Microsoft 365 Security Administrator Associate (SC-401) + MS Teams

SC-401 (Microsoft Information Security Administrator) ersetzt seit Ende 2024 das ehemalige MS-500 (Microsoft 365 Security Administrator). Themen: 1. Implement Information Protection (35-40%) — Microsoft Purview Information Protection mit Sensitivity Labels (Confidential, Internal, Public, Highly Confidential mit Auto-Encryption und Rights Management), Label Policies für User-Gruppen, Auto-Apply Conditions (Sensitive Info Types Standard wie EU IBAN/Credit Card/SSN, Trainable Classifiers für Custom Content, Regex Patterns für Custom Detection), Recommendation Bar für User. DLP Data Loss Prevention für Exchange/SharePoint/OneDrive/Teams/Endpoint/Defender for Cloud Apps. DLP Policies mit Conditions (welche Daten), Exceptions, Actions (Notify User mit Policy Tips, Block-Action mit Override-Option und Justification, Quarantine, Generate Incident Report). Microsoft Purview Data Lifecycle Management mit Retention Policies (Time-based, Event-based mit Trigger wie Employee Termination), Retention Labels für granular Records Management, Adaptive Policies basierend auf User-Attributes (Department, Country). Disposition Reviews mit Approval-Workflow. 2. Implement Data Loss Prevention DLP (15-20%) — Endpoint DLP mit Microsoft Defender for Endpoint Integration (Windows, macOS), Policy Templates (Financial, Medical, Privacy für Standard-Use-Cases), DLP Reports (Trends, Incidents pro User/Location/Policy), Alert Tuning gegen False Positives. Custom Sensitive Info Types für Branchen-spezifische Daten. 3. Manage Insider Risk Management (15-20%) — Insider Risk Management Policies (Templates: Data Theft by Departing Employees, Data Leaks, General Data Leaks, Healthcare Data Leaks, Risky Browser Usage, Forensic Evidence), Indicators (Risk Behaviors wie Mass Downloads in Short Time, Off-Hours Access, USB Device Connect, Print Activity, Cloud Storage Upload). Investigation und Case Management. HR Connector für Termination-Date-Sync. Communication Compliance für Insider-Themen. 4. Implement and Manage Microsoft Purview eDiscovery (15-20%) — eDiscovery Standard für einfache Searches across Exchange/SharePoint/OneDrive/Teams, Hold für rechtlich relevante Daten. eDiscovery Premium für komplexe Legal Cases (Custodian Management mit Hold Notifications und Acknowledgement, Communications Tracking, Review Sets mit Tags/Themes/Analytics, Predictive Coding mit Machine Learning für Relevanz, OCR für Scanned PDFs, Export to Relativity oder generische Formate). Cross-Tenant eDiscovery. 5. Manage Microsoft Purview Audit (10-15%) — Audit Standard vs. Premium (1-Jahres-Retention vs. 10-Jahre, mehr Activities loggt), Audit Search mit Filter (User, Activity, Date, Workload), High-Volume Activities. Examen SC-401: ~50 Fragen, 100 Min, 700/1000 Pass. MS Teams (1 Tag): Security-Admin-Workflow mit Teams (Alerts in Channel, Loop für gemeinsame Investigations).