CertifyDeckCargando contenido…
The official Microsoft Certified: Information Security Administrator Associate syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Implement and manage data classification
Microsoft Purview identifies sensitive items in three ways: manually by users, with pattern-based sensitive information types and with machine learning trainable classifiers. Each requirement maps to a classifier: built-in or named entity SITs, exact data match, document fingerprinting, credential SITs, or OCR to extend detection to images.
Learn about sensitive information types ↗Microsoft Purview Classifiers Overview ↗
A requirement becomes a SIT pattern: a primary element (regular expression, keyword list or dictionary, or function), supporting elements, character proximity and a confidence level. Built-in SITs can't be edited but can be copied as templates; named entity SITs can't be copied and are used through enhanced DLP templates. Date or checksum validators reduce false positives.
Learn about sensitive information types ↗Sensitive information type REGEX validators and additional checks ↗
A custom SIT is created in the portal (name, patterns with a primary element, proximity, supporting elements and confidence level) or in PowerShell through XML rule packages. Regular expressions avoid anchors and use a single capturing group with alternation. Keyword dictionaries scale better than keyword lists, and existing SharePoint content must be recrawled.
Create custom sensitive information types ↗Modify a custom sensitive information type using PowerShell ↗
Document fingerprinting turns a standard form, ideally blank, into a sensitive information type that stores only a hash of its text. It's used in DLP (Exchange, SharePoint, OneDrive, Teams and devices) and auto-labeling, with partial percentage-based or exact matching. It doesn't detect password-protected or image-only files, and devices require Advanced classification scanning and protection.
An exact data match SIT detects real values from your own source table, which is hashed with a salt and uploaded with the EDM Upload Agent by an account in the EDM_DataUploaders group; hashing and uploading from two separate computers is the best practice. The schema defines searchable fields and options such as caseInsensitive and ignoredDelimiters, and the new experience builds schema and SIT in one flow.
Learn about exact data match based sensitive information types ↗Hash and upload the sensitive information source table for exact data match sensitive information types ↗
Trainable classifiers use machine learning to recognize categories of content that have no fixed pattern. Pretrained classifiers are ready to use; custom ones are seeded with positive and negative samples in dedicated SharePoint folders, tested and then published. A published classifier can't be retrained, only recreated, and classifiers don't evaluate encrypted items.
Learn about trainable classifiers ↗Get started with trainable classifiers ↗
Data explorer and Content explorer show a current snapshot of items that have a sensitivity label, a retention label or a classification, and let you export to .csv and save views. Opening the page isn't enough: seeing the item list needs the List viewer role group and seeing contents needs Content viewer, both restrictable by administrative unit. Activity history lives in Activity explorer.
Get started with data explorer ↗Get started with content explorer ↗
Microsoft Purview OCR is enabled at the tenant level after Microsoft Syntex pay-as-you-go billing is set up; you then choose the locations (Exchange, SharePoint, OneDrive, Teams and devices) and the groups. No new classifiers are needed: sensitive information types, EDM, fingerprints and trainable classifiers also scan images, but only those uploaded after OCR is enabled.
Learn about optical character recognition in Microsoft Purview ↗
Implement and manage sensitivity labels in Microsoft Purview
Labels are created and configured by the Information Protection and Information Protection Admins role groups, or by a custom role group with the Sensitivity Label Administrator role (Sensitivity Label Reader for read-only). These permissions are not needed to apply labels, and Microsoft Entra administrative units restrict an administrator to the users in their units.
Get started with sensitivity labels ↗Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview ↗
A label scope decides what you can configure and where the label appears: files, emails, meetings (which requires files and emails) or groups and sites, which protects containers without labeling their items. List order sets priority (most restrictive at the bottom), label groups replace parent labels, and removing a label from its policies is less risky than deleting it.
Learn about sensitivity labels ↗Create and publish sensitivity labels ↗
Label access control uses Azure Rights Management: the administrator assigns permissions now (users, groups or domains, expiry and offline access) or lets users assign them with Do Not Forward, Encrypt-Only or custom permissions in Word, PowerPoint and Excel. Content marking adds headers, footers and watermarks with variables; a dynamic watermark requires encryption.
Apply encryption using sensitivity labels ↗Manage sensitivity labels in Office apps ↗
Labels are published to users and groups with label policies that define the default label (documents, emails, meetings, containers and Power BI), mandatory labeling, justification for downgrades and a help link. When a user gets several policies and a setting conflicts, the policy with the highest order number wins; supported groups include security, distribution and Microsoft 365 groups.
Learn about sensitivity labels ↗Create and publish sensitivity labels ↗
Auto-labeling policies run in the service for files at rest in SharePoint and OneDrive and for email in transit in Exchange, without user interaction, and must run in simulation first. They require auditing and labels enabled for Office files; by default they do not replace manually applied labels, but they can be configured to replace lower-priority ones.
Automatically apply a sensitivity label to Microsoft 365 data ↗
To label containers you enable EnableMIPLabels in Microsoft Entra ID and synchronize labels with Execute-AzureAdLabelSync; when a team is created, the label applies to the group and the site but not to their items. In Power BI, labels do not control access in the service: their encryption applies on export, and downstream inheritance propagates them to content built from a model or report.
Use sensitivity labels to protect collaborative workspaces (groups and sites) ↗Sensitivity labels in Power BI ↗
Microsoft Defender for Cloud Apps applies Microsoft Purview sensitivity labels as a file policy governance action or directly to a file. It needs the Microsoft 365 app connector and published labels scoped to Files and emails. It can't remove encrypted labels applied elsewhere, and it doesn't label empty or password-protected files or files in libraries that require checkout.
Integrate Microsoft Purview sensitivity labels with Defender for Cloud Apps ↗
Implement information protection for Windows, file shares, and Exchange
The Microsoft Purview Information Protection client runs only on Windows, replaces the AIP unified labeling client and provides the File Explorer file labeler, the viewer, the scanner and a PowerShell module; it has no Office add-in. Non-interactive upgrades from AIP need the AllowMajorVersionUpgrade registry key, and disconnected computers support only labels without encryption.
The Microsoft Purview Information Protection client labels and encrypts files from File Explorer or PowerShell. Office and PDF files get native encryption; other types such as .jpg or .txt switch to a p-prefixed extension, and the rest get generic .pfile encryption, which doesn't enforce usage rights. System types such as .exe or .pst are excluded, and label policy advanced settings control options such as custom permissions.
Extend sensitivity labeling on Windows ↗PowerShell advanced settings for Microsoft Purview Information Protection client ↗
The Microsoft Purview Information Protection scanner is a Windows Server service that crawls network shares and SharePoint Server libraries in cycles to discover, label and encrypt files. It needs the full client, SQL Server and a service account synchronized to Microsoft Entra ID. You configure it with a cluster and a content scan job, and by default it encrypts only Office and PDF files.
Learn about the Microsoft Purview Information Protection scanner ↗Configure and install the Microsoft Purview Information Protection scanner ↗
Microsoft Purview Message Encryption is built on the Azure Rights Management service, its only prerequisite, and isn't compatible with AD RMS. Users encrypt from Outlook, and admins automate encryption with mail flow rules or DLP policies using Encrypt-Only, Do Not Forward or templates. Microsoft 365 recipients read the message inline in Outlook, and other recipients use the encrypted message portal.
Microsoft Purview Message Encryption ↗Define mail flow rules to encrypt email messages ↗
Microsoft Purview Advanced Message Encryption extends Message Encryption with multiple branding templates, message expiration and revocation, and encrypted message portal activity logs. It works only for external recipients who read mail through the portal, which you ensure by applying a custom branding template with a mail flow rule that is processed after the encryption rule.
Advanced Message Encryption ↗Add your brand to encrypted messages ↗