CertifyDeck
Start for free
All cheat sheets
SC-401 · CHEAT SHEET

Microsoft Certified: Information Security Administrator Associate

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Implement information protection

30–35%

Implement and manage data classification

  • Microsoft Purview identifies sensitive items in three ways: manually by users, with pattern-based sensitive information types and with machine learning trainable classifiers. Each requirement maps to a classifier: built-in or named entity SITs, exact data match, document fingerprinting, credential SITs, or OCR to extend detection to images.
  • A requirement becomes a SIT pattern: a primary element (regular expression, keyword list or dictionary, or function), supporting elements, character proximity and a confidence level. Built-in SITs can't be edited but can be copied as templates; named entity SITs can't be copied and are used through enhanced DLP templates. Date or checksum validators reduce false positives.
  • A custom SIT is created in the portal (name, patterns with a primary element, proximity, supporting elements and confidence level) or in PowerShell through XML rule packages. Regular expressions avoid anchors and use a single capturing group with alternation. Keyword dictionaries scale better than keyword lists, and existing SharePoint content must be recrawled.
  • Document fingerprinting turns a standard form, ideally blank, into a sensitive information type that stores only a hash of its text. It's used in DLP (Exchange, SharePoint, OneDrive, Teams and devices) and auto-labeling, with partial percentage-based or exact matching. It doesn't detect password-protected or image-only files, and devices require Advanced classification scanning and protection.
  • An exact data match SIT detects real values from your own source table, which is hashed with a salt and uploaded with the EDM Upload Agent by an account in the EDM_DataUploaders group; hashing and uploading from two separate computers is the best practice. The schema defines searchable fields and options such as caseInsensitive and ignoredDelimiters, and the new experience builds schema and SIT in one flow.

Implement and manage sensitivity labels in Microsoft Purview

  • Labels are created and configured by the Information Protection and Information Protection Admins role groups, or by a custom role group with the Sensitivity Label Administrator role (Sensitivity Label Reader for read-only). These permissions are not needed to apply labels, and Microsoft Entra administrative units restrict an administrator to the users in their units.
  • A label scope decides what you can configure and where the label appears: files, emails, meetings (which requires files and emails) or groups and sites, which protects containers without labeling their items. List order sets priority (most restrictive at the bottom), label groups replace parent labels, and removing a label from its policies is less risky than deleting it.
  • Label access control uses Azure Rights Management: the administrator assigns permissions now (users, groups or domains, expiry and offline access) or lets users assign them with Do Not Forward, Encrypt-Only or custom permissions in Word, PowerPoint and Excel. Content marking adds headers, footers and watermarks with variables; a dynamic watermark requires encryption.
  • Labels are published to users and groups with label policies that define the default label (documents, emails, meetings, containers and Power BI), mandatory labeling, justification for downgrades and a help link. When a user gets several policies and a setting conflicts, the policy with the highest order number wins; supported groups include security, distribution and Microsoft 365 groups.
  • Auto-labeling policies run in the service for files at rest in SharePoint and OneDrive and for email in transit in Exchange, without user interaction, and must run in simulation first. They require auditing and labels enabled for Office files; by default they do not replace manually applied labels, but they can be configured to replace lower-priority ones.

Implement information protection for Windows, file shares, and Exchange

  • The Microsoft Purview Information Protection client runs only on Windows, replaces the AIP unified labeling client and provides the File Explorer file labeler, the viewer, the scanner and a PowerShell module; it has no Office add-in. Non-interactive upgrades from AIP need the AllowMajorVersionUpgrade registry key, and disconnected computers support only labels without encryption.
  • The Microsoft Purview Information Protection client labels and encrypts files from File Explorer or PowerShell. Office and PDF files get native encryption; other types such as .jpg or .txt switch to a p-prefixed extension, and the rest get generic .pfile encryption, which doesn't enforce usage rights. System types such as .exe or .pst are excluded, and label policy advanced settings control options such as custom permissions.
  • The Microsoft Purview Information Protection scanner is a Windows Server service that crawls network shares and SharePoint Server libraries in cycles to discover, label and encrypt files. It needs the full client, SQL Server and a service account synchronized to Microsoft Entra ID. You configure it with a cluster and a content scan job, and by default it encrypts only Office and PDF files.
  • Microsoft Purview Message Encryption is built on the Azure Rights Management service, its only prerequisite, and isn't compatible with AD RMS. Users encrypt from Outlook, and admins automate encryption with mail flow rules or DLP policies using Encrypt-Only, Do Not Forward or templates. Microsoft 365 recipients read the message inline in Outlook, and other recipients use the encrypted message portal.
  • Microsoft Purview Advanced Message Encryption extends Message Encryption with multiple branding templates, message expiration and revocation, and encrypted message portal activity logs. It works only for external recipients who read mail through the portal, which you ensure by applying a custom branding template with a mail flow rule that is processed after the encryption rule.

2. Implement data loss prevention and retention

30–35%

Create and configure data loss prevention policies

  • Designing a data loss prevention policy starts with stakeholders and an intent statement that answers what to monitor, the scope, where, which conditions and which actions. The chosen locations limit how content can be defined: when you combine them, the location that doesn't support a method wins. Roll out in simulation mode, first without and then with policy tips, before enforcing the policy.
  • Creating and deploying DLP policies requires role groups such as Compliance Administrator, Compliance Data Administrator, Information Protection or Information Protection Admins; Analysts and Investigators manage alerts with view-only policy access, and Readers only view reports. An administrative unit restricted admin manages only the policies and alerts of that unit, and an Entra role overrides a scoped assignment.
  • A DLP policy is rolled out by combining state, actions and scope: create it as Keep it off, move to simulation mode, then simulation with policy tips for a pilot group, and finally turn it on. Allow exists only for Devices, Block with override lets users bypass with a reason, and a Devices policy applies only when both user and device are in scope.
  • Adaptive Protection adds the Insider risk level for Adaptive Protection is condition (Elevated, Moderate, Minor) to DLP for Exchange Online, Devices and Teams. Quick setup creates two DLP policies in simulation mode, and on devices you need advanced classification or the File type is condition. Creating these policies requires roles such as Compliance Data Administrator or DLP Compliance Management.
  • In Exchange, SharePoint and OneDrive, rules take priority in creation order and the most restrictive matching rule is enforced, while all matches are logged. On devices, the most restrictive actions of all matching policies are aggregated; for identical actions the enforced policy and then the higher-priority policy win, and No override beats Allow override.

Implement and monitor Microsoft Purview Endpoint DLP

  • Endpoint DLP needs Windows devices that are Microsoft Entra joined (or hybrid joined or registered), with Real-time protection and Behavior monitor enabled and MpDlpService.exe allowed; devices already onboarded to Defender for Endpoint need no more steps. The Purview extensions for Chrome and Firefox are used only on Windows, and servers need Endpoint DLP turned on after onboarding.
  • DLP rules for devices support AND, OR and NOT conditions in nested groups, and per-activity actions that can be refined with authorization groups (printers, USB devices, network shares) and network exceptions, where the VPN entry must have top priority. Restricted app group settings override the restricted apps list within the same rule.
  • Endpoint DLP settings are global and apply to every DLP policy for devices: cloud-based advanced classification (exact data match, trainable classifiers), file path exclusions, restricted apps and app groups (the group overrides the list in the same rule), Auto-quarantine, service domains, and printer, USB and network share groups.
  • Just-in-time protection holds egress activities (print, copy to USB or network share, RDP, Bluetooth, upload to restricted domains) on never-evaluated or stale files while evaluation completes, and only when a rule blocks that activity. The fallback action decides what happens if classification fails; JIT path exclusions affect only JIT.
  • Once a device is onboarded, its audited activity reaches activity explorer even without policies; Always audit file activity for devices audits Office, PDF and CSV files without a policy match. Windows servers need Endpoint DLP turned on. Alerts are reviewed in the DLP alerts dashboard or Defender XDR, and evidence collection stores full copies in Azure.

Implement and manage retention

  • Retention labels work at item level and add what policies lack: starting when labeled or on an event, record declaration and disposition review. Disposition review needs the Disposition Management role, and content stays in place while it waits. File plan bulk-imports labels, and events start event-based retention.
  • An adaptive scope is a daily query on user attributes, Microsoft 365 group attributes or SharePoint site properties, so membership updates itself. Role groups with Scope Manager create them; the advanced builder uses OPATH or KeyQL and is required to exclude inactive mailboxes. Queries are validated with PowerShell or SharePoint search.
  • Retention labels add item-level exceptions to retention policies: retain-only, delete-only or retain then delete, starting at creation, last modification or labeling. At the end they can switch to another label or deactivate retention. After saving, the name and record option can't change, and a label can only be deleted when no policy includes it.
  • Publishing retention labels needs a label policy that makes them available to users and admins in Exchange, SharePoint, OneDrive and Microsoft 365 Groups. For an adaptive policy, scopes must exist first and decide which locations you can select. Teams, Viva Engage and public folders don't support labels; failed distribution is retried with -RetryDistribution.
  • An auto-apply policy assigns a single retention label to unlabeled content that contains sensitive information types, keywords or searchable properties, or matches trainable classifiers; it can also label cloud attachments. It can run in simulation mode for sensitive information types and queries, never replaces a label that is already applied, and trainable classifiers require a static scope.

3. Manage risks, alerts, and activities

30–35%

Implement and manage Microsoft Purview Insider Risk Management

  • Insider Risk Management uses six role groups: Insider Risk Management (full access), Admins (policies, settings, and Adaptive Protection), Analysts (alerts and cases), Investigators (plus forensic evidence and Content Explorer), Auditors (audit logs), and Approvers (approve forensic captures). Administrative units restrict members to the users of a region or department.
  • Insider Risk Management imports external signals through data connectors: the HR connector (CSV files with resignations, job level changes, reviews, and improvement plans), the Healthcare connector (EHR audit data), and the Physical badging connector (physical access in JSON). They are created with the Data Connector Admin role, a Microsoft Entra app registration, and a script that uploads data with the connector job ID.
  • The security policy violation templates use Microsoft Defender for Endpoint alerts about defense evasion of security controls and unwanted software. They require an active Defender for Endpoint subscription, turning on endpoint alert sharing with Microsoft Purview in its advanced features, and selecting its indicators; alerts are imported daily based on the chosen triage statuses.
  • Insider Risk Management settings apply to all policies regardless of template. Privacy anonymizes usernames; Policy timeframes sets the activation window and past activity detection; Intelligent detections tunes alert volume and imports Defender for Endpoint alerts; Global exclusions removes domains, paths, file types or keywords from scoring.
  • All global indicators are disabled by default: you enable them in Policy indicators and only then select them in each policy, where you tune their thresholds. Indicators cover Office, devices, DLP, Communication Compliance, Microsoft Entra ID and cloud apps, plus risk score boosters, variants with detection groups and custom indicators through a connector.

Manage information security alerts and activities

  • Audit (Premium) includes all of Audit (Standard) and adds retention policies, longer retention and intelligent insights. To log its events, each user needs a qualifying license and the Microsoft 365 Advanced Auditing plan enabled; Exchange search auditing (SearchQueryInitiated) is turned on per mailbox. Ten-year retention requires a per-user add-on license and is not retroactive.
  • Searching the audit log requires the Audit Logs or View-Only Audit Logs role (Audit Manager or Audit Reader role groups). Searches filter by dates, users, activities, exact operation names, record types and workloads; keyword search only covers indexed content. Admins restricted by administrative units cannot see some events, and MailItemsAccessed helps scope a compromised mailbox.
  • Audit log retention policies are an Audit (Premium) feature and require the Organization Configuration role. They are scoped by users, record types and activities, with a duration and a priority: the lowest value wins and any custom policy overrides the default policy, which cannot be edited. Changes do not affect audit records that were already committed.
  • Activity explorer gives a historical view of activities on labeled content and DLP matches, built from the unified audit log, so it is not real time. You analyze it with filters and filter sets (Endpoint DLP activities, labels changed, egress). Some sources, such as Power BI, appear only in the audit log, and rules that allow activity without auditing generate no rule matched events.
  • DLP alerts are configured in policy rules and reviewed in the DLP Alerts dashboard, which requires the Manage alerts role plus DLP Compliance Management or its view-only version. You filter alerts, review their events, assign ownership with comments and set them to Resolved. Content preview requires Content Explorer Content Viewer, and audit retention settings control how long alerts stay visible.

Protect data used by AI services

  • Purview protects AI usage with existing controls: encrypting labels require the VIEW and EXTRACT rights, the DLP location for Microsoft 365 Copilot stops labeled items from being processed or sensitive prompts from going to web search, Endpoint DLP acts on third-party AI sites, and audit, eDiscovery, retention and Communication Compliance manage prompts and responses.
  • SharePoint Advanced Management helps prepare for Copilot: data access governance reports find overshared sites, Restricted Content Discovery temporarily hides a site from search and Copilot without changing permissions, and restricted access control limits a site or OneDrive to members of specific groups, which Copilot also honors.
  • DSPM for AI needs Purview auditing turned on and Microsoft 365 Copilot licenses to show Copilot interactions; for third-party AI sites, devices must be onboarded to Purview and the browser extension deployed. Other Copilots and AI apps need collection policies, Purview SDK integration or an Edge configuration policy, and Fabric assessments need an Entra-registered app.
  • In Data Security Posture Management, the Entra Compliance Administrator and Global Administrator roles and the Purview Compliance Administrator role group can create and edit; Security Reader, Data Security AI Viewer and AI Administrator are view-only. Viewing AI prompts and responses needs Data Security AI Content Viewer or Content Explorer Content Viewer, and Data Security AI Admin edits Copilot DLP policies without reading them.
  • DSPM for AI offers one-click policies that are created in other Purview solutions (DLP, insider risk management, Communication Compliance and collection policies) and edited there. Those that use Adaptive Protection turn it on with default risk levels, the network policy needs a SASE or SSE integration, and with administrative units only an unrestricted administrator can create them.
Practice this certification