SC-401 cheat sheet

A sensitivity label can enforce encryption, content marking (header, footer, watermark), and content marking is configurable per label; users only see labels that a label policy publishes to their user or group scope.

Encryption offers two paths: 'Assign permissions now' with a fixed set of usage rights, or 'Let users assign permissions' with custom rights; both support content expiry and offline access days.

Client-side auto-labeling evaluates sensitive information types inside Office apps at create/edit time and can recommend a label or apply it automatically; service-side auto-labeling runs against data at rest in SharePoint, OneDrive, and Exchange and should be run in simulation before enforcement.

A parent label that has sub-labels cannot be applied directly; users select a sub-label, which can carry its own encryption, marking, and auto-labeling settings.

Labels published for sites and groups (container labels) set privacy and external sharing/guest access defaults on Teams teams, SharePoint sites, and Microsoft 365 groups; item-level labeling is separate.

Double Key Encryption protects content with two keys, one held by Microsoft and one by the customer in an on-premises HSM, so Microsoft alone cannot decrypt the data; it requires the DKE service and a published label.

Exact data matching uses a hashed table of exact values for high-confidence detection; document fingerprinting derives a sensitive information type from a template form; trainable classifiers recognize content by example with seeded samples.

Activity explorer records label and DLP activity for up to 30 days; Content explorer shows the current state of which items carry a given label or match a given sensitive information type or classifier.

DLP policy locations: Exchange, SharePoint, OneDrive, Teams chat and channel messages, Devices (endpoint DLP), Defender for Cloud Apps (cloud apps), and the on-premises data gateway scanner.

DLP rules are evaluated in order; each rule combines conditions, exceptions, and actions (audit, block, block with override, encrypt), plus user notification, policy tip, incident report, and alert severity.

Policy tips surface in supported client apps to users in policy scope; notification emails can go to the user and to a configurable recipient list, and alerts can aggregate to reduce noise.

Adaptive Protection adds the insider risk level (minor, moderate, elevated) as a DLP rule condition, so elevated-risk users receive stricter actions from the same policy.

Endpoint DLP requires onboarded devices and can restrict activities including copy to USB, copy to network share, print, clipboard, upload to cloud service, and Remote Desktop sessions.

Retention settings are retain-and-delete, retain-only, or delete-only; the retention start can be creation date, last modified date, when labeled, or a specified event type.

Retention precedence: retention wins over deletion, the longest retention period wins, an explicit label setting beats an implicitly applied policy, and for delete-only settings the shortest period wins.

Auto-apply retention labels use sensitive information types, trainable classifiers, keyword queries, or cloud attachments; manual label application requires the label policy to be published to that location.

Insider Risk Management policies start from a template (data theft by departing users, data leaks, security policy violations, risky browser usage); scope, indicators, and thresholds decide who is scored.

IRM computes minor, moderate, and elevated risk levels from indicator hits and thresholds; those levels can be shared with Adaptive Protection to tighten DLP and access controls.

Anonymization hides user names in IRM alerts and cases; revealing identities requires a role that is not assigned to the anonymous reviewers.

Forensic evidence capture is an optional per-policy setting that records a clip of user activity for a triggering indicator, which investigators review inside the case.

Audit (Standard) retains events 180 days by default; Audit (Premium) adds 10-year retention, high-value events, and intelligent insights, and requires the corresponding add-on licenses.

Audit retention policies define how long audit records are kept by record type or activity, from 180 days up to 10 years, and changes to those policies are themselves audited.

eDiscovery holds preserve Exchange, SharePoint, OneDrive, and Teams content for a case, either for whole locations or query-based, and preserve deleted items until the hold is removed.

Content explorer reports current labeled or sensitive items, Activity explorer reports the last 30 days of activity, and generated alerts are triaged in the Purview portal or surfaced in Defender XDR.