Module 1: Explore security metrics in Microsoft 365
In this learning path, you will examine all the common
types of threat vectors and data breaches facing organizations today, and you
will learn how Microsoft 365’s security solutions address these security
threats, including the Zero Trust approach. You will be introduced to the
Microsoft Secure Score, Privileged Identity Management, as well as to Azure
Identity Protection and Microsoft Defender for Office 365.
Lessons
Examine threat vectors and data breaches
Explore the Zero Trust security model
Explore security solutions in Microsoft 365
Examine Microsoft Secure Score
Examine Privileged Identity Management
Examine Azure Identity Protection
Lab: Tenant Setup and Privileged Identity Management
After completing this module, students will be able to:
Describe several techniques hackers use to compromise
user accounts through email
Describe techniques hackers use to gain control over
resources
Describe techniques hackers use to compromise data
Describe the Zero Trust approach to security in Microsoft
365.
Describe the components of Zero Trust security.
Describe five steps to implementing a Zero Trust model in
your organisation.
Explain Zero Trust networking
List the types of threats that can be avoided by using
EOP and Microsoft Defender for Office 365
Describe how Microsoft 365 Threat Intelligence can
benefit your organisation
Monitor your organisation through auditing and alerts
Describe how ASM enhances visibility and control over
your tenant through three core areas
Describe the benefits of Secure Score and what kind of
services can be analysed
Describe how to collect data using the Secure Score API
Know where to identify actions that will increase your
security by mitigating risks
Explain how to determine the threats each action will
mitigate and the impact it has on the use
Explain Privileged Identity Management (PIM) in Azure
administration
Configure PIM for use in your organisation
Audit PIM roles
Explain Microsoft Identity Manager
Explain Privileged Access Management in Microsoft 365
Describe Azure Identity Protection and what kind of
identities can be protected
Understand how to enable Azure Identity Protection
Know how to identify vulnerabilities and risk events
Plan your investigation in protecting cloud-based
identities
Plan how to protect your Azure Active Directory
environment from security breaches
Module 2: Manage your Microsoft 365 security services
This learning path examines how to manage the Microsoft
365 security services, including Exchange Online Protection, Microsoft Defender
for Office 365, Safe Attachments, and Safe Links. You will also be introduced
to the various reports that help an organisation monitor its security health.
Lessons
Examine Exchange Online Protection
Examine Microsoft Defender for Office 365
Manage Safe Attachments
Manage Safe Links
Explore reporting in the Microsoft 365 security services
Lab: Manage Microsoft 365 Security Services
After completing this module, students will be able to:
Describe the anti-malware pipeline as Exchange Online
Protection analyses email
List several mechanisms used to filter spam and malware
Describe additional solutions to protect against phishing
and spoofing
Describe the benefits of the Spoof Intelligence feature
Describe how Safe Attachments is used to block zero-day
malware in email attachments and documents
Describe how Safe Links protect users from malicious URLs
embedded in email and documents
Create and modify a Safe Attachments policy in the
Security & Compliance Center
Create a Safe Attachments policy by using Windows
PowerShell
Configure a Safe Attachments policy to take specific
actions
Understand how a transport rule can be used to disable
the Safe Attachments functionality
Describe the end-user experience when an email attachment
is scanned and found to be malicious
Create and modify a Safe Links policy in the Security
& Compliance Center
Create a Safe Links policy by using Windows PowerShell
Understand how a transport rule can be used to disable
the Safe Links functionality
Describe the end-user experience when Safe Links
identifies a link to a malicious website or file
Describe how the Microsoft 365 security reports show how
your organisation is being protected
Understand where to access reports generated by EOP and
Microsoft Defender for Office 365
Understand how to access detailed information from the
generated reports generated
Module 3: Implement threat intelligence in Microsoft 365
In this learning path, you will transition from security
services to threat intelligence, precisely using the Security Dashboard,
Microsoft Defender for Identity, and Microsoft Cloud Application Security to
stay ahead of potential security breaches.
Lessons
Explore threat intelligence in Microsoft 365
Explore the Security Dashboard
Implement Microsoft Defender for Identity
Implement Microsoft Cloud Application Security
Lab: Implement Threat Intelligence
Conduct a Spear Phishing attack using the Attack
Simulator
Conduct Password attacks using the Attack Simulator
Prepare for Alert Policies
Implement a Mailbox Permission Alert
Implement a SharePoint Permission Alert
Test the Default eDiscovery Alert
After completing this module, students will be able to:
Understand how the Microsoft Intelligent Security Graph
powers threat intelligence
Describe how the threat dashboard can benefit C-level
security officers
Understand how Threat Explorer can be used to investigate
threats and help to protect your tenant
Describe how the Security Dashboard displays top risks,
global trends, and protection quality
Describe what Microsoft Defender for Identity is and what
requirements are needed to deploy it
Configure Microsoft Defender for Identity
Manage the Microsoft Defender for Identity services
Describe Cloud App Security
Explain how to deploy Cloud App Security
Control your Cloud Apps with Policies
Troubleshoot Cloud App Security
Module 4: Introduction to Data Governance in Microsoft
365
This learning path examines the critical components of
Microsoft 365 Compliance management. This begins with an overview of all key
aspects of data governance, including data archiving and retention, Information
Rights Management, Office 365 message encryption, In-place Records Management
in SharePoint, and data loss prevention (DLP).
Lessons
Explore archiving in Microsoft 365
Explore retention in Microsoft 365
Explore Information Rights Management
Explore Office 365 Message Encryption
Explore In-place Records Management in SharePoint
Explore Data Loss Prevention in Microsoft 365
Lab: Implement Data Governance
Configure Microsoft 365 Message Encryption
Validate Information Rights Management
Initialise Compliance
Configure Retention Tags and Policies
After completing this module, students will be able to:
Understand Data Governance in Microsoft 365
Describe the difference between In-Place Archive and
Records Management
Explain how data is archived in Exchange
Recognise the benefits of InPlace Records Management in
SharePoint
Understand how Messaging Records Management works in
Exchange
List the types of retention tags that can be applied to
mailboxes
Know the different Microsoft 365 Encryption Options
Understand how Information Rights Management (IRM) can be
used in Exchange
Configure IRM protection for Exchange mails
Explain how IRM can be used in SharePoint
Apply IRM protection to SharePoint documents
Tell the differences between IRM protection and AIP
classification
Understand how message encryption works
Perform encryption on a message
Accomplish decryption of a message
Understand the co-operation of signing and encryption
simultaneously
Explain what triple-wrapped messages are
Describe when you can use Office 365 Message Encryption
Explain how Office 365 Message Encryption works
Describe Data Loss Prevention (DLP)
Understand what sensitive information and search patterns
are that DLP is using
Know what a DLP policy is and what it contains
Recognise how actions and conditions work together for
DLP
Express how actions contain functions to send emails on
matches
Show policy tips to the users if a DLP rule applies
Use policy templates to implement DLP policies for
commonly used information
Explain document finger
Understand how to use DLP to protect documents in Windows
Server FCI
Module 5: Implement data governance in Microsoft 365
This learning path examines how to implement the key
aspects of data governance, including building information barriers in
Microsoft 365 and ethical walls in Exchange Online, creating DLP policies from
built-in templates, creating custom DLP policies, creating DLP policies to
protect documents, and creating policy tips.
Lessons
Evaluate your compliance readiness
Implement compliance solutions
Create information barriers in Microsoft 365
Create a DLP policy from a built-in template
Create a custom DLP policy
Create a DLP policy to protect documents
Implement policy tips for DLP policies
Lab: Implement DLP Policies
After completing this module, students will be able to:
Describe the Microsoft 365 Compliance Center and how to
access it
Describe the purpose and function of the Compliance score
Explain the components of how an organisation's
Compliance score is determined
Explain how assessments are used to formulate compliance
scores
Explain how Microsoft 365 helps address Global Data
Protection Regulation
Describe insider risk management functionality in
Microsoft 365
Configure insider risk management policies
Configure insider risk management policies
Explain the communication compliance capabilities in
Microsoft 365
Describe what an ethical wall in Exchange is and how it
works
Explain how to create information barriers in Microsoft
365
Identify best practices for building and working with
ethical walls
Understand the different built-in templates for DLP
policies
Determine how to choose the correct locations for a DLP
policy
Configure the correct rules for protecting content
Enable and review the DLP policy correctly
Describe how to modify existing rules of DLP policies
Explain how to add and modify custom conditions and
actions to a DLP rule
Describe how to change user notifications and policy tips
Configure the user override option to a DLP rule
Explain how a DLP rule violation sends incident reports
Describe how to work with managed properties for DLP
policies
Explain how SharePoint Online creates crawled properties
from documents
Describe how to create a managed property from a crawled
property in SharePoint Online
Explain how to create a DLP policy with rules that apply
to managed properties via PowerShell
Describe the user experience when a user creates an email
or site containing sensitive information
Explain the behaviour in Office apps when a user enters sensitive
information
