Microsoft SC-401 Course Notes

SC-401 information protection starts with accurate classification, then uses sensitivity labels and encryption to enforce protection. Know when to use pattern-based SITs, custom SITs, document fingerprints, EDM, and trainable classifiers. Know that OCR extends classification into supported image content. Sensitivity labels can classify and protect files, emails, meetings, and containers, but labels must be published before users can apply them. The exam also expects legacy/on-premises protection skills: the Purview Information Protection client, the information protection scanner for file shares, and Microsoft Purview Message Encryption.

• Treating sensitivity labels and sensitive information types as interchangeable.

• Classifier decision: pattern = SIT; known values = EDM; known template = fingerprint; contextual meaning = trainable classifier.

DLP prevents inappropriate handling or egress of sensitive information by evaluating content and activity against rules. Know policy design, location scope, precedence, Adaptive Protection, policy tips/overrides, and Defender for Cloud Apps integration. Endpoint DLP extends DLP to onboarded devices and can control actions such as copying, printing, uploads, removable media, and network shares. JIT protection can temporarily block certain egress activities while a stale or unevaluated file is classified. Retention is separate from DLP: retention policies broadly target locations, while retention labels provide item-level retention/disposition behavior and can be published or auto-applied.

• Treating DLP policy order as a universal first-match-wins mechanism.

• DLP logic: Where -> What/Who -> Condition -> Action -> Exception/Override -> Alert -> Deploy.

The third SC-401 domain is operational: detect risky behavior, investigate activity, respond to alerts, and protect data used by AI. Insider Risk Management correlates user activity and indicators through policy templates, alerts, cases, and workflows, and can feed Adaptive Protection. Audit answers 'who did what and when'; Activity Explorer answers 'what happened to sensitive/labeled content'; DLP/Insider Risk/Defender alerts drive response; eDiscovery searches content for investigation. The July 2026 blueprint explicitly tests data protection for AI services and DSPM for AI.

• Treating Insider Risk indicators as the same thing as policies.

• Insider Risk flow: Signals/Indicators -> Policy -> Alert -> Triage -> Case -> Response.