Microsoft 365 Data Security Engineering

What this course teaches: how to build data security in a Purview tenant that has the license and none of the configuration. Classify what the business holds, label it so every control downstream can act, close the channels data leaves through, keep what must be kept, watch the people who already have access, and prove any of it worked. Start here.

Why data security is a different job: data has three states and a control that works in one does nothing in the others. Purview as a control plane over data at rest, in use and in motion. The E3 and E5 boundary stated once, properly. And least privilege for a data security team.

Classification is the datum every other Purview control resolves to. Ten sections on sensitive information types, the confidence model, custom SITs, document fingerprinting, Exact Data Match, trainable classifiers, OCR, and the explorers that measure whether any of it worked. Build a classifier, measure its false-positive rate against real content, and tune it on evidence rather than instinct.

The label is the only control that leaves your tenant. Taxonomy first, because the fourteen-label failure is organizational rather than technical, then the mechanics: scope, marking, encryption, publishing, and precedence.

Client-side against service-side and why the difference is operational. Simulation as the mandatory first step. Container labels, and the container-item distinction most deployments blur.

Where the label stops traveling. The Purview Information Protection client and the scanner against on-premises file shares. Message Encryption and Advanced Message Encryption for mail that leaves your control.

Design a DLP policy from a requirement, not a template. Locations, conditions, actions, overrides. Rule and policy precedence with a worked collision. Simulation to audit to block, and why that order is the only safe one.

Endpoint DLP as a discipline. The device as a different surface, onboarding as the gate, browser and file-type reality, the six egress channels, advanced device rules, the exclusion model, and just-in-time protection.

Retention as a two-sided obligation: keep content as long as it must be kept, and dispose of it deliberately when the obligation ends. Labels against policies, adaptive scopes, precedence taught with a worked conflict, recovery, disposition review, and the records-management boundary.

Watching the people who handle your data, powerfully and lawfully. The triggering-event gate, the role groups and separation of duties, the privacy model, the HR connector, signal sources and the endpoint, thresholds, forensic evidence, Adaptive Protection, and the path from alert to a preserved, escalated case.

The data-security engineer as investigator. Purview Audit Standard against Premium and the audit-log retention gap that ends investigations, searching the audit log, Activity Explorer as the label and DLP trail, responding to DLP alerts in Purview and in Defender XDR, Cloud Apps file-policy alerts, Content Search for what was in it, and correlating the Purview finding against endpoint and cloud telemetry.

Securing data for AI in Microsoft Purview. Why a copilot turns survivable oversharing into exposure, DSPM for AI as the front door, its prerequisites and roles, data risk assessments, sensitivity labels and DLP for Microsoft 365 Copilot, the oversharing controls in SharePoint, third-party AI and endpoint controls, prompt and response governance, and assembling a Copilot readiness baseline.

Step-by-step configuration guides for every control in the data-security program. Follow each guide in your own tenant to build classification, sensitivity labels and auto-labeling, DLP and endpoint DLP, retention, insider risk with Adaptive Protection, and the AI-readiness controls, with the portal paths, the PowerShell, the verification, and the pitfalls.

Where each control lives, what its setting actually decides, and what it leaves uncovered, one sheet per domain.

Ordered procedures for the data security work that recurs: standing up classification, rolling out labels, deploying DLP without stopping the business.

Building a tenant with content messy enough to behave like a real estate, where you can watch a control cover nothing.

Data security work reasoned end to end, including the cases where the control was already there and the ones that end in doing nothing.

What to do when something fires or somebody asks: a DLP alert, a suspected leak, a subject access request, a regulator, a control that broke the business.

Every practice surface available for this course, what each one gives you, and where the gaps are.

Microsoft Purview documentation, Microsoft security documentation, sensitive information type and EDM references, DLP and endpoint guidance, retention and records, insider risk, DSPM for AI, and the frameworks and standards used throughout the course.

Microsoft 365 Data Security Engineering end-of-course exam: a simulation-based assessment testing whether you can scope a data security incident, establish what a label and a policy actually did, and respond without breaking the business process that produced the data.