Pass Microsoft SC-400 Exam in First Attempt Guaranteed!

All Microsoft SC-400 certification exam dumps, study guide, training courses are Prepared by industry experts. PrepAway's ETE files povide the SC-400 Microsoft Information Protection Administrator practice test questions and answers & exam dumps, study guide and training courses help you study and pass hassle-free!

Implementing and Managing Sensitivity Labels

3. Enabling Audit Logging before working with Sensitivity Labels

Now if you're going to start working with sensitivity labels and data loss prevention and all that fun stuff, one thing you need to understand is that there are some functions within these components that are going to require auditing to be turned on within your Microsoft 365 tenant. and, sadly, that is not the case. By default, Microsoft does not turn on all the auditing services because it uses processing power on their end, so they require you to turn them on.

If you don't turn this on, you will get certain errors when trying to create some of the different label policies and all, especially when you start trying to do automatic policies. So this is something you definitely want to turn on. The other thing I'll warn you about is that when you turn it on, it can take about an hour before it takes effect. Okay? So just be patient once you turn it on.

Okay? So here we are; we're on portal Microsoft.com. We're going to click "Show all." We're going to go to the compliance blade, click on that, and it's going to bring us into the compliance center. OK? We're going to go down here to the audit blade, and here is the button right here.

So you're going to just click that button and start recording user admin activity, okay? And then keep in mind that even though it appears as though it's on, it can take about 60 minutes, roughly an hour, before it's actually activated. At that point, you should be clear to start working with the sensitive labels, DLP, and all that fun stuff.

4. Creating Sensitivity Labels including with Email, Content Marking and Encryption

Alright, I want to take a look now at working with sensitivity labels with the help of Azure Information Protection in Microsoft 365. OK, so we're going to start out at Portal, Microsoft.com. We're going to click on the "Show All" button. We're going to scroll down and go to the Compliance Center. So we're going to let the Compliance Center load up.

And then, once the Compliance Center is loaded, we're going to scroll down just a little bit. And there is an area called information protection. So we're going to click on that. And this is where you are going to create a sensitivity label. So if you look at a few things on the screen here, First off, I wanted to point out that it mentions something called Azure Purview. This is something that's going to allow you to use information protection with SQL columns within SQL databases and all that fun stuff. We're not getting into that right now. Also, if you look down here, there's a little yellow box that tells you. It states that if your organisation has not enabled the ability to process content in Office Online files that have been encrypted since the application of HIV labels and are stored in OneDrive.

You can also enable SharePoint right now. All right, so they give you some information about turning that on over here to the right. This is going to be involved if you are going to be implementing this for one drive, SharePoint. You can turn this on. So I'm going to go ahead and click to create a label. And this is what the wizard looks like; he's going to help you with this label. Keep in mind, guys, that Microsoft changes these screens. It seems to happen every week. I definitely work hard to keep my videos updated. But keep in mind that it's sometimes a losing battle because it seems like they're changing the wording and adding new features week after week after week. And I will definitely try to keep it updated. But don't be surprised if things are sometimes a little different here. The sooner you can get used to the fact that the cloud constantly changes, the better off you're going to be as an IT person, I promise you. because it is what it is.

It's one of those things that's constant. OK, so let's give it a name. Let's say this is going to be called Business Secure. That's going to be my label. So this is going to be some kind of label that I can apply to some of my documents, and I'm going to label it "Business Secure." OK? You can name it whatever you want. Business confidential. Top secret. You know, classified. There are all sorts of words here that you could give it. So then it wants to display the name. I'm just going to give it the same display name and description. You can give it any description you want. I'm just going to leave that as basically all the same. And then the description for the admins would be giving some information about who did this, when I could say, "John Christopher enabled this on a certain date, and this is why it was enabled, and this is how it's supposed to be applied." And this is for your administrators.

I'm going to go and click Next. So on the next screen, it says "Define the scope." So in other words, to what is this going to be applied to? You'll notice that files and emails are the default here, and that's kind of what we're focused on at the moment. However, you'll notice that you can apply this to groups and sites within teams and the Microsoft 365 Groups in SharePoint. Now, if you want to do that, you need to click this button right here, this link, and then just follow the steps, and at that point, you can have this checkbox enabled. Okay? The same is true for Azure Purview, the database I mentioned a minute ago; you can enable it by following the steps in this little article here. All right, but I'm just going to do files and emails. I'm going to go ahead and click "Next." And then it asked me if I would like to encrypt files and emails as well as mark the content of the file. So I could say "encrypt" if I wanted to encrypt the files and emails.

And then I could say to mark the content of the files and emails as well with something like a watermark. Okay, so if you're going to encrypt, it will implement what's called rights management and also provide encryption. Therefore, if somebody downloads a document that is out of the cloud through SharePoint teams, OneDrive for Business, or whatever it may be, it's encrypted, and they have to have the ability to decrypt it based on the sensitivity label in order to use it. Okay? And then, using watermarking, I can place watermarks on there. So the document will actually have a certain set of keywords on it. So if we click Next, you'll notice here it says, "OK, you're going to do encryption control," which determines who can access the files and email messages that have the sensitivity label. So I can say "configure the encryption." And again, it does mention that when you turn on this encryption for Office files (Word, PowerPoint, Excel), as they have indicated, it is going to affect the performance. It warns you about that.

Okay, remember that with SharePoint OneDrive, you must have previously turned it on, as I mentioned just a minute ago, allright, in the earlier part of the video. So from here, I can say "assign the permissions now." So I can say, "Assign permissions now" or "Let users assign permissions when the label is applied." So I can set the permissions on what I want, or I can let a user set the permission when they're applying this label to a document when they're using it, okay? So from there, I can say I'm going to let user access to content expire. I can say never. It's never going to expire. I can have it expire on a specific date. I can say a number of days after the label is applied, okay? And then you can also allow offline access if you want. You can say never. You can only say for a limited time. If you say never, then somebody's always got to have access to the cloud when they open the file. You've got to assign permissions to specific users and groups. I can say "assign," and here's where I can go and specify the user groups that I want or specific users that I want in my environment, okay? just particular users that are authenticated.

So you can kind of choose what you want to do there as far as groups and all that. You can also implement what's called "double encryption," which is going to increase security but also affect permissions even further. You can read more about that here, and they tell you that you can utilise double encryption. This is also going to use Azure's Rights Management Services, and we're implementing double encryption, which is going to slow things down more, okay? From there. I'm going to click next. This is where I can do content marking. So this is the watermark feature. I can select that, and I can have a watermark appear across the page, such as "Business Secure." I can have it go diagonally along the page or horizontally.

I can adjust the font size and the font colour as well. You can add a header at the top or a footer at the bottom of the page. And then after that, we'll click "Next." From here. You can do automatic labeling. Now keep in mind that to do auto-labeling, a user must have a licence for that. You must also have Azure Ad Premium or higher. Now, if you're using the EMS subscription E.Five, that does come with the Azure Ad Premium, too. So you can always double-check that. If you come over to Portal Azure.com, you can double-check that and ensure that you have the necessary licensing. If I go to the menu button, I go to Azure Advertising, all right? And then from there, you can see that I've got Azure Ad Premium, too. And again, if we go to "users," I'm sorry, not "users." If we go to Licenses and we go to all products, we can see Enterprising Ability plus Security E-5 and then Service Plan Details, and you can see that we have the Azure Ad Premium, too, and that's going to affect us.

We've also got the Azure Information Protection premium too as well. And that's going to give us our licence to do what's called "auto assignment." So this "auto-assignment of labeling," or "auto-labeling," as it is colloquially known, will essentially allow me to do the following based on a set of rules: documents can have auto-labeling applied, okay? So we can set conditions on this. We can say that the content contains sensitive information. Okay? So, for example, I could scroll down and do, let's do, find a few things here. How about we say us? UK passport, bank account, driver's license, social security number, tax ID number So those are some of the things we're going to add. And then if it finds a match on those, then at that point it's going to auto-flag. So if somebody is opening up a document that's tied to your Microsoft 365 environment and they start putting some of these numbers in that document, it's going to automatically apply this sensitivity label. Other users can also manually apply this sensitivity label.

Remember, you've got to have the premium for that too. Okay? All right, so from there, I can say, "automatically apply." I can also have a message pop up when this gets applied. All right, so on this next screen are defined protection settings for groups and sites. We did not enable that feature earlier for teams, groups, and sites. We could apply that and enable that. Returning to the beginning of the video, there is a link you can click and follow to enable these features here. At that point, you'll have the Groups and Sites features as well. And again, this is going to mostly apply to the teams in the Microsoft 365 Groups feature. Same thing if you go next and go to this auto-labelling for the databases; again, that's another thing. You follow the link, and you can enable this feature if you want. This is going to have autolabeling applied to database columns. Okay? At that point, I can click Next, and I can go ahead and click to create the label.

5. Configuring and Managing Sensitivity Label Policies

Now the thing you've got to understand about sensitivity labels is that you create the labels, but the labels are not available until after they've actually been published as what's called a policy. So let's take a look at how we can do that. We're going to start off right here, back at the beginning of Portal Microsoft.com. We're going to click to show all lips here, and we're going to click the compliance blade, and that's going to bring us into compliance.

Of course, you can always go directly to Microsoft.com. Once you're here, you're going to go down to information protection. All right. This is where we create our label. So you'll see all the labels that I've created here. One thing you'll notice about labels is that if there is ever a conflict between them, the one with the higher priority will always win. So you'll notice there is a priority here.

You can also adjust the priorities. You can shift those around if you want. Okay? So all you have to do is move all that good stuff down as well. You'll also notice you can have sublabels that go with those as well. All right? So if I want to have a sub-label for the label I just created, I can go ahead and specify sub-labels to go with that, which is kind of nice because you have the general label, the main label, but then you can provide some sub-categories if you want some sub-labels. The other thing is, and this is the point of this, of what I'm trying to get across to you now, that you must publish a label using a policy. Surprisingly, there are two options. Well, three ways if you count PowerShell, because you can do this through PowerShell, but you can also click "Publish the Label," which is going to basically create a policy, and the label is published. And at that point, you can start using the label. Okay, well, at that point, it can take well over an hour, sometimes even longer, before it actually becomes available. But you can publish it there, or you can click Label Policies and do it here. It really doesn't matter. You can use either one of those options.

Okay. So I'll just go ahead and click it here, all right? And then here's where I'm going to choose what I want. So from there, I have all these different ones that are available that I've created in the past. Of course, the one that I'm going to focus on right now is this one here called ConfidentialGroup, and we're going to click Add on that and we're going to click Next. And then we can choose our users and groups, whatever user groups you've got. Maybe I'm going to do this with the HR department. Maybe it's going to be focused on HR. So I'll just add HR. All right? And so this particular policy is only going to affect them. That means the HR department is the only one that's going to be able to use this label. All right? So we're going to click next on that, all right? And then we're going to bring them into policy settings. Oddly enough, you're not going to configure policy settings here. If you click next, that's when you're going to see policy settings. Now the policy settings are going to apply with regards to sites and groups, and it's asking if you would like to apply a default label for sites and groups. Okay, so in other words, do you want any, like, SharePoint sites and groups to go ahead and have this default label? So if I want, the HR department can have the "Confidential Group" label already applied to the stuff that they work with.

So if they're in there posting things in SharePoint or we start getting in with teams and all that, their stuff will be defaulted to the Confidential Group. Now I'm going to choose none. This way, they can select it as they go along. They can select the different labels as they go along if they want. All right? I can also require a user to apply a label to their groups or sites. So anybody in the HR group at that point would be forced to apply some kind of label to their stuff. I'm not going to do that either. Okay? Now if you created a bunch of different labels—you have one called "general," one called "confidential," and one called "highly confidential," and you could have different levels of each of those—you could force them to select one. But I'm not going to do that in this case. So then I'll click Next, and then I'm going to give it a name, and I'm just going to call it the HR Confidential Policy. All right? You could give it a description, and then we'll click "Next," and we're going to click "Submit." And we've now officially set this up.

And notice that it says it can take up to 24 hours. It usually does not take more than 24 hours. Sometimes it is definitely well over an hour, but it can take up to 24 hours. So if you're doing this, please be patient. I get lots of messages from people saying that they'll go through and do this process, and then they're like, "Hey, it's not showing up." What did I do wrong? You've got to give it time, okay? Please give it time for at least 24 hours before freaking out and thinking, "Oh, no, it didn't work, all right?" and I hate that. I really do. I wish that it were faster, but it is what it is. This is the way Microsoft has done it, and we kind of have to deal with it, unfortunately. So at that point, I can click Done, and I've now officially published my label. You.

6. Applying Sensitivity Labels to Teams, Microsoft 365 groups, and SharePoint

Now when it comes to applying sensitivity labels to Microsoft 365 Groups, which of course will involve Teams and SharePoint and all that, there are a couple of other steps you have to perform in order to make sensitivity labels associated with those things. So we're going to start here at Portal Microsoft.com. We're going to click on the All Ellipse symbol, and then we're going to click on the Compliance Center.

Okay, this will take us to Compliance.Microsoft.com, which you can also type in and go directly to. Of course, once you get here, you'll notice there's an area here called information protection. We're going to go ahead and click on that, and then this is where we can create labels. So we would click to create a label, and I'm just going to call this demo Label. All right, we're going to click next. Now this is what I really wanted to show you. So when you come in here, obviously you can start creating your labels for your files and emails. But you'll notice that for Groups and Sites, which are going to involve your Microsoft three Cs, five groups, which are going to involve Teams and SharePoint, and all that, you do have to do some extra steps as well, as with this Azure Purview feature, which is going to involve databases and all that.

But to do this, you'll notice there's a little link right here. It says, "Complete these steps." So if you click that link to complete these steps, you'll notice it brings you to this page here, alright? And it's basically telling you that you have to follow some guidelines in order to do this. To get the most up-to-date information, you should basically scroll down a little bit here and you'll see it says how to enable city labels for containers and synchronised labels and all that. Then it says how to configure groups and site settings, which you must do if you want to enable label synchronisation and other features. But what we really want to focus on right now is enabling this feature right here. So if we scroll down, it tells you the steps for doing this, all right? And what we're going to do is follow these steps and try to make sure that we have everything enabled that we need in order to enable this. Now, oddly enough, we're going to scroll back up to this area here where it says how to enable some TV labels for containers and synchronised labels.

And there is a link right here to an article that essentially gets into this. Essentially, it's telling you that because this feature is an Azure ad functionality feature, you've got to enable this group feature for associating sensitivity labels. So we're going to go ahead and click this little article here, and this is the article that is going to get this turned on for us, okay? So we're going to basically go through and follow what this article is telling us to do. As always, I want to encourage you guys—if you're doing this for real, in the real world, whatever—to follow the latest version of this article. I know I sound like a broken record, but you've got to remember that things in the cloud are constantly changing. Microsoft is constantly making updates. So no joke, I could be recording this today and tomorrow. These commands could be slightly different. It is almost impossible for me to update every single little change that they make every time they make a change in the cloud, because it happens every single week. The sooner you get used to change in the cloud, the better off you're going to be as an IT person, I promise.

So just get used to change. You may come here on the screen right now and see a slightly different command than what I've got up here. You're always welcome to message me and let me know because I'm always trying to keep my videos updated, but it is a losing battle, okay? They're always changing things. So here we are, in the process of making this video. These are the commands that are going to be used in PowerShell in order to help you get this set up. Okay? So what I'm going to do is open up PowerShell as an administrator, and I'm going to type ISe, which is going to bring me into the integrated scripting environment. And I'm going to copy these little commands right here. All right? And we'll pull this over into the Ise. I'm just going to paste it into the ISC, all right? And I'm just going to run each of these kinds of tests one at a time. We'll take a look at what happens. So we're going to go ahead and hit Run Selection, and it's going to do Install Dashmodule Azure 80 preview. Now in my case, you'll notice that I got a warning message. The warning message says that it's already installed. And if I want to have an older version installed or if I want to install the newer version, I can add a force parameter so I can say force, all right.

And then from there, I can highlight it again, and we'll just hit play. And this time it's going to, of course, try to force that to go ahead and get installed. The latest and greatest version As you can see, it's now officially getting installed, and it looks like it is completing right now. All right, it looks like that's done. So, now that I'm there, I can import modules. So we're going to highlight that import module that's going to import those commands into memory. And then I'm now officially ready to connect to Azure AD. so that I can actually work with these new commands. So I'm just going to go ahead with using my cell phone and approve that. All right, it's officially approved, and we're now officially connected to our Azure AD environment with PowerShell. Okay, I'm going to go back over to the article now, and it tells me to fetch the current group settings for your Azure ad organization. So I'm going to copy this, and then I'm going to go back in here and I'm just going to paste it right here. So we've now got this command. It's creating a variable called "setting." Get Azure ad directory settings. ID and then it's getting Azure directory settings where the property display name value is group Unified.

So "group unified" simply means Microsoft 365 Group. They originally called these unifiedgroups, which they renamed in PowerShell as unified groups. So at that point, I should be able to highlight this line here, this command, and I'm going to go ahead and tell it to run. Okay, so you'll notice I made an error. And if we come back over to our article, the article will tell you that if you get this error, you need to follow these steps. Okay? So we're going to go ahead and click on this little article here, and we're going to take a look at it. So this is for configuring group settings in your Azure tenant. Again, I don't really know. Microsoft eventually might create a graphical way to do this, but right now they are requiring us to go and run some PowerShell commands. So to configure group settings so that this is going to be allowed, If we scroll down here, it gives you more information on how to prevent non-administrators from creating security groups. You can go here. This gets into non-administrative users. That's not really the command we care about. But if we scroll down, it says to install PowerShell commands. We don't need to uninstall the version we already have. We've already got the version that we need.

So if we go right here, we can run this command. All right? So if we come back over here, paste that in, and we will run that command. All right? So then at that point, it shows you my groups, all right? My group information and group settings—what are called group settings? Here are all the group settings that are listed. Now what they're telling us to do here, if we scroll down a little bit, it says to add a Usage Guidelines URL. First, you need to get the settings template objects to find the Usage Guidelines URL. So if we copy this information and paste it over here into the ISC, all right, and then we'll go ahead and play this one. Alright? And then we're going to play this one. Let me fix that. There we go. Actually, don't copy; just highlight it and hit Play. We've done both of those things. It says, "Next, create a newsettings object based on the template." So we'll copy that. We're going to paste that over here, and we're going to run that. There you go. And then it says, "Then update the settings object with a new value." The two examples below change the usage guidelines value and enable sensitivity labels.

Set these or any other template settings that are required so that I can have guideline settings and a URL to point to if I want. Ultimately, the second option is the most important. This is just to provide guideline information. So I'm just going to copy and use the example. This is the most important one right here, this little flag right here. So we're going to go ahead and do that. Okay, that's now been set to true. All right. "Apply the settings," it says next. So we're going to copy this. This is going to apply the settings. Paste that in. We've now officially applied it. All right. And then, if we want to view the settings value, we can just view what that says. All right? and as you can see, it is set to true. So we're good there. All right, this is updating settings at the directory level. That's going to bring us back over to this article right here because, essentially, that's what they're telling you to do next. So we've got this command already. All we've got to do is go back up and try running it. All right. Notice we did not get an error that time. So we were able to officially run that. Here's our settings value again; it's telling us to run. We'll just run that one.

All right, everything looks good there. All right. And then it says, "Then save the changes and apply the settings." So go ahead and do it; we've already done it. Yeah, we've already run this, but I'm going to run it again just for the heck of it, just so that I'm following everything this article is telling me to do here. Okay? All right, so we've now officially done everything this article has told us to do. And again, just to kind of make sure you guys are on the same page with me here, Nobody's expecting you to memorise all these settings, okay? You're taking an exam. They're not expecting you to memorise all these commands. They definitely expect you to know that, hey, there are some extra steps here that you have to perform, and you're going to do these in PowerShell, but you're not having to memorise all the commands in the real world too. The big thing is that I encourage you to live by these documents. Don't always go by the crazy forum posts that people make. Not that I am not a fan of crazy forum posts, but I definitely say live by these Microsoft documents because these are always going to have the most up-to-date information, and no joke, they're up-to-date; they can change every week.

So this is why you may do a slightly different set of procedures than me. It could be the very next day after I make this video. So just be aware of that. You definitely want to go through this process and do the steps they tell you in the latest and greatest document. You also now know how you can view the latest and greatest version of that article as well. Based on when you go to create the label, it gives you a link that you can click on that's going to bring you here. Okay, so now that we've gone through all that work to get this working, let's jump back over to the Compliance Center and make sure we are on information protection. and we're going to click to create a label. Give it a name. I'll just call it a confidential group. Okay.

Alright. So from there, I'll just label the same thing "confidential group." Of course, you can give it a description if you want to get through it quickly. I'm going to click next. All right, so as you can see, our trouble did pay off. We do have groups and sites now available to us. So from there, if we want to just focus on groups and sites, we can click Next. We will not be encrypting emails or contexts. Because we did not select files and data, we can now ask, "Do we want to define protection settings for groups and sites?" Does this setting apply to teams, groups, and sites that have this label applied? They don't apply directly to the files stored in those cans. That's why you have another rule for the fox, right? And then it says that privacy and external user access settings control the level of access that internal and external users will have applied to teams and Microsoft's three groups. So we'd choose that, and then we'd be able to specify external sharing and conditional access settings. We can go ahead and select that as well.

All right, so control external sharing. This means if somebody is trying to share information with, say, somebody in the outside world, then we can have that flagged as well. So we would click next. Okay. And then define the privacy and external user access settings. So notice here that it says these options apply to all Microsoft 365 groups and teams that have this label applied. When applied, these settings will replace any existing privacy settings for the team or group.

If the label is removed, users can change it again. Okay, so from here, we can go ahead and choose whichever we want. We can choose "public," which means anyone in your organisation can access the group or team if we go with that. Okay, we can do private only for team owners. Members can access the group or team, and only owners can add members, or none of the team or group members can set the privacy settings themselves. Isn't this where someone can set it during the creation process? So we have that option. Whichever one of these we want, I'm going to choose none for right now so that people can select them themselves.

And then here it says "external user access." Let Microsoft Groups group owners add people outside their organisation to the group as guests. So I can select that if I want to allow group owners to add people outside the organisation as external users, I can. This is confidential; maybe I'm not going to allow that. So then I'm going to click next. It says "Define external sharing and device access settings." And then, as you can see, this is primarily concerned with SharePoint Control: who can share SharePoint content with people outside your organisation and whether users can access labelled sites from unmanaged devices. These are devices that aren't always related to your Azure advertising environment. I can control external sharing from labelled SharePoint sites, and then they tell you here that if this is applied to a SharePoint site, these settings will replace the external sharing settings that are configured on the site.

So you're going to basically override the SharePoint site settings if you want. And then from here, I can choose which content can be shared by anybody, new and existing guests, existing guests, or only people in your organization. Some of the only people in the organisation use Azure ad-hoc access to protect labelled SharePoint sites. So that's going to enable the conditional access that you just saw on that last screen, which I'm not going to turn on right now.

Click Next. I want to do auto-labeling. I'm not doing auto-labelling for databases because I have to enable Azure database purview, which I'm not getting into right now. And then I'm going to click Next, and then we'll say "Create a label." And just like that, we've now officially created a sensitivity label that can now work in conjunction with our Microsoft 365 Groups team. SharePoint and all that good stuff Just always be forewarned when you implement labels. This can take an hour or more before it even becomes available to you. So don't get too excited and think that you're going to create a label and it's just always going to be ready. It may take an hour or longer for this to appear. But once it shows up, you should be able to start using it.

Microsoft SC-400 practice test questions and answers, training course, study guide are uploaded in ETE Files format by real users. Study and Pass SC-400 Microsoft Information Protection Administrator certification exam dumps & practice test questions and answers are to help students.