto-labeling policies.

● Modify label encryption and content marking settings.

Review of Admin Roles from the Table:

Users that must be assigned the Sensitivity Label Administrator role:

● Admin2 (Compliance Data Administrator)

● Admin3 (Compliance Administrator)

● Admin1 (Global Reader) (should be assigned this role to fulfill the requirement that all admins can create labels).