SC-401 · Learning Path 1 · Implement Microsoft Purview Information Protection · 9 modules
Learning Path 1, exam recap
This page is not a re-teach. It holds only what the exam tests.
Each module tab has four parts: the one idea, "if the stem says, answer with", the look-alikes, and the traps.
Then take the mixed quiz. It has 51 items. Your 9 misses from M03 are inside it again.
Full lessons with tenant screenshots: m04 to m09 .kevinleonjouvin.com. This page links to none of the claude.ai pages.
The whole path in one chain
Find it. Tag it. Lock it. Watch it.
| Step | Tool | Module |
|---|---|---|
| 1. Find sensitive data | Sensitive information types (SIT), exact data match (EDM), fingerprints, trainable classifiers | M02, M04 |
| 2. See what you found | Reports, Data explorer, Activity explorer | M03 |
| 3. Tag and lock files and mail | Sensitivity labels, label policies, auto-labeling | M05 |
| 4. Tag the rest | Labels on teams, sites, meetings, Copilot, Power BI | M06 |
| 5. Reach your own servers | Information protection scanner, DLP on-premises | M07 |
| 6. Know what Microsoft already locks | BitLocker, service encryption, Customer Key, TLS | M08 |
| 7. Lock one email to anyone | Message Encryption, Advanced Message Encryption | M09 |
The exam asks one question again and again: which link in the chain does this job?
YOUR WEAK SPOTM03 Unit 3: the 7 ideas behind your 9 misses
You scored 4 of 11 on Activity explorer. Read these once. They come back in the quiz.
| You thought | The rule |
|---|---|
| Each solution in a series sounds useful, so Yes. | Judge each solution alone. It must meet every part of the goal. Most series have one Yes. |
| Devices are in Defender for Endpoint, so start onboarding. | They are already onboarded. The first step is the Purview "device monitoring" switch. |
| Activity explorer shows label changes from 50 days ago. | Activity explorer keeps 30 days. Older events: Audit search (180 days in Audit Standard). |
| Exchange retention-label actions are in Activity explorer. | Activity explorer does not track retention for Exchange. Use Audit search. |
| A colleague sees events I don't, so fix collection. | Collection works. It is a permission gap on your account. |
| Information Protection Readers alone opens Activity explorer. | Readers needs Admins with it. Information Protection Analysts is the narrow fix. |
| Investigators is the second key for content explorer. | Readers opens the tab. Content Explorer List Viewer lists the items. Investigators is too broad. |
EXAMTop 20 lines for the whole path
| If the stem says | Answer with |
|---|---|
| "pattern-based", fixed format (CUST-1234-5678) | Custom SIT with a regular expression |
| only the real values in our HR or CRM table | EDM SIT |
| a standard form or template | Document fingerprinting |
| no pattern: CVs, contracts, source code | Trainable classifier |
| how much, trend, adoption | Reports |
| which files have label X now, and where | Data explorer (Content explorer in older items) |
| who changed or removed the label, last 30 days | Activity explorer |
| same, but older than 30 days | Audit search |
| encrypt, watermark, header | Inside the label |
| who sees labels, default label, mandatory, justification | Label publishing policy |
| label files nobody opens, PDFs, simulation | Auto-labeling policy (service-side) |
| recommend a label while the user types | Auto-labeling setting inside the label (client-side) |
| team private, no guests, unmanaged devices | Label with Groups & sites scope |
| Groups & sites is greyed out | EnableMIPLabels = True, then Execute-AzureADLabelSync |
| Copilot cannot summarize an encrypted file | The user lacks the EXTRACT right |
| label files on an on-premises share or SharePoint Server | Information protection scanner |
| own, rotate or revoke the root key | Customer Key |
| Microsoft must never decrypt | Double Key Encryption (DKE) |
| encrypt mail to Gmail, no software needed | Message Encryption |
| must not forward, print or copy | Do Not Forward (not Encrypt-Only) |
How Microsoft words it
| Wording | What it means |
|---|---|
| "Each correct answer presents part of the solution" | The keys work together. You need all of them. |
| "Each correct answer presents a complete solution" | Each key works alone. |
| "Least privilege" | The narrowest built-in role that fully works. |
| "Minimize administrative effort" | The built-in or automatic option wins. |
| "Solution: … Does this meet the goal?" | Judge this solution alone. Ignore the others in the series. |
| "In sequence" | Prerequisites first. |
M01 Protect sensitive data in a digital world · M02 Classify data for protection and governance
Pick the classifier from what the data looks like
Structured data → SIT. Unstructured data → trainable classifier.
M01 is the map of all Purview tools. M02 teaches the two ways to recognize content.
EXAMWhich control does the job?
| Need | Control | Not this |
|---|---|---|
| Protection that travels with the file | Sensitivity label | DLP. It acts at the moment of an action and does not travel. |
| Stop or warn when a user shares, emails, copies, pastes into AI | DLP policy | A label alone |
| Patterns of risky behavior over time (mass download before leaving) | Insider Risk Management | Audit. Audit records; it does not score. |
| Raw record of every user and admin action | Audit | Activity explorer (30 days, labels and DLP only) |
EXAMSIT or trainable classifier? They overlap, but they are not interchangeable.
| SIT | Trainable classifier | |
|---|---|---|
| Recognizes | A pattern or a word list | A kind of document, by meaning |
| Pick it when the stem says | "format", "number", "ID", "pattern-based" | "no consistent keywords", "résumés", "source code", "contracts" |
| Communication Compliance | Yes | Microsoft pretrained classifiers only. Custom ones are not supported. |
| Encrypted items | Not the deciding fact on the exam | Not classified. "Classifiers only work with items that aren't encrypted." |
EXAMCustom trainable classifier: the numbers
50–500positive samples
150–1,500negative samples
1 hwait after you create a new seed site or folder
24 hto process the seeds
Englishonly language for custom classifiers
65/75/85SIT confidence: low / medium / high
Traps
- TRAP"Retrain the published classifier." Not supported. Delete it and start over with larger sample sets.
- TRAPSeed content in OneDrive or a Teams folder. It must be a dedicated SharePoint site folder.
- TRAPDLP scanning old mail in mailboxes. Exchange DLP checks new mail only.
- TRAP"Copy the named entity SIT." Named entity SITs cannot be edited or copied.
- TRAPZero Trust has three principles: verify explicitly, use least privilege, assume breach. "Trust the internal network" is the old model.
M03 Review and analyze data classification and protection
Three windows, three questions
Reports count. Data explorer lists. Activity explorer tells the story.
EXAMThe three tools side by side. Not interchangeable.
| Reports | Data explorer | Activity explorer | |
|---|---|---|---|
| Question | How much? | What, and where? | Who did what, when? |
| Data | Summaries | Current snapshot of classified items | Events from the unified audit log |
| Time | 30-day rolling window | Now. Counts lag up to 7 days (14 for SharePoint) | Last 30 days. 60–90 min delay |
| Needs auditing on? | Yes | No | Yes |
| Narrowest viewer | Information Protection Readers | Tab role group + List viewer (+ Content viewer to open items) | Information Protection Analysts |
| Older than 30 days? | Gone unless saved as PDF | Not about time | Audit search (180 days Standard) |
EXAMWho opens what
| Need | Give |
|---|---|
| Read reports only, change nothing | Information Protection Readers. In older DLP-report items with Microsoft 365 roles only: Security Reader. |
| Open Activity explorer, no policy rights | Information Protection Analysts. Readers works only together with Admins. |
| See the list of items in Data explorer, not the content | A role group that opens the tab + List viewer |
| Open the item content | Content viewer. It does not include List viewer. Give both if both are needed. |
Source checked today: Activity explorer accepts "Information Protection Admins & Information Protection Readers (both role groups needs to be assigned)". Information Protection Analyst: "Access and manage DLP alerts and activity explorer. View-only access to DLP policies."
EXAMWhen does a DLP rule create a DLP match in Activity explorer?
| Policy | DLP match and alert? |
|---|---|
| One rule that only allows, no audit | No |
| Rule 1 allows, Rule 2 audits | Yes, for Rule 2 |
| An audit log retention policy | No. It only keeps records longer. |
| Defender for Cloud Apps file policies | No. Not a DLP source for Activity explorer. |
This table is the whole SC401-110 series. One Yes, two No.
Traps
- TRAPGlobal Administrator opens Data explorer but sees no items. The tab key does not open the item lock.
- TRAPActivity done 10 minutes ago is missing. Wait 60–90 minutes.
- TRAPNo rows at all, ever. Auditing is off. Turn on the unified audit log.
- TRAPEndpoint activity missing for devices already in Defender for Endpoint. Turn on device monitoring first.
M04 Create and manage sensitive information types
Pick the detector
Pattern → SIT. Table of values → EDM. One form → fingerprint. No pattern → trainable classifier.
EXAMThe data looks like… use
| The data looks like | Use |
|---|---|
| A public format: card number, IBAN, passport | Built-in SIT. You cannot edit it. You can copy it. |
| Your own format: EMP-482913 | Custom SIT with a regular expression |
| Real values in a database, changing daily | EDM SIT |
| One standard form that people fill in | Document fingerprint |
| Names, street addresses, medical terms | Named entity SIT. No edit, no copy. |
| Passwords, API keys, connection strings | Credential SIT |
| Thousands of words that change often | Keyword dictionary |
EXAMKeyword list or keyword dictionary? They overlap, but they are not interchangeable.
| Keyword list | Keyword dictionary | |
|---|---|---|
| Lives | Inside one SIT | On its own, shared by many SITs |
| Size | Up to 2,048 terms | Large. 1 MB compressed for all dictionaries in the tenant |
| Pick it when the stem says | "a few terms" in one SIT | "thousands of terms", "update often", PowerShell New-DlpKeywordDictionary |
EXAMEDM in five facts
- Refresh up to 5 times in 24 hours, by re-hashing and re-uploading. Checked today on "Refresh your EDM source table".
- Up to 100 million rows. Up to 10 searchable fields per schema.
- Upload rights come from the EDM_DataUploaders security group. Compliance Administrator alone cannot upload.
- "Clear text must never touch an internet-connected computer" = two-computer method: /CreateHash on the secure one, /UploadHash on the other.
- EDM fits structured data. Source code is not a table: EDM does not fit.
Numbers
500custom SITs in the portal
1,024characters per regex
30–90%fingerprint partial match
4 MBmax scanned file for fingerprints
Traps
- TRAP"Works on new SharePoint files, not old ones." The old content must be recrawled.
- TRAP"Test is greyed out." Licence, not role: add an Exchange Online licence.
- TRAPA filled form is missed with Exact match. Use Partial matching.
- TRAPFingerprint template saved as .dotx. Save it as .docx.
- TRAPNamed entity works in email, not on devices. Turn on Advanced classification scanning and protection.
- FIXSC401-003 vendor says "wait five hours". That is vendor maths. Microsoft says up to 5 refreshes in 24 hours. Pick the option that re-hashes and re-uploads.
M05 Protect sensitive data with sensitivity labels
Three objects. Most traps mix them up.
The label protects. The policy hands it out. The auto-labeling policy applies it without users.
EXAMWhere does the setting live?
| If the stem says | It lives in |
|---|---|
| Encrypt, watermark, header, scope, sublabel | The label |
| Who sees labels, default label, mandatory, justification, help link | The label publishing policy |
| Recommend while the user types | Client-side auto-labeling inside the label |
| Files at rest, mail in transit, simulation, PDFs | Auto-labeling policy |
EXAMClient-side or service-side auto-labeling? Not interchangeable.
| Client-side (in the label) | Service-side (policy) | |
|---|---|---|
| Runs in | Word, Excel, PowerPoint, Outlook, while a user edits | SharePoint, OneDrive (at rest), Exchange (in transit) |
| Needs a user to open the file | Yes | No |
| Recommend, user can override | Yes | No |
| Simulation | No | Yes, required once. About 12 hours. |
| No | Yes, once PDF support is on | |
| Markings on files | Yes | No. Headers and watermarks are not applied by the policy. |
Ceiling: 500,000 auto-labeled SharePoint and OneDrive files per tenant per day. Checked today. The training text says 1 million; learn 500,000.
EXAMEncryption: who decides the permissions?
| Assign permissions now | Let users assign permissions | |
|---|---|---|
| Who decides | The admin, in the label | The user, when applying it |
| Expiry, offline access | Yes | No |
| Usable by SharePoint/OneDrive auto-labeling | Yes, if expiry is Never | No |
| Example | "Partners": fabrikam.com can view | Do Not Forward on an email |
Traps
- TRAPUsers cannot see the new label. It is not in a policy yet, or 24 hours have not passed.
- TRAPChanging between two sublabels of the same parent asks for no justification.
- TRAP"All users and groups in your organization" leaves out guests.
- TRAPPrerequisite for label encryption or Message Encryption: Azure Rights Management active.
- TRAPLabels: the highest order number (bottom of the list) is the most sensitive and wins.
- TRAPDefender for Cloud Apps Apply label stops at 100 actions per app, per tenant, per day.
M06 Apply and manage sensitivity labels
A label protects the thing it sits on. Nothing else.
A site label protects the site, not its files. A meeting label protects the meeting, not the recording.
EXAMContainer labels: switch them on in this order
Enable labels for files in SharePoint and OneDriveUseful. Not strictly a container prerequisite.
Set EnableMIPLabels = TrueIn the Group.Unified directory setting, with Microsoft Graph PowerShell.
Run Execute-AzureADLabelSyncIn Security & Compliance PowerShell. Syncs labels to Microsoft Entra ID.
Create or edit the label with Groups & sites scope, publish itUsers then pick it when they create a team or site.
EXAMLook-alike pairs. Each pair overlaps, but is not interchangeable.
| Stem says | Pick | Not |
|---|---|---|
| "Owners must not add guests" | External user access (cleared) | External sharing setting |
| "Files must not be shared outside" | External sharing from labeled sites | External user access |
| "Browser only on personal devices" | Unmanaged devices: limited, web-only | Authentication context |
| "MFA for this site only" | Authentication context | Unmanaged devices |
| "Every new file in this library must be Confidential" | Library default label (Files scope) | Site label (Groups & sites scope) |
| "Users must not copy content" | Label encryption without EXTRACT | DLP for Copilot |
| "Copilot must not use files labeled X, users work as normal" | DLP policy, location Microsoft 365 Copilot and Copilot Chat | Removing EXTRACT |
EXAMCopilot and Power BI in four lines
- Copilot needs VIEW + EXTRACT to summarize an encrypted file. With VIEW only, it gives a link.
- A Copilot draft inherits the highest-priority source label.
- Power BI encryption applies only on export (Excel, PDF, PowerPoint). Inside Power BI, Power BI permissions decide.
- Power BI does not support container labels. Label semantic models first; reports built on them follow.
Traps
- TRAPThe label cannot be weaker than the tenant setting. Tenant = web-only, label = full access: web-only wins.
- TRAPConfidential file in a General site is not blocked. SharePoint sends an "incompatible label" email and logs it.
- TRAPExchange admin center cannot apply container labels.
- TRAPLibrary default label: new and edited files only. Old files stay as they are (exam view).
M07 Protect on-premises data
The scanner is a robot that walks your file servers
It crawls on a schedule. It is never real time. On-premises DLP runs on the scanner.
EXAMWhich tool for which place? Not interchangeable.
| Files are | Pick |
|---|---|
| On SMB/NFS shares or SharePoint Server | Information protection scanner |
| In SharePoint Online, OneDrive, Exchange Online | Auto-labeling policy |
| On a device while a user copies, prints, uploads | Endpoint DLP |
| Exchange Server, SharePoint Server, FCI: protect only, no classification | RMS connector |
| In non-Microsoft cloud apps | Defender for Cloud Apps |
EXAMInstall order (build-list items)
Portal: create the scanner clusterThe installer needs its name.
Portal: create the content scan job, add repositories
Server: Install-Scanner -SqlServerInstance … -Cluster …Creates the service and the SQL database.
Entra app registration + Set-AuthenticationToken for unattended runs. -OnBehalfOf if the account cannot log on locally.
Scan in discovery, then Schedule = Always, Enforce = On
EXAMSymptom → fix
| Symptom | Fix |
|---|---|
| Scanner runs, no labels appear | Enforce = On, then Rescan all files |
| New settings, old files unchanged | Rescan all files / Start-Scan -Reset |
| Start-Scan does nothing | Schedule is Always. Start-Scan is for Manual jobs. |
| Files it cannot inspect stay unlabeled | Set a default label |
| .zip content not inspected | Install the Microsoft Office IFilter |
| Cannot open encrypted files | Make the scanner account a super user |
| DLP matches, but permissions unchanged | The DLP policy is still in simulation |
Numbers and traps
4 / 8 / 10cores / GB RAM / GB free disk
90 daystoken without an app (or until the password expires)
- TRAPServer Core and Nano Server are never supported. Windows 10/11 only for testing.
- TRAP"Enable DLP policy rules" without a DLP policy makes the scanner throw errors.
- TRAPNo policy tips on-premises. Users never see a pop-up.
- FIXSC401-032: vendor key is wrong. Unattended labeling needs a Windows account, a Microsoft Entra account and a Microsoft Entra access token.
M08 Learn how Microsoft 365 data is encrypted
Your data is always encrypted. The only choice is who holds the top key.
On the exam, this module mostly shows up as wrong options: "Implement BitLocker", "Use Customer Key".
EXAMFour layers
| Layer | Who turns it on | Follows the file out of Microsoft 365? |
|---|---|---|
| BitLocker (disk) | Microsoft. Always on. | No |
| Service encryption | Microsoft. Always on. Top key: Microsoft or Customer Key. | No |
| Item encryption (label, Message Encryption, DKE) | You, per label or rule | Yes |
| TLS (on the move) | Microsoft. TLS 1.2 or higher. | Only while moving |
If the stem says "after the file leaves", "shared outside" or "downloaded", the answer is never BitLocker or Customer Key.
EXAMFive look-alikes, one question each
| Feature | The one question it answers |
|---|---|
| Customer Key | Who owns the root key for data at rest in Microsoft datacenters? |
| Double Key Encryption | How do I make a file Microsoft can never decrypt? (Search, eDiscovery, Copilot stop working on it.) |
| Bring Your Own Key (BYOK) | Who owns the root key behind labels and Message Encryption? |
| Customer Lockbox | Who approves a Microsoft engineer looking at my content? (Global Administrator or Customer Lockbox access approver) |
| Message Encryption | How do I send an email that stays encrypted at the recipient? |
Numbers and traps
2root keys per data encryption policy, in 2 Azure subscriptions
12 h / 4 hLockbox request expiry / access window
- TRAPTLS protects the pipe, not the message. Once the mail lands, TLS is gone.
- TRAPTeams chat is in the multi-workload policy. Teams files live in SharePoint, so they are in the SharePoint policy.
- TRAPSC401-040: find, unshare and encrypt cloud files = Defender for Cloud Apps file policy. Not BitLocker, not AD RMS.
M09 Deploy Microsoft Purview Message Encryption
Encryption decides who can open. Usage rights decide what they can do.
Message Encryption: anyone, any mailbox. Advanced: control after the mail has left, in the web portal only.
EXAMFour ways to protect email. Not interchangeable.
| Pick this | When the stem says |
|---|---|
| Message Encryption | "external recipients", "any email address", "Gmail", "no special software" |
| Do Not Forward | "must not forward, print or copy". Encrypt-Only allows all three. |
| S/MIME | "digital signature", "certificates", "peer-to-peer" |
| TLS | "between mail servers", "the connection", "partner connector" |
EXAMMail flow rule or DLP policy? Both encrypt mail. Not interchangeable.
| Mail flow rule | DLP policy | |
|---|---|---|
| Condition is about | The message: recipient, domain, sender, subject | Sensitive content, same policy for other locations |
| Where | Exchange admin center › Mail flow › Rules | Purview portal › Data loss prevention |
| Pick it when | "All mail to partner.com, least effort"; branding; removing encryption | "Alerts, policy tips, reports"; content also in SharePoint, Teams, devices |
EXAMTurn on, check, brand, control
| Goal | Answer |
|---|---|
| Only prerequisite | Azure Rights Management active. AD RMS must be migrated first. Checked today on "Set up Message Encryption". |
| Is it on? | Get-IRMConfiguration → AzureRMSLicensingEnabled = True |
| Does it work? | Test-IRMConfiguration -Sender … (-Sender is mandatory) |
| Logo, colour, texts | Set-OMEConfiguration on "OME Configuration" |
| More than one template | New-OMEConfiguration. Needs Advanced Message Encryption (E5). |
| Expire the mail | Custom template, -ExternalMailExpiryInDays 1–730, external readers only |
| Revoke | Link-based readers only (Gmail, Yahoo). Admin: Set-OMEMessageRevocation. |
| Did the partner open it? | Set-IRMConfiguration -EnablePortalTrackingLogs $true, then Audit › Encrypted message portal activities |
Numbers and traps
25 MBmax encrypted message
.doc .xls .pptnot encrypted (old formats)
PDFonly with -EnablePdfEncryption $true
- TRAPA connector routes mail and forces TLS. It does not apply Message Encryption.
- TRAPRevoking mail to a Microsoft 365 or outlook.com reader fails. They got it inline.
- TRAPGet-OMEConfiguration shows branding, not activation. Activation is IRM.
- TRAPBranding only works on mail that is already encrypted. Encrypt rule first, brand rule second.
Every cmdlet in Learning Path 1, on one table
The exam puts these in drop-downs. The wrong options come from the wrong module. Learn which shell each one runs in.
Each line was checked against Microsoft Learn in its module thread (M04 to M09). A separate PowerShell 101 page for the exam is being built in its own thread.
| Goal | Command | Runs in | Mod |
|---|---|---|---|
| Hash the EDM table on a secure PC | EdmUploadAgent.exe /CreateHash | EDM Upload Agent (Command Prompt) | M04 |
| Upload the hash | EdmUploadAgent.exe /UploadHash | EDM Upload Agent | M04 |
| Hash and upload in one step | EdmUploadAgent.exe /UploadData | EDM Upload Agent | M04 |
| Create a keyword dictionary | New-DlpKeywordDictionary -FileData | Security & Compliance PowerShell | M04 |
| Test a SIT against text | Test-DataClassification | Security & Compliance PowerShell | M04 |
| Allow labels on groups | EnableMIPLabels = True via Update-MgBetaDirectorySetting | Microsoft Graph PowerShell | M06 |
| Sync labels to Entra ID | Execute-AzureADLabelSync | Security & Compliance PowerShell | M06 |
| Install the scanner | Install-Scanner -SqlServerInstance -Cluster | Scanner server (PurviewInformationProtection module) | M07 |
| Token for unattended scanner | Set-Authentication -AppId -AppSecret -TenantId -DelegatedUser | Scanner server | M07 |
| Discovery to enforcement | Set-ScannerContentScan -Schedule Always -Enforce On | Scanner server | M07 |
| Rescan every file | Start-Scan -Reset | Scanner server | M07 |
| Is Message Encryption on? | Get-IRMConfiguration (AzureRMSLicensingEnabled) | Exchange Online PowerShell | M09 |
| Test Message Encryption | Test-IRMConfiguration -Sender | Exchange Online PowerShell | M09 |
| Change default branding | Set-OMEConfiguration -Identity "OME Configuration" | Exchange Online PowerShell | M09 |
| New branding template (E5) | New-OMEConfiguration | Exchange Online PowerShell | M09 |
| Revoke an encrypted mail | Set-OMEMessageRevocation -Revoke $true -MessageId | Exchange Online PowerShell | M09 |
| Encrypt PDFs too | Set-IRMConfiguration -EnablePdfEncryption $true | Exchange Online PowerShell | M09 |
Rule for drop-downs: activate, verify, test = IRM cmdlets. Logo, text, expiry = OME cmdlets. Scanner = server, not Exchange.
Mixed quiz: 51 items across the path
Vendor items first, then original items, then a few new ones where the bank is thin. Modules are mixed on purpose.
Click an answer. The key and the explanation open at once. For "select two/three", click each choice.
Your results
Paste the text back in the thread. I grade it, update the ledger and plan the re-tests.
Confidence and caveats
0.85. Every quiz key was checked against Microsoft Learn in its module thread (M01–M09, 3–11 November 2026). On 11 November I re-checked the facts this page leans on most: EDM refresh (5 per 24 hours), Activity explorer (30 days, role groups), auto-labeling ceiling (500,000 per day), trainable classifiers (no retraining, Communication Compliance pretrained only) and Message Encryption prerequisites (Azure Rights Management, AD RMS migration, Test-IRMConfiguration).
- Not higher: M08 topics (BitLocker, Customer Key, TLS) are not named in the SC-401 skills outline. Real exam wording is unknown.
- SC401-032 keeps a CORRECTION: the vendor key disagrees with Microsoft's client PowerShell page.
- SC401-003 is a weak vendor item. Win it by elimination: the only option that re-hashes and re-uploads.
- Your tenant uses label groups and new permission names (Owner, Editor). The exam may say parent labels and Co-Author.
Sources (opened 11 November 2026)
- Refresh your exact data match source table
- Get started with activity explorer
- Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview
- Automatically apply a sensitivity label
- Learn about trainable classifiers · Get started with trainable classifiers
- Set up Message Encryption · Test-IRMConfiguration
- Each quiz item shows its own source link.