Sign In
In this section

Microsoft 365 Data Security Engineering: Course Orientation

Module 0
Unknown documents drifting and overlapping at the left, sorting into ordered tagged stacks as they move right, with a few left deliberately untagged past a dashed line
MICROSOFT 365 DATA SECURITY ENGINEERING · MODULE 00
Your organization already knows what its sensitive data is. Nothing in your tenant does.
Microsoft Purview Sensitivity Labels DLP + Endpoint DLP Insider Risk DSPM for AI 13 modules 36-40 hours

Why this course exists

Most organizations running Microsoft 365 already own Purview. Far fewer have it configured, and of those, a good number were configured once by somebody who has since left, in a hurry, against a requirement nobody wrote down.

The reason is not laziness. Data security is a genuinely different job from the two disciplines it sits next to, and the skills do not transfer as cleanly as the org chart assumes. Identity security has a subject: a user, a token, a sign-in you can point at. Endpoint security has an object: a device you own, that runs your agent, that you can isolate. Data security has neither. Data has no boundary, no session, and no agent. It is copied rather than accessed, it leaves in a hundred ordinary ways that all look like work, and the thing you are trying to protect is a property of the content rather than of the container it happens to be sitting in this morning.

Which produces a specific failure, and it is the one this course is built around. Every control in Purview resolves to a question about content: is this sensitive, and how do we know? A sensitivity label applies because a classifier matched. A DLP rule blocks because a classifier matched. Retention applies, insider risk scores, a Copilot response is withheld, all because something decided what a piece of content was. When that decision is wrong, it is not one broken control. It is every control standing on it, wrong in the same direction, silently, for as long as nobody measures it.

And nothing tells you. That is the property that makes this discipline hard and this course long: in data security, wrong is quiet. A misconfigured firewall rule breaks something and somebody rings you. A misconfigured classifier produces a clean dashboard and a false sense of a programme.

Three disciplines, and the one with nothing to hold on to Identity security has a SUBJECT a user, a token, a sign-in you can point at it and it tells you when it fails Endpoint security has an OBJECT a device you own, running your agent and it tells you when it fails Data security has NEITHER no boundary, no session, no agent, copied not accessed and it stays silent when it fails Every control here stands on one decision: is this sensitive, and how do we know? Get that wrong and six enforcement decisions inherit it, in the same direction, without a word.

The skills from the first two boxes do not carry into the third, and most Purview deployments are staffed as though they do.

What you will be able to do

You will walk into a tenant that has the licence and none of the configuration, and leave it with a programme you can defend to an auditor, including an honest account of what it does not cover.

The arc: what you can do at each stage Today licence, no config Know build a classifier and measure it Mark a taxonomy that survives contact with users Stop DLP on the paths data actually leaves through Prove watch, investigate, and defend it

Each stage is only worth building because the one before it can be trusted, which is why the course refuses to move on until you can measure.

Concretely, by the end you can build custom sensitive information types, document fingerprints, Exact Data Match and trainable classifiers, and choose correctly between them. You can obtain a false-positive rate from real content and tune on evidence rather than on the last complaint. You can design a label taxonomy, publish it, and apply it without depending on users. You can take DLP from a requirement to a policy, resolve rule precedence, and roll out simulation to audit to block in the only safe order. You can deploy endpoint DLP across USB, cloud sync, print, clipboard and unallowed apps. You can set retention that satisfies a regulator without hoarding. You can run insider risk without producing four hundred alerts a week. And you can answer what left, when, and who moved it, which is the question that arrives on the day none of the rest of it mattered enough.

The data you will be defending

Northgate Engineering is an 810-person engineering firm on Microsoft 365 E5. It is not a bank and it does not process cardholder data at scale, which is deliberate, because the interesting data security problems are not the regulated ones.

Northgate's crown jewels are its client contracts and its technical proposals. Both are commercially devastating if a competitor reads them and neither is covered by a single built-in classifier, because no vendor ships a pattern for "the thing that makes this firm money". Its contracts run fifteen years, half of them scanned paper with no reference number. Its proposals are sensitive because of what they describe rather than what they contain. Its engineers email drawings, photograph whiteboards, and paste screenshots into Teams a hundred times a day.

One organization emitting its data through five channels, mail, documents, chat, device files and photographs, each stream passing through a single narrow band where every item is tagged, then continuing out of frame with two items still untagged

That is the estate, and the shape of it is the point. Data leaves an organization through many ordinary channels at once, all of which look like work, and there is exactly one place where anybody decides what each thing is. Everything downstream inherits that decision.

You will meet the same people throughout: Rachel Okafor, the CISO, who has promised a client's auditor something you now have to be able to prove. Elena Petrova in GRC, who owns the definitions and will not give you a copy of the contract register. Marcus Webb, the security architect, whose credit card classifier returned 4,318 matches nobody can explain. Phil Greaves, the IT Director, who wants to know what the meter costs. Their disagreements are the course, because none of the real decisions here are technical.

How the course is built

Thirteen modules across six phases, then reference and completion. The order is not negotiable and the reason is in the first phase: everything after Phase 1 stands on a classifier, so the course refuses to build controls on top of a decision you cannot measure.

Six phases, and each one is load-bearing for the next M0 · Course Orientation you are here Phase 1 · Know your data M1 the discipline and the licensing baseline · M2 classification, the heaviest module in the course Phase 2 · Mark your data M3 sensitivity labels and taxonomy · M4 auto-labelling and containers · M5 protection beyond the tenant Phase 3 · Stop it leaving M6 DLP policy design and precedence · M7 endpoint DLP across every channel Phase 4 · Keep and dispose M8 retention, precedence, recovery Phase 5 · Watch and investigate M9 insider risk · M10 audit and investigation Phase 6 · AI and capstone M11 data security for AI and Copilot readiness · M12 the capstone, on a requirement set you have not seen then Reference, and Course Completion

Phase 1 is two modules and roughly a fifth of the course. That ratio is the argument.

Every module is built the same way. You meet a problem somebody at Northgate actually has, you learn the mechanism properly rather than the click path, and then at the point where the real decision sits you are asked to commit to an answer before you are told one. Those decisions have costs, and the course reads you the cost of the option you took rather than the one it wanted you to take. Some of them have no right answer at all, which is honest, because neither do the originals.

What you need, and who this is for

You need familiarity with Microsoft 365 as an administrator or a heavy user, and enough comfort to read a PowerShell cmdlet without running it. No prior Purview, no KQL, no compliance background. Everything is taught at first use.

There is no lab to build and no image to download. The course is completable without a tenant. If you want to build every control as you learn it, a Microsoft 365 E5 trial or a developer tenant is enough, and the course states plainly which controls need E5 and which are reachable on E3, because that boundary is a real constraint rather than a footnote.

This is for the security engineer or M365 administrator who has Purview in the tenant and a gap between what it could do and what it does. It is for the SOC analyst who keeps receiving DLP alerts nobody can act on. It is for the consultant who has to walk into somebody else's tenant and form a view in a week. And it is for compliance and privacy staff who need to know what the technical controls actually do rather than what the datasheet says, because you will be the one in the room when the auditor asks.

Do I already know this material?

Six scenarios spanning the full range of the course, from the classifier that decides everything to the AI surface that indexes whatever you did not classify. Answer them to find out where you sit, and whether this course teaches you the job or sharpens a job you already do.

Your credit card classifier returns 4,318 matches across the tenant. Leadership wants to know if you have a card data problem. What does that number tell you?

You have a serious card data problem and should escalate immediately.
Nothing, because built-in classifiers are unreliable and should be replaced with custom ones.
Almost nothing on its own. It is a count rather than a rate, and until you know the confidence distribution, the locations, and how many are sixteen-digit strings that pass a checksum by accident, the number is not evidence of anything.
A count without a denominator is not a measurement. The distribution across locations and confidence levels is the finding; the total is the headline. M2 takes this apart in full and M2.9 gets you the rate.
That the classifier is broken and should be switched off until it can be fixed.

A DLP rule set to low confidence is producing noise. Somebody suggests raising it to high. What are they actually choosing?

To catch strong and weak matches separately so each can be routed differently.
To discard every medium and low match in the tenant, including any real sensitive data that happened to arrive without supporting context. Confidence is a threshold that is inclusive upward, not a band you select.
Low means everything at 65 and above; high means discard everything below 85, whatever it was. You trade a visible false-positive problem for an invisible false-negative one, and nothing will ever tell you what you gave up. M2.1.
To make the classifier more accurate at identifying real card numbers.
To reduce scanning load, since fewer items are evaluated.

You need to detect when a real client contract reference leaves the organization, not merely a string shaped like one. What actually answers that, and what does it cost?

Exact Data Match: a pattern SIT finds the candidate string, EDM hashes it and checks it against an uploaded table of your real references. The cost is a pipeline that has to keep running, because the table describes your organization on the day you uploaded it.
EDM answers a question about fact rather than format, which is the question an auditor is actually asking. The price is a hashing and upload pipeline whose failure mode is staleness rather than an outage, and staleness does not announce itself. M2.4 and M2.5.
A tighter regular expression on the reference format.
A trainable classifier trained on your contracts.
A document fingerprint of the contract template.

Your DLP policy is ready and it will block. What is the only safe way to turn it on?

Enable it out of hours so any disruption lands overnight.
Enable it for a pilot group, then expand once they stop complaining.
Enable it in audit mode and review the alerts for a week.
Simulation first, then audit, then block, in that order, because simulation is the only mode that shows you what the policy would have done to the whole estate without doing it to anybody.
A pilot group tells you about the pilot group. Simulation tells you the blast radius before any user is affected, which is the only honest input to the decision to enforce. M6.

Your insider risk policy is generating four hundred alerts a week and the team has stopped reading them. What is the most likely cause?

The thresholds are too low and should be raised until the volume is manageable.
The policy is scoped to behaviour rather than to risk. Volume anomalies without context are activity, and activity is not a signal, so the queue fills with people doing their jobs unusually rather than people acting against the organization.
Raising thresholds quiets the queue and teaches you nothing, because the tuning is happening against the error you can see. Indicators need context, sequence and a triggering event before they mean anything. M9.
Insider risk always produces this volume and the team should triage in shifts.
The connectors are misconfigured and duplicating events.

Leadership wants Copilot enabled next month. From a data security position, what is the actual risk?

That Copilot will send company data to a public model for training.
That prompts and responses are unlogged and therefore uninvestigable.
That Copilot respects the permissions you already have, and surfaces the oversharing that was survivable only while finding things was hard. It is a discovery engine pointed at whatever you never classified or labelled.
The failure is not a new leak path. It is the existing one becoming efficient. Everything the assistant can reach, somebody could always reach; the difference is that now they can ask. M11, and it is why M2 through M8 come first.
That there is no way to control which files Copilot indexes.
This course is for you.
These are the decisions the job actually turns on, and they are the ones that separate a tenant with Purview licensed from a tenant with data security working. The course starts where you are: no prior Purview, no KQL, no compliance background, everything taught at first use. Start at Module 1.
Start Microsoft 365 Data Security Engineering
You have the fundamentals. The value here is what nobody measures.
You read the classifier questions correctly, which puts you ahead of most tenants. The harder half of this course is the part that gets skipped: getting a false-positive rate out of real content, resolving DLP precedence before it resolves itself, running insider risk without drowning, and being able to say what your programme does not cover. Start at Module 2.
Start Microsoft 365 Data Security Engineering
You clearly do this work.
You handled the classifier trade, the fact-versus-format question, safe rollout, insider risk scoping, and the honest read on Copilot. That is the senior end of the discipline. Take the course for the parts that move: DSPM for AI, the endpoint channels, and the measurement discipline that turns a working programme into one you can defend to an auditor. Skim Phase 1, start at Module 3.
Start Microsoft 365 Data Security Engineering

Start here

You are a student of this course now, so start by deciding what you want out of it. Are you here to stand up data security in a tenant that has none, to fix a deployment somebody else abandoned, or to be the person who can tell leadership what the programme actually covers?

Name that outcome, because it changes how you read what follows. Then be honest about the second thing: which data in your own organization would genuinely hurt to lose, and who decides that. If the answer is that nobody has ever written it down, you are in the normal case, and Module 1 is where that stops being somebody else's problem.

The rest of Module 0 sets you up to do exactly that, and it is free. Work through it to see what the job is when it is somebody's actual job, where the controls live in a product that has been renamed three times, how this course is built and what it expects of you, what the work looks like when it arrives as a real request, and what Purview genuinely cannot do. Then begin Module 1.

© 2026 Ridgeline Cyber Defence™ Ltd. Content may not be reproduced or redistributed. Worked artifacts may be adapted for use within your organization.
Next →