MS-102 Course Notes

Respond to Defender XDR incidents by reviewing the incident graph and correlated evidence. Manage email protection with Defender for Office 365 using preset policies or custom configurations. Implement endpoint protection by onboarding devices through supported management platforms. Manage Microsoft 365 activity with Defender for Cloud Apps.

• Assuming a single alert is the entire incident – consider correlations.

• Prioritize based on the incident graph's severity.

Implement Microsoft 365 using a custom domain. Domain verification is mandatory. Accurate DNS records are essential for service routing. Manage Microsoft 365 groups for access control and collaboration. Dynamic membership adapts to attribute changes. Manage PIM roles and activation settings for secure access.

• Incorrect DNS record types will prevent verification.

• Focus on the verification process and DNS configuration steps.

Implement Entra Connect for on-premises directory synchronization to Microsoft Entra ID. Manage authentication methods in Entra using policies and strengths. Conditional Access uses identity and conditions to control access. Report-only mode is for testing policy impact.

• Assuming all sign-in options are equally suitable without considering dependencies.

• Focus on scope and anchor configuration – these are critical.

Implement sensitivity labels within Purview to classify and protect data. Implement Microsoft Purview DLP policies to protect sensitive data. Define policy scope (administrative units, locations).

• Confusing label creation with policy configuration.

• Focus on the core components: label scope, protection actions, and policy configuration.