SC-401 key terms

A tag applied to files, emails, SharePoint sites, Teams meetings, and other items that classifies the content and can enforce protection such as encryption, content markings, and access restrictions.

The publishing policy that makes sensitivity labels available to chosen users and locations, and sets options such as a default label, mandatory labeling, and a help link.

The order of sensitivity labels in the published list. When several labels could apply to the same item, the label higher in the order wins.

A child label nested under a parent label to create a group, such as Confidential then Legal. A parent label that has sublabels cannot itself be applied to content.

Headers, footers, or watermarks that a sensitivity label adds to documents and emails so the classification is visible to anyone who opens them.

Protection applied through a label that uses Azure Rights Management to assign usage rights, set content expiry, control offline access, and restrict who can open the item.

A service-side rule that scans content at rest in Exchange, SharePoint, and OneDrive for sensitive information or classifiers and applies a label without any user action.

The sensitivity label pre-selected for new items in a label policy. When labeling is mandatory, users must keep or replace it before saving or sending.

A pattern definition that detects a category of data, such as credit card numbers, using elements like regular expressions, keywords, checksums, and a confidence level.

A sensitive information type built from a hashed table of exact values, such as employee records, so detection matches real entries instead of generic patterns.

A method that turns a template document into a sensitive information type by learning its text patterns, so similar documents can be detected.

A machine learning model trained on samples of content to recognize a category, such as resumes or contracts, without relying on fixed patterns.

A setting on a sensitive information type or rule that defines how strong a match must be, usually low, medium, or high, before it counts as detected.

A protection option that encrypts content with two keys, one stored in Azure and one held by the organization on-premises, so Microsoft cannot decrypt the data alone.

A set of rules that finds sensitive content across Exchange, SharePoint, OneDrive, Teams, endpoints, and cloud apps, then blocks, restricts, or audits it.

The part of a DLP policy that defines conditions, exceptions, actions, and user notifications, and is evaluated when content is created, shared, or uploaded.

An on-screen notification shown to a user when content matches a DLP rule, often allowing an override when the user supplies a business justification.

A DLP or auto-labeling setting that shows what would match and what the policy would do, without enforcing actions or blocking users.

DLP that runs on onboarded Windows and macOS devices to watch activities such as copying to USB, printing, and uploading sensitive items to cloud services.

A tag applied to individual items to keep or delete them for a set period, optionally declaring the item a record, triggered manually, automatically, or by default.

A container-level rule applied to whole mailboxes, SharePoint sites, or OneDrive accounts that keeps or deletes content without requiring users to classify each item.

The length of time content is kept before deletion, counted from a start point such as when the item was created, modified, labeled, or an event occurred.

An approval step at the end of retention where reviewers confirm deletion of items or extend retention before they are permanently removed.

A retention label that declares an item a record, restricting edits and deletion and often logging changes for compliance.

A retention configuration where the retention clock starts only when a defined event happens, such as a contract expiring or an employee leaving.

A structured set of descriptors, such as department, retention period, and record type, used to organize retention labels in records management.

A setting that raises or lowers DLP and insider risk controls for a user dynamically based on that user's current insider risk level.

A policy that combines signals such as file downloads, HR events, and unusual access to detect risky user behavior within configured privacy boundaries.

A specific user activity, such as downloading many files or sending email to a personal address, that an insider risk policy can detect and score.

An item generated when user activity meets a policy threshold, queued for triage where it can be confirmed, dismissed, or escalated to a case.

A container in insider risk management that groups alerts for one investigation and holds notes, evidence, and actions such as notifying the user or HR.

A view that lists items containing sensitive information types or sensitivity labels across Exchange, SharePoint, and OneDrive, with details about each match.

A view of label, DLP, and retention events over time, showing who did what to which item, used to verify that policies are working.

The Purview record of user and administrator activity, searchable by date, user, and operation, with premium retention available for long-term investigations.

The process of identifying, preserving, and exporting content for legal or investigative matters using cases, searches, custodians, holds, and review sets.

A policy that reviews Teams, Exchange, and other messages for inappropriate or risky content using classifiers and keywords, with reviewers handling the flagged items.

A dashboard that shows where AI apps and agents are used and where sensitive data appears in prompts and responses, with recommendations to reduce exposure.

A rule in Purview that triggers an alert when specified activities occur, such as mass file downloads or eDiscovery searches, and can notify admins by email.