Describe information protection and data lifecycle management in Microsoft Purview Flashcards
Microsoft Purview Information Protection and Data Lifecycle Management
- Information Protection: Microsoft Purview Information Protection helps discover, classify, and protect sensitive and business-critical content throughout its lifecycle in your organization.
- Know Your Data: Purview enables organizations to understand their data landscape and identify important data across on-premises, cloud, and hybrid environments using trainable classifiers, activity explorer, and content explorer.
- Protect Your Data: Organizations can apply flexible protection actions, including encryption, access restrictions, and visual markings, to safeguard their data.
- Prevent Data Loss: Purview helps detect risky behaviour and prevent accidental oversharing of sensitive information through features like data loss prevention policies and endpoint data loss prevention.
- Data Lifecycle Management: Microsoft Purview Data Lifecycle Management allows organizations to manage the content lifecycle, import, store, and classify business-critical data to meet compliance and regulatory requirements.
- Govern Your Data: Purview enables organizations to automatically keep, delete, and store data and records in a compliant manner using capabilities like retention policies, retention labels, and records management.
Microsoft Purview Information Protection and Data Lifecycle Management work together to provide organizations with the tools and capabilities to understand, protect, prevent data loss, and govern their data throughout its lifecycle.
Data Classification in Microsoft Purview
- Knowing Your Data: Organizations need to identify and understand their data across the estate to ensure compliance and proper handling.
- Data Classification: Microsoft Purview offers data classification capabilities and tools in the compliance portal to help organizations identify important information. These include sensitive information types, trainable classifiers, content explorer, and activity explorer.
- Information Protection: Identifying and classifying sensitive items is the first step in the Information Protection discipline.
- Manual Classification: Users can manually classify data items based on their knowledge and understanding of the content.
- Automated Pattern Recognition: Purview uses automated pattern recognition, such as sensitive information types, to identify and classify sensitive items automatically.
- Machine Learning: Purview leverages machine learning to continuously improve data classification accuracy and efficiency.
By leveraging manual classification, automated pattern recognition, and machine learning, organizations can effectively identify and classify their sensitive data in Microsoft Purview, enabling better data management, compliance, and protection.
Sensitive Information Types in Microsoft Purview
- Sensitive Information Types (SIT): SITs are pattern-based classifiers used to identify sensitive information based on specific patterns or formats.
- Built-in Sensitive Information Types: Microsoft Purview provides numerous built-in SITs that cover common types of sensitive information, such as credit card numbers, passport or identification numbers, bank account numbers, and health service numbers.
- Regular Expressions and Functions: Sensitive information types are defined using regular expressions (regex) or functions that match specific patterns.
- Custom Sensitive Information Types: Organizations can create custom sensitive information types in Purview to address their unique requirements, such as employee IDs or project numbers.
- Exact Data Match (EDM) Classification: Purview supports EDM classification, which allows the creation of custom sensitive information types based on exact values in a database of sensitive information.
- Classification Capabilities: Data classification in Microsoft Purview includes the ability to identify and classify sensitive information using both built-in and custom sensitive information types.
By leveraging the built-in sensitive information types and creating custom types, organizations can effectively classify and protect sensitive data in Microsoft Purview, ensuring compliance and data privacy.
Trainable Classifiers in Microsoft Purview
- Trainable Classifiers: Trainable classifiers in Microsoft Purview use artificial intelligence and machine learning to classify data based on its content, rather than pattern matching. They are useful for classifying unique organizational data, such as specific contracts, invoices, or customer records.
- Pre-trained Classifiers: Microsoft provides pre-trained classifiers that are ready to use without any additional training. These classifiers cover categories like resumes, source code, harassment, profanity, and threats.
- Custom Trainable Classifiers: Purview supports the creation and training of custom classifiers to classify organization-specific data. These classifiers require a seeding process, where positive samples of the desired content category are provided to create a prediction model.
- Model Testing and Verification: The prediction model is tested to ensure its accuracy in distinguishing between items that match the content category and those that don’t. Manual verification of the prediction results helps improve the model’s accuracy.
- Publishing and Content Classification: Once the accuracy score of the model stabilizes, the trainable classifier can be published. It can then be used to classify content in locations such as SharePoint Online, Exchange, and OneDrive.
- Encryption Limitations: Currently, trainable classifiers only work with items that are not encrypted. Encrypted content is not processed by the classifiers.
By utilizing pre-trained classifiers or creating custom trainable classifiers, organizations can leverage AI and machine learning to accurately classify their data based on its content, enabling better organization and governance of their information assets.
Understand and explore the data
Data classification can involve large numbers of documents and emails.
To help administrators to easily derive insights and understanding, the overview section of the data classification pane in compliance portal provides many details at a glance, including:
- The number of items classified as sensitive information and which classifications they are.
- Details on the locations of data based on sensitivity.
- Summary of actions that users are taking on sensitive content across the organization.
Administrators can also use the content and activity explorers to gain a deeper understanding and guide their actions.
What is the content explorer?
The content explorer is available as a tab in the data classification pane of compliance portal.
It enables administrators to gain visibility into the content that has been summarized in the overview pane.
Access to content explorer is highly restricted because it makes it possible to read the contents of scanned files.
There are two roles that grant access to content explorer:
*Content explorer list viewer.
*Content explorer content viewer.
Anyone who wants to access content explorer must have an account in one or both of the role groups.
With content explorer, administrators get a current snapshot of individual items that have been classified across the organization.
It enables administrators to further drill down into items by allowing them to access and review the scanned source content that’s stored in different kinds of locations, such as Exchange, SharePoint, and OneDrive.
Activity Explorer in Microsoft Purview
- Activity Explorer: The Activity Explorer in Microsoft Purview provides visibility into the discovery and labelling of content, as well as tracking activities performed on labelled content across the organization.
- Monitoring Labelled Content: Admins can use Activity Explorer to monitor activities related to labelled content, including document-level actions such as label changes and downgrades (e.g., changing a label from confidential to public).
- Filtering and Details: Activity Explorer offers filters to view specific label details, such as file types, users, and activities associated with a particular label. This helps admins understand the actions taken on labelled content over time.
- Analysing Activities: Admins can analyse various activity types, including file copying to removable media, file copying to network shares, label application, and label changes. These activities provide insights into how sensitive content is being handled.
- Comprehensive Filters: More than 30 filters are available in Activity Explorer, allowing admins to analyse data based on location, user, sensitivity label, retention label, and other relevant parameters.
- Evaluating Controls: Activity Explorer helps admins assess the effectiveness of existing controls, such as data loss prevention policies. By understanding the actions taken with sensitive content, admins can identify any undesirable behaviour and update policies accordingly.
By utilizing the Activity Explorer in Microsoft Purview, organizations can gain insights into the usage and handling of labelled content, enabling them to make informed decisions to enhance data protection and mitigate risks effectively.
Sensitivity Labels in Microsoft Purview
- Sensitivity Labels: Sensitivity labels in the Microsoft Purview compliance portal enable organizations to label and protect content without disrupting productivity and collaboration.
- Customizable Labels: Admins can create customized sensitivity label categories specific to the organization, such as Personal, Public, Confidential, and Highly Confidential.
- Clear Text Storage: Sensitivity labels are stored in clear text within the metadata of the content. This allows third-party apps and services to read the labels and apply their own protective actions, if required.
- Persistence: Once a sensitivity label is applied to content, it is stored in the metadata of the email or document. The label moves with the content, including its protection settings, and serves as the basis for applying and enforcing policies.
- Single Label per Item: Each item supporting sensitivity labels can have only one label applied to it at any given time.
- Configuration Options: Sensitivity labels can be configured to encrypt email or both email and documents. They can also mark content when Office apps are used, apply labels automatically or recommend them, protect content in containers, extend labels to third-party apps and services, and classify content without applying specific protection settings.
- Roaming Classification: Sensitivity labels can be assigned as a classification to content, persisting and roaming with the content as it is used and shared. This classification can be used for generating usage reports and tracking activity data for sensitive content.
By leveraging sensitivity labels in Microsoft Purview, organizations can effectively label and protect their content while maintaining control and compliance across their data ecosystem.
Label Policies for Sensitivity Labels
- Publishing Sensitivity Labels: Sensitivity labels need to be published through label policies to make them available to users and services in the organization.
- Users and Groups: Label policies allow admins to choose specific users, distribution groups, Microsoft 365 groups, and more to whom sensitivity labels will be published.
- Default Label: Admins can apply a default sensitivity label to all new emails and documents created by the specified users and groups. Users have the flexibility to change the default label if necessary.
- Label Change Justifications: Admins can require users to provide valid justifications when removing or replacing a sensitivity label. This helps maintain accountability and ensures proper label management.
- Mandatory Labelling: Label policies can be configured to require users to apply a sensitivity label before saving documents, sending emails, or creating new sites or groups.
- Custom Help Pages: Admins have the option to link users to custom help pages that provide guidance on the meaning and proper usage of different sensitivity labels.
- Enforced Protection Settings: Once a sensitivity label is applied to an email or document, any protection settings configured for that label will be enforced on the content.
By utilizing label policies for sensitivity labels, organizations can effectively control and manage the application of labels across their users and ensure consistent data protection and compliance.
Data Loss Prevention (DLP) Policies in Microsoft Purview
- Protecting Sensitive Information: Data loss can have severe consequences for organizations. Admins can use DLP policies in Microsoft Purview to identify, monitor, and automatically protect sensitive information across Microsoft 365 services such as OneDrive for Business, SharePoint Online, Microsoft Teams, and Exchange Online.
- User-Friendly Compliance: DLP policies enable admins to educate users about compliance without disrupting their workflow. Users receive email notifications and policy tips when attempting to share documents containing sensitive information.
- DLP Reports: Admins can access DLP reports to track matches with organization-wide DLP policies over time, allowing assessment of compliance adherence.
- Rule-Based Enforcement: DLP policies consist of rules that enforce specific conditions and actions for sensitive content. Admins define conditions that content must meet and specify actions to be taken automatically when conditions are matched.
- Policy Application: DLP policies can be applied to various locations such as Exchange, SharePoint, OneDrive, and more, ensuring comprehensive protection across different Microsoft 365 services.
- Scenarios for DLP Policies: DLP policies help in scenarios like identifying credit card numbers in OneDrive accounts or blocking outbound emails containing personal employee information.
- Policy Hierarchy: DLP policies can contain multiple rules, and rules are prioritized for implementation within a policy. Prioritization ensures the appropriate actions are taken based on rule conditions.
By implementing DLP policies, organizations can proactively prevent data loss and safeguard sensitive information across Microsoft 365 services, maintaining compliance and protecting their customers, business processes, and reputation.
Endpoint Data Loss Prevention (Endpoint DLP)
- Extending DLP to Endpoints: Endpoint DLP expands the capabilities of Data Loss Prevention (DLP) to sensitive items physically stored on Windows 10, Windows 11, and macOS devices (Catalina 10.15 and higher).
- Monitoring User Activities: With Endpoint DLP, admins can audit and manage user activities related to sensitive content on endpoints. Examples include creating, renaming, copying to removable media, copying to network shares, printing documents, and accessing items through unallowed apps and browsers.
- Activity Explorer: The Activity Explorer provides a view of user activities performed on sensitive content. Admins can monitor and analyse these activities to enforce protective actions and ensure compliance.
- Protective Actions and Policies: Based on the insights from the Activity Explorer, admins can establish controls and policies to enforce protective actions on sensitive content accessed through endpoints.
Endpoint DLP enhances data protection by extending monitoring and control capabilities to the endpoints where sensitive information resides. By effectively managing user activities and enforcing protective measures, organizations can mitigate the risk of data loss and maintain security and compliance.
Data Loss Prevention (DLP) in Microsoft Teams
- DLP in Microsoft Teams: Data loss prevention capabilities have been extended to Microsoft Teams, covering chat and channel messages, including private channels. DLP policies can prevent users from sharing sensitive information in Teams conversations, including messages and files.
- Policy Tips: DLP policy tips are displayed to users when a policy is triggered, explaining why their message or file sharing has been blocked. Users receive real-time feedback on compliance requirements to make informed decisions.
- Understanding Policy Blocks: Users can click on the “What can I do?” link to learn more about why their message or file was blocked. This helps users understand the policy violation and take appropriate actions.
- Collaboration with Compliance: By implementing DLP policies in Microsoft Teams, organizations can enable secure collaboration while adhering to compliance requirements. Teams provides a secure environment for communication and file sharing, reducing the risk of data loss.
DLP in Microsoft Teams enhances data protection and promotes secure collaboration within organizations. With policy tips and user guidance, Teams users can ensure they communicate and share information in a compliant manner, safeguarding sensitive data.
Retention Labels and Policies
- Purpose of Retention Labels and Policies: Retention labels and policies help organizations manage and govern information by specifying how long content should be retained and when it should be permanently deleted.
- Compliance and Risk Reduction: Applying retention labels and policies allows organizations to comply with industry regulations and internal policies that require content to be retained for a specific duration. It also reduces the risk associated with litigation or security breaches by securely deleting old content that is no longer required.
- Seamless User Experience: Retention settings do not disrupt users’ workflows. Content remains in its original location, and users can continue working with their documents or emails as usual. If content subject to retention settings is edited or deleted, a secure copy is automatically preserved without users needing to be aware of it.
- Supported Workloads: Retention settings can be applied to content in SharePoint, OneDrive, Microsoft Teams, Yammer, and Exchange. This ensures consistent retention across various collaboration and communication platforms.
- Key Points to Understand: When using retention labels and policies, it’s important to consider various aspects such as the retention duration, actions on expired content, exceptions, and the specific capabilities of each workload. Refer to the “Compare capabilities for retention policies and retention labels” resource for a comprehensive list of key points.
Retention labels and policies provide organizations with a proactive approach to managing data retention, enabling compliance, reducing risk, and ensuring a seamless user experience across different workloads.
Retention policies
Retention policies are used to assign the same retention settings to content at a site level or mailbox level.
A single policy can be applied to multiple locations, or to specific locations or users.
Items inherit the retention settings from their container specified in the retention policy.
If a policy is configured to keep content, and an item is then moved outside that container, a copy of the item is kept in the workload’s secured location.
However, the retention settings don’t travel with the content in its new location.
Retention labels
Retention labels are used to assign retention settings at an item level, such as a folder, document, or email.
An email or document can have only a single retention label assigned to it at a time.
Retention settings from retention labels travel with the content if it’s moved to a different location within your Microsoft 365 tenant.
Admins can enable users in the organization to apply a retention label manually.
A retention label can be applied automatically if it matches defined conditions.
A default label can be applied for SharePoint documents.
Retention labels support disposition review to review the content before it’s permanently deleted.
