Mitigate threats using Microsoft Purview

In this module you learn to:

• Investigate DLP alerts in Microsoft Purview and Microsoft Defender XDR
• Review alert details, related user activities, and matched events
• Apply remediation actions and update alert or incident statuses
• Assign ownership, document decisions, and support accountability
• Recognize when DLP policies might need adjustments based on investigation outcomes

After completing this module, you'll be able to:

• Understand how alerts are generated and prioritized in Insider Risk Management.
• Tune policies and thresholds to manage alert volume effectively.
• Use the Alerts dashboard and alert details to triage and respond to risky activity.
• Investigate behavior using tabs like All risk factors, Activity explorer, and User activity.
• Integrate with Microsoft Defender XDR for broader threat investigation.
• Create, manage, and resolve Insider Risk Management cases.

After completing this module, you'll be able to:

• Describe how Microsoft Purview Audit records, retains, and exposes activity across Microsoft 365.
• Configure Audit (Standard) or Audit (Premium) for the users, services, and retention windows your compliance requirements call for.
• Run audit searches from the Microsoft Purview portal and PowerShell to surface evidence of user and admin activity.
• Extend the same search to Copilot and AI app activity across first-party, connected, and non-Microsoft record types.
• Investigate message-level access with Audit (Premium) events like MailItemsAccessed.
• Analyze and report on audit results by parsing exports and joining across record types.

In this module you learn how to:

• Assign the roles and permissions to access Microsoft Purview eDiscovery
• Create and manage cases used to run eDiscovery searches
• Define search scope and build queries using conditions, keywords, and Copilot-generated prompts
• Run searches and validate results using statistics or random samples