Reviews 4,2
Reviews 4,5
SC-401 Information Security Administrator
Information security has become a strategic priority: threats grow more sophisticated, compliance demands increase, and cloud adoption introduces new vulnerabilities. The SC-401 course provides the technical foundation for an effective security strategy.
Key topics
- Designing and operating security architectures in Microsoft environments
- Permission management and identity-based access protection
- Threat analysis, log evaluation, and security incident response
- Protecting sensitive data across cloud services and hybrid infrastructure
- Compliance enforcement and insider risk management
Prerequisite
Experience in IT administration is required, along with knowledge of network infrastructure, cloud services, and foundational IT security concepts.
Target group
This course is designed for IT security professionals working with Microsoft technologies who are responsible for data protection, compliance, and threat mitigation.
Completing SC-401 enables participants to develop targeted security policies, identify risks early, and maintain lasting protection for sensitive information.
Course content
Prerequisites for the course
- Familiarity with Microsoft Purview and its compliance tools
- Basic understanding of data protection and information security principles
- Knowledge of Microsoft security and compliance solutions
- Understanding of core information protection and data security concepts
- Overview of data management capabilities in Microsoft 365
Data security in digital practice
- Growing data protection requirements in organizations
- Secure handling of confidential and sensitive information
- Implementing data protection in zero-trust architectures
- Relevance of data classification and targeted data security
- Preventing data leaks and protecting against insider threats
- Evaluating security alerts and managing threats effectively
- Protecting data created and processed by AI systems
Data classification as a security foundation
- Fundamentals and overview of data classification
- Identifying and systematically categorizing sensitive information types
- Applying customizable algorithms for classification
- Building and configuring custom trainable classifiers
Analyzing classification and data protection
- Evaluating classification status and protection measures
- Investigating data records in Content Explorer
- Monitoring and controlling activities on classified data
Managing sensitive information types
- Understanding and categorizing sensitive information types
- Comparing and evaluating different information types
- Creating custom information types
- Using exact data match for precise identification
- Setting up document fingerprinting
- Identifying and working with named entities
- Building and maintaining keyword dictionaries
Sensitivity labels with Purview
- Overview of sensitivity labels and their use cases
- Creating and configuring labels and associated policies
- Enabling data encryption through sensitivity labels
- Defining and applying automatic labeling rules
- Tracking labeling activities in Microsoft Purview
Sensitivity labels in Microsoft 365
- Activating and embedding sensitivity labels in Microsoft 365
- Using and managing labels across Office applications
- Securing collaborative work with Microsoft 365 Copilot
- Protecting online meetings with sensitivity labels
- Applying labels consistently in Teams, groups, and SharePoint
Setting up local file protection with Purview
- Securing local files and drives with Purview
- Configuring the Purview Information Protection Scanner
- Installing, setting up, and testing the scanner service
- Running scans, monitoring progress, and reviewing results
- Deploying DLP policies for on-premises environments
Data encryption in Microsoft 365
- Encryption methods for data in Microsoft 365
- Activating service encryption through Microsoft Purview
- Managing encryption keys with Customer Key
- Securing data in transit through encryption
Email encryption and message protection
- Understanding message protection and encryption concepts
- Planning and preparing Purview Message Encryption
- Configuring and activating message protection
- Setting up corporate branding for encrypted emails
- Controlling access permissions for encrypted messages
- Linking email flow rules with protection templates
DLP policies with Microsoft Purview
- Applying data loss prevention in an organizational context
- Designing, planning, and structuring DLP policies
- Testing policies in simulation mode and rolling them out gradually
- Creating, updating, and centrally managing DLP policies
- Integrating Adaptive Protection for dynamic data security
- Identifying and assessing data risks using DLP analytics
- Understanding DLP alerts and systematically monitoring activities
Endpoint DLP with Microsoft Purview
- Overview of Endpoint DLP and its use cases
- Hands-on exercises for Endpoint DLP
- Onboarding devices into the DLP solution
- Configuring Endpoint DLP settings
- Managing and updating DLP policies on endpoints
- Deploying and setting up the Purview browser extension
- Activating and managing Just-in-Time protection
Data protection in Microsoft Defender for Cloud Apps
- Configuring data protection policies for Power Platform
- Setting up file and information protection in Defender for Cloud Apps
- Defining and activating security policies in Defender
- Detecting and resolving data protection violations in Defender
Understanding and managing DLP alerts
- Understanding the structure and purpose of DLP alerts
- Following the lifecycle of a DLP alert from detection to resolution
- Optimizing DLP policies based on alert findings
- Evaluating and classifying alerts in Microsoft Purview
- Investigating DLP events in Microsoft Defender XDR
- Initiating appropriate responses to DLP alerts
Insider risk management with Purview
- Defining insider risk and its relevance to organizations
- Getting to know Purview Insider Risk Management as a security solution
- Key features of Purview Insider Risk Management at a glance
- Case study: Protecting sensitive data from insider threats
Building an insider risk strategy
- Developing a targeted insider risk strategy
- Preparing the organization and its prerequisites for risk management
- Adapting system settings to internal requirements
- Connecting Purview to existing systems and data sources
Configuring insider risk policies
- Understanding the types and structure of insider risk policies
- Comparing and evaluating different risk policies
- Creating and activating custom insider risk policies
- Maintaining and updating existing risk policies
Analyzing insider risk alerts
- Understanding the structure and significance of insider risk alerts
- Monitoring and evaluating alert volumes
- Performing structured triage in Microsoft Purview
- Analyzing risk context using the ‘All risk factors’ view
- Reviewing activity details in Activity Explorer
- Recognizing temporal activity patterns via ‘User Activity’
- Investigating insider risk alerts in Microsoft Defender XDR
- Coordinating and managing escalated insider risk cases
Adaptive Protection for insider risks
- Understanding the concept and functionality of Adaptive Protection
- Defining risk levels in the Adaptive Protection model
- Setting up and activating Adaptive Protection step by step
- Maintaining and adjusting Adaptive Protection settings
AI security with Purview DSPM
- Identifying security risks associated with AI systems
- Getting to know Microsoft Purview Data Security Posture Management (DSPM) for AI
- Configuring and activating DSPM for AI environments
- Evaluating and interpreting AI-related security reports
- Reviewing Copilot usage and activities in Microsoft Purview
Data protection for AI-related security risks
- Using DSPM as a tool for AI security assessment
- Protecting Copilot-generated content with sensitivity labels
- Deploying Endpoint DLP to prevent AI-related data loss
Managing and controlling AI interactions
- Defining and applying retention rules for Copilot data
- Locating and deleting Copilot content using eDiscovery
- Systematically monitoring AI interactions and activities
Purview as a governance tool for AI use
- Using data insights and analytics to detect AI-related risks
- Applying Insider Risk Management to AI usage scenarios
- Case study: Adaptive Protection against AI-specific risks
Retention rules in Microsoft Purview
- Fundamentals of data retention and the information lifecycle
- Understanding how retention policies are built and work
- Calculating and setting specific retention periods
Managing retention labels and policies
- Creating and deploying retention labels
- Defining and activating automatic labeling rules
- Adjusting and managing adaptive scopes
- Creating and configuring retention policies
- Understanding label priority and conflict resolution in Purview
- Restoring deleted or modified data in Microsoft 365
Using Microsoft Purview Audit
- Getting to know the capabilities of Microsoft Purview Audit
- Configuring and administering the audit solution
- Conducting basic searches with Audit Standard
- Tracing Copilot activities in the audit log
- Analyzing advanced audit capabilities with Audit Premium
- Exporting and processing log data
- Defining retention periods for audit logs
eDiscovery in Microsoft Purview
- Overview of eDiscovery and search functions in Microsoft Purview
- Technical prerequisites for eDiscovery
- Creating and structuring an eDiscovery search
- Running an eDiscovery search and reviewing results
- Exporting and preparing search results for further use
