Mastering Office 365 Security Controls and Threat Protection
You're not just managing an inbox. You're protecting your organisation’s crown jewels-data, reputation, and compliance standing-all from within the same platform your team uses every day. But with rising threats, ever-evolving attack vectors, and growing regulatory pressure, one misconfigured setting could be your organisation’s next headline for all the wrong reasons. You know the risks. You’ve reviewed the alerts. You’ve run the reports. But are you truly confident that your Office 365 environment is shielded against targeted phishing, account compromise, or data exfiltration? Or are you operating on hope rather than a hardened, proactive security posture? Mastering Office 365 Security Controls and Threat Protection is the definitive blueprint for turning reactive fear into strategic confidence. This course transforms how you architect, configure, and maintain Microsoft 365’s native security framework-so you go from monitoring alerts to mastering prevention, detection, and response-all within 21 days. One recent learner, a senior security analyst at a healthcare provider with 8,000 employees, used this course’s methodology to redesign their conditional access policies and detect a previously missed insider threat. Within two weeks of implementation, they reduced unauthorised access attempts by 92% and received executive recognition for strengthening compliance alignment. This isn’t theoretical. It’s actionable, precise, and built for real environments-where budgets are tight, timelines are compressed, and the cost of failure is measured in breaches, audits, and lost trust. Here’s how this course is structured to help you get there.Course Format & Delivery Details Self-Paced Learning with Immediate Online Access This course is designed for professionals who need precision, not pressure. Enroll once and gain instant access to the full curriculum. Learn on your terms-no deadlines, no fixed start dates, no mandatory attendance. Whether you have 30 focused minutes or a full afternoon, your progress is preserved exactly where you leave off. Typical Completion: 21 Days | Real Results in Under 7 Most learners implement their first major security enhancement-such as a hardened Conditional Access policy or a custom threat detection rule-within the first week. Complete the full journey in three weeks of dedicated study, or spread it across a month without losing momentum. Lifetime Access & Ongoing Updates
You’re not buying a moment in time. You’re investing in a living resource. All future updates to Office 365 security features, threat landscapes, and Microsoft’s expanding ecosystem are included at no extra cost. As Microsoft evolves, so does your access-ensuring your knowledge stays current, credible, and compliant. 24/7 Global & Mobile-Friendly Access
Access the course anytime, anywhere. Whether you're on-site, remote, or traveling, the interface adapts seamlessly to desktops, tablets, and smartphones. No installations. No downloads. Just secure, immediate access with your login credentials. Instructor Support & Guided Expertise
You're never alone. Receive direct guidance from our expert instructors-seasoned Microsoft security architects with over 15 years of enterprise experience each. Ask questions, request clarification, and get real-world insights through dedicated support channels. Responses are typically delivered within 24 business hours, ensuring you never get stuck. Certificate of Completion: Credibility You Can Showcase
Upon finishing the course, you will earn a verified Certificate of Completion issued by The Art of Service. This globally recognised credential verifies your mastery of Office 365 security controls and threat protection frameworks, and can be shared on LinkedIn, included in job applications, or presented during performance reviews to demonstrate proactive expertise. Transparent Pricing, No Hidden Fees
What you see is what you pay. There are no subscription traps, no auto-renewals, no hidden charges. One straightforward fee includes full curriculum access, updates for life, and certification. No surprises. No fine print. Accepts Major Payment Methods
- Visa
- Mastercard
- PayPal
100% Satisfaction Guarantee: Try It Risk-Free
If you complete the first two modules and don’t believe this course will fundamentally improve your ability to secure Microsoft 365, contact us for a full refund-no questions asked. We’re confident in the transformation this program delivers, and we’re committed to eliminating any financial risk for you. Enrollment Confirmation & Access Flow
After enrollment, you will receive a confirmation email with your purchase details. Your access credentials and login instructions will be sent separately once your course materials are fully provisioned. Please allow standard processing time for delivery-your access will be active as soon as setup is complete. “Will This Work for Me?” – The Ultimate Reassurance
This works whether you're: - A security administrator with limited Microsoft 365 exposure
- A compliance officer needing to validate control effectiveness
- An IT manager overseeing cloud operations without deep security training
- Or a consultant delivering rapid, high-impact improvements to clients
This works even if: You’ve never used Microsoft Defender for Office, don’t have E5 licenses, are working in a hybrid environment, or report to leadership that demands clear, actionable justification for every control change. The frameworks inside this course are designed for real constraints, real budgets, and real-world risk profiles. With over 12,000 professionals trained globally and a 97% satisfaction rate, The Art of Service has built a reputation for delivering precise, no-fluff, results-driven learning. This course continues that standard-transforming uncertainty into authority, and effort into impact.
Extensive and Detailed Course Curriculum
Module 1: Foundations of Office 365 Security Architecture - Understanding the shared responsibility model in Microsoft 365
- Mapping the threat landscape across Exchange Online, OneDrive, SharePoint, Teams
- Overview of Microsoft 365 security stack components
- Key differences between M365 Business, E3, and E5 security capabilities
- How identity becomes the new perimeter in cloud security
- Principles of Zero Trust and their application to Office 365
- Introduction to the Microsoft Secure Score framework
- Interpreting and acting on Secure Score recommendations
- Role-based access control (RBAC) best practices
- Default admin roles vs custom roles: when and how to create them
- Securing Global Admin accounts with MFA and PIM
- Planning administrative access with least privilege
- Understanding service principals and app permissions
- Audit logging fundamentals in the Microsoft 365 compliance center
- Enabling and verifying unified audit logging
Module 2: Identity and Access Governance - Implementing strong authentication with Multi-Factor Authentication (MFA)
- Configuring MFA for admin and end-user accounts
- Balancing security and usability with MFA registration policies
- Setting up self-service password reset (SSPR) securely
- Integrating Azure AD Identity Protection for risk-based policies
- Detecting and responding to sign-in risk events
- Implementing conditional access policies from first principles
- Creating named locations for trusted IP ranges
- Building policies based on user risk, sign-in risk, device state
- Requiring compliant devices for access to sensitive apps
- Using sign-in frequency to limit session replay
- Blocking legacy authentication protocols
- Enabling continuous access evaluation for real-time revocation
- Configuring authentication strengths for modern sign-in methods
- Testing and auditing conditional access policies safely
Module 3: Email Security with Exchange Online Protection (EOP) and Defender for Office 365 - Understanding EOP’s role in inbound and outbound filtering
- Configuring anti-phishing policies for impersonation protection
- Detecting spoofed sender addresses with SPF, DKIM, and DMARC
- Creating and enforcing organizational DMARC policies
- Setting up anti-spam policies with custom spam thresholds
- Blocking malware and malicious attachments at the gateway
- Implementing outbound spam policies to detect compromised accounts
- Creating mail flow rules (transport rules) for data control
- Preventing unauthorised external sharing via automated policies
- Quarantine management and end-user release procedures
- Understanding and enabling Office 365 Advanced Threat Protection (ATP)
- Configuring Safe Attachments policies for malware scanning
- Setting up Safe Links for real-time URL rewriting and inspection
- Enabling anti-phishing policies with impersonation insights
- Protecting executives with targeted email attack protection
- Using spoof intelligence to inform policies automatically
- Reviewing and acting on threat reports in the Threat Explorer
Module 4: Endpoint and Device Security Integration - Connecting Office 365 to Microsoft Intune for device compliance
- Enforcing conditional access based on device compliance state
- Configuring compliance policies for mobile and desktop devices
- Integrating Azure AD Hybrid Join for on-prem to cloud identity
- Using device identity for access decisions in conditional access
- Managing app-based conditional access for mobile clients
- Implementing app protection policies (MAM) without device enrollment
- Securing data in Outlook, Teams, and OneDrive on unmanaged devices
- Wiping corporate data from lost or compromised devices remotely
- Auditing device compliance and access history
- Monitoring device risk with Microsoft Defender for Endpoint
- Enabling automatic remediation of non-compliant devices
- Using device trust levels in access policies
- Integrating third-party EDR solutions with O365 controls
- Building consistent enforcement across BYOD and corporate-owned fleets
Module 5: Data Protection and Information Governance - Overview of sensitivity labels and their role in classification
- Creating and publishing sensitivity labels in the Microsoft 365 compliance center
- Applying encryption to documents and emails via labels
- Configuring label policies for automatic or user-assigned classification
- Enforcing label use for specific departments or high-risk content
- Protecting data in Teams, SharePoint, and OneDrive with labels
- Using retention labels to manage data lifecycle
- Setting up retention policies for sites, mailboxes, and teams
- Preventing deletion with deletion prevention labels
- Implementing event-based retention for legal or compliance triggers
- Creating legal holds for investigations without user impact
- Using the Content Search tool to identify high-risk data
- Exporting search results securely for review
- Configuring eDiscovery cases for internal investigations
- Setting up communication compliance policies to detect policy violations
- Monitoring for harassment, discrimination, or data leakage in chats
- Using trainable classifiers to detect custom data types
Module 6: Threat Detection and Response with Microsoft Defender - Introduction to Microsoft Defender for Office 365 capabilities
- Differences between Plan 1 and Plan 2 features
- Configuring threat intelligence sources and feeds
- Understanding automated investigation and response (AIR)
- Reviewing incident queues and triaging alerts
- Interpreting attack chain visualizations
- Using threat investigation reports to trace campaign origins
- Blocking malicious senders and domains at scale
- Creating custom detection rules with threat indicators
- Importing IOCs for proactive threat hunting
- Setting up real-time alerts for high-priority threats
- Integrating with SIEM via Microsoft 365 Defender API
- Using the Threat Explorer to identify attack patterns
- Reviewing indicators of compromise (IOCs) in email headers
- Analyzing suspicious URLs and file hashes
- Simulating phishing attacks with Attack Simulation Training
- Building custom phishing scenarios for user awareness
- Tracking user click rates and improving training programs
- Generating executive reports on threat readiness
Module 7: Collaboration Security in Teams, SharePoint, and OneDrive - Securing Microsoft Teams: external access and guest settings
- Managing org-wide and team-level privacy configurations
- Controlling guest access to Teams and channels
- Enabling and auditing external sharing in SharePoint Online
- Setting up sharing policies by group or sensitivity
- Requiring sign-in for shared links to OneDrive and SharePoint
- Blocking anonymous access to shared content
- Using access reviews to clean up stale permissions
- Scheduling regular reviews for guest accounts and sharing links
- Detecting overexposed files using sensitivity labels and audit logs
- Automatically applying labels to newly created files
- Configuring DLP policies for SharePoint and OneDrive
- Blocking or encrypting files containing credit card numbers, PII, etc
- Setting up alerts when sensitive data is shared externally
- Using the file policy tips in Office apps for real-time warnings
- Managing retention and deletion policies for Teams content
- Archiving and preserving Teams for compliance
- Auditing file access and sharing activities across platforms
Module 8: Advanced Security Configuration and Automation - Using PowerShell to automate security configurations
- Connecting to Exchange Online, Azure AD, and Security & Compliance
- Scripting bulk role assignments and policy deployments
- Exporting audit logs for third-party analysis
- Creating custom scripts for Secure Score improvement
- Enabling API access with service principals and app-only tokens
- Securing automation with certificate-based authentication
- Integrating with Azure Logic Apps for automated workflows
- Building playbooks for common threat scenarios
- Sending alerts to Microsoft Teams channels or Slack via connectors
- Automating response actions based on Defender incidents
- Scheduling recurring compliance checks with scripts
- Backups and configuration snapshots for disaster recovery
- Documenting and versioning security policies
- Using GitHub or Azure Repos for policy as code
- Integrating with CI/CD pipelines for governance as code
- Validating configurations before deployment
Module 9: Comprehensive Auditing, Logging, and Reporting - Understanding audit log retention periods and limits
- Searching audit logs for user, admin, and app activities
- Filtering logs by operation, user, severity, or date
- Exporting audit log data in standard formats
- Setting up alert policies for suspicious activities
- Creating custom alerts for bulk file deletions or downloads
- Detecting impossible travel and anomalous location access
- Monitoring administrative changes to RBAC or policies
- Tracking mailbox folder permission modifications
- Generating executive dashboards from audit data
- Using Power BI to visualise O365 security events
- Connecting Microsoft 365 logs to external SIEMs
- Formatting data for Splunk, QRadar, or ArcSight ingestion
- Mapping Office 365 events to MITRE ATT&CK framework
- Analysing lateral movement and persistence techniques
- Correlating email, identity, and endpoint logs for full context
- Producing audit-ready reports for regulators or internal review
Module 10: Real-World Implementation Projects - Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance
Module 11: Certification Preparation and Career Advancement - Review of key domains covered in the course
- Self-assessment quiz to test mastery of core concepts
- Hands-on simulation checklist for real-world readiness
- Preparing your Certificate of Completion portfolio
- Best practices for showcasing certification on LinkedIn and resumes
- Translating course skills into job interview talking points
- Positioning yourself for promotions or security specialist roles
- Using the certificate to support audit evidence packages
- Continuing your journey: recommended Microsoft certifications
- Microsoft SC-300, SC-400, and MS-500 alignment overview
- Building a personal cloud security lab for ongoing practice
- Joining security communities and staying current
- Accessing The Art of Service alumni resources
- Receiving job board alerts for security-focused roles
- Requesting a recommendation letter upon successful completion
Module 1: Foundations of Office 365 Security Architecture - Understanding the shared responsibility model in Microsoft 365
- Mapping the threat landscape across Exchange Online, OneDrive, SharePoint, Teams
- Overview of Microsoft 365 security stack components
- Key differences between M365 Business, E3, and E5 security capabilities
- How identity becomes the new perimeter in cloud security
- Principles of Zero Trust and their application to Office 365
- Introduction to the Microsoft Secure Score framework
- Interpreting and acting on Secure Score recommendations
- Role-based access control (RBAC) best practices
- Default admin roles vs custom roles: when and how to create them
- Securing Global Admin accounts with MFA and PIM
- Planning administrative access with least privilege
- Understanding service principals and app permissions
- Audit logging fundamentals in the Microsoft 365 compliance center
- Enabling and verifying unified audit logging
Module 2: Identity and Access Governance - Implementing strong authentication with Multi-Factor Authentication (MFA)
- Configuring MFA for admin and end-user accounts
- Balancing security and usability with MFA registration policies
- Setting up self-service password reset (SSPR) securely
- Integrating Azure AD Identity Protection for risk-based policies
- Detecting and responding to sign-in risk events
- Implementing conditional access policies from first principles
- Creating named locations for trusted IP ranges
- Building policies based on user risk, sign-in risk, device state
- Requiring compliant devices for access to sensitive apps
- Using sign-in frequency to limit session replay
- Blocking legacy authentication protocols
- Enabling continuous access evaluation for real-time revocation
- Configuring authentication strengths for modern sign-in methods
- Testing and auditing conditional access policies safely
Module 3: Email Security with Exchange Online Protection (EOP) and Defender for Office 365 - Understanding EOP’s role in inbound and outbound filtering
- Configuring anti-phishing policies for impersonation protection
- Detecting spoofed sender addresses with SPF, DKIM, and DMARC
- Creating and enforcing organizational DMARC policies
- Setting up anti-spam policies with custom spam thresholds
- Blocking malware and malicious attachments at the gateway
- Implementing outbound spam policies to detect compromised accounts
- Creating mail flow rules (transport rules) for data control
- Preventing unauthorised external sharing via automated policies
- Quarantine management and end-user release procedures
- Understanding and enabling Office 365 Advanced Threat Protection (ATP)
- Configuring Safe Attachments policies for malware scanning
- Setting up Safe Links for real-time URL rewriting and inspection
- Enabling anti-phishing policies with impersonation insights
- Protecting executives with targeted email attack protection
- Using spoof intelligence to inform policies automatically
- Reviewing and acting on threat reports in the Threat Explorer
Module 4: Endpoint and Device Security Integration - Connecting Office 365 to Microsoft Intune for device compliance
- Enforcing conditional access based on device compliance state
- Configuring compliance policies for mobile and desktop devices
- Integrating Azure AD Hybrid Join for on-prem to cloud identity
- Using device identity for access decisions in conditional access
- Managing app-based conditional access for mobile clients
- Implementing app protection policies (MAM) without device enrollment
- Securing data in Outlook, Teams, and OneDrive on unmanaged devices
- Wiping corporate data from lost or compromised devices remotely
- Auditing device compliance and access history
- Monitoring device risk with Microsoft Defender for Endpoint
- Enabling automatic remediation of non-compliant devices
- Using device trust levels in access policies
- Integrating third-party EDR solutions with O365 controls
- Building consistent enforcement across BYOD and corporate-owned fleets
Module 5: Data Protection and Information Governance - Overview of sensitivity labels and their role in classification
- Creating and publishing sensitivity labels in the Microsoft 365 compliance center
- Applying encryption to documents and emails via labels
- Configuring label policies for automatic or user-assigned classification
- Enforcing label use for specific departments or high-risk content
- Protecting data in Teams, SharePoint, and OneDrive with labels
- Using retention labels to manage data lifecycle
- Setting up retention policies for sites, mailboxes, and teams
- Preventing deletion with deletion prevention labels
- Implementing event-based retention for legal or compliance triggers
- Creating legal holds for investigations without user impact
- Using the Content Search tool to identify high-risk data
- Exporting search results securely for review
- Configuring eDiscovery cases for internal investigations
- Setting up communication compliance policies to detect policy violations
- Monitoring for harassment, discrimination, or data leakage in chats
- Using trainable classifiers to detect custom data types
Module 6: Threat Detection and Response with Microsoft Defender - Introduction to Microsoft Defender for Office 365 capabilities
- Differences between Plan 1 and Plan 2 features
- Configuring threat intelligence sources and feeds
- Understanding automated investigation and response (AIR)
- Reviewing incident queues and triaging alerts
- Interpreting attack chain visualizations
- Using threat investigation reports to trace campaign origins
- Blocking malicious senders and domains at scale
- Creating custom detection rules with threat indicators
- Importing IOCs for proactive threat hunting
- Setting up real-time alerts for high-priority threats
- Integrating with SIEM via Microsoft 365 Defender API
- Using the Threat Explorer to identify attack patterns
- Reviewing indicators of compromise (IOCs) in email headers
- Analyzing suspicious URLs and file hashes
- Simulating phishing attacks with Attack Simulation Training
- Building custom phishing scenarios for user awareness
- Tracking user click rates and improving training programs
- Generating executive reports on threat readiness
Module 7: Collaboration Security in Teams, SharePoint, and OneDrive - Securing Microsoft Teams: external access and guest settings
- Managing org-wide and team-level privacy configurations
- Controlling guest access to Teams and channels
- Enabling and auditing external sharing in SharePoint Online
- Setting up sharing policies by group or sensitivity
- Requiring sign-in for shared links to OneDrive and SharePoint
- Blocking anonymous access to shared content
- Using access reviews to clean up stale permissions
- Scheduling regular reviews for guest accounts and sharing links
- Detecting overexposed files using sensitivity labels and audit logs
- Automatically applying labels to newly created files
- Configuring DLP policies for SharePoint and OneDrive
- Blocking or encrypting files containing credit card numbers, PII, etc
- Setting up alerts when sensitive data is shared externally
- Using the file policy tips in Office apps for real-time warnings
- Managing retention and deletion policies for Teams content
- Archiving and preserving Teams for compliance
- Auditing file access and sharing activities across platforms
Module 8: Advanced Security Configuration and Automation - Using PowerShell to automate security configurations
- Connecting to Exchange Online, Azure AD, and Security & Compliance
- Scripting bulk role assignments and policy deployments
- Exporting audit logs for third-party analysis
- Creating custom scripts for Secure Score improvement
- Enabling API access with service principals and app-only tokens
- Securing automation with certificate-based authentication
- Integrating with Azure Logic Apps for automated workflows
- Building playbooks for common threat scenarios
- Sending alerts to Microsoft Teams channels or Slack via connectors
- Automating response actions based on Defender incidents
- Scheduling recurring compliance checks with scripts
- Backups and configuration snapshots for disaster recovery
- Documenting and versioning security policies
- Using GitHub or Azure Repos for policy as code
- Integrating with CI/CD pipelines for governance as code
- Validating configurations before deployment
Module 9: Comprehensive Auditing, Logging, and Reporting - Understanding audit log retention periods and limits
- Searching audit logs for user, admin, and app activities
- Filtering logs by operation, user, severity, or date
- Exporting audit log data in standard formats
- Setting up alert policies for suspicious activities
- Creating custom alerts for bulk file deletions or downloads
- Detecting impossible travel and anomalous location access
- Monitoring administrative changes to RBAC or policies
- Tracking mailbox folder permission modifications
- Generating executive dashboards from audit data
- Using Power BI to visualise O365 security events
- Connecting Microsoft 365 logs to external SIEMs
- Formatting data for Splunk, QRadar, or ArcSight ingestion
- Mapping Office 365 events to MITRE ATT&CK framework
- Analysing lateral movement and persistence techniques
- Correlating email, identity, and endpoint logs for full context
- Producing audit-ready reports for regulators or internal review
Module 10: Real-World Implementation Projects - Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance
Module 11: Certification Preparation and Career Advancement - Review of key domains covered in the course
- Self-assessment quiz to test mastery of core concepts
- Hands-on simulation checklist for real-world readiness
- Preparing your Certificate of Completion portfolio
- Best practices for showcasing certification on LinkedIn and resumes
- Translating course skills into job interview talking points
- Positioning yourself for promotions or security specialist roles
- Using the certificate to support audit evidence packages
- Continuing your journey: recommended Microsoft certifications
- Microsoft SC-300, SC-400, and MS-500 alignment overview
- Building a personal cloud security lab for ongoing practice
- Joining security communities and staying current
- Accessing The Art of Service alumni resources
- Receiving job board alerts for security-focused roles
- Requesting a recommendation letter upon successful completion
- Implementing strong authentication with Multi-Factor Authentication (MFA)
- Configuring MFA for admin and end-user accounts
- Balancing security and usability with MFA registration policies
- Setting up self-service password reset (SSPR) securely
- Integrating Azure AD Identity Protection for risk-based policies
- Detecting and responding to sign-in risk events
- Implementing conditional access policies from first principles
- Creating named locations for trusted IP ranges
- Building policies based on user risk, sign-in risk, device state
- Requiring compliant devices for access to sensitive apps
- Using sign-in frequency to limit session replay
- Blocking legacy authentication protocols
- Enabling continuous access evaluation for real-time revocation
- Configuring authentication strengths for modern sign-in methods
- Testing and auditing conditional access policies safely
Module 3: Email Security with Exchange Online Protection (EOP) and Defender for Office 365 - Understanding EOP’s role in inbound and outbound filtering
- Configuring anti-phishing policies for impersonation protection
- Detecting spoofed sender addresses with SPF, DKIM, and DMARC
- Creating and enforcing organizational DMARC policies
- Setting up anti-spam policies with custom spam thresholds
- Blocking malware and malicious attachments at the gateway
- Implementing outbound spam policies to detect compromised accounts
- Creating mail flow rules (transport rules) for data control
- Preventing unauthorised external sharing via automated policies
- Quarantine management and end-user release procedures
- Understanding and enabling Office 365 Advanced Threat Protection (ATP)
- Configuring Safe Attachments policies for malware scanning
- Setting up Safe Links for real-time URL rewriting and inspection
- Enabling anti-phishing policies with impersonation insights
- Protecting executives with targeted email attack protection
- Using spoof intelligence to inform policies automatically
- Reviewing and acting on threat reports in the Threat Explorer
Module 4: Endpoint and Device Security Integration - Connecting Office 365 to Microsoft Intune for device compliance
- Enforcing conditional access based on device compliance state
- Configuring compliance policies for mobile and desktop devices
- Integrating Azure AD Hybrid Join for on-prem to cloud identity
- Using device identity for access decisions in conditional access
- Managing app-based conditional access for mobile clients
- Implementing app protection policies (MAM) without device enrollment
- Securing data in Outlook, Teams, and OneDrive on unmanaged devices
- Wiping corporate data from lost or compromised devices remotely
- Auditing device compliance and access history
- Monitoring device risk with Microsoft Defender for Endpoint
- Enabling automatic remediation of non-compliant devices
- Using device trust levels in access policies
- Integrating third-party EDR solutions with O365 controls
- Building consistent enforcement across BYOD and corporate-owned fleets
Module 5: Data Protection and Information Governance - Overview of sensitivity labels and their role in classification
- Creating and publishing sensitivity labels in the Microsoft 365 compliance center
- Applying encryption to documents and emails via labels
- Configuring label policies for automatic or user-assigned classification
- Enforcing label use for specific departments or high-risk content
- Protecting data in Teams, SharePoint, and OneDrive with labels
- Using retention labels to manage data lifecycle
- Setting up retention policies for sites, mailboxes, and teams
- Preventing deletion with deletion prevention labels
- Implementing event-based retention for legal or compliance triggers
- Creating legal holds for investigations without user impact
- Using the Content Search tool to identify high-risk data
- Exporting search results securely for review
- Configuring eDiscovery cases for internal investigations
- Setting up communication compliance policies to detect policy violations
- Monitoring for harassment, discrimination, or data leakage in chats
- Using trainable classifiers to detect custom data types
Module 6: Threat Detection and Response with Microsoft Defender - Introduction to Microsoft Defender for Office 365 capabilities
- Differences between Plan 1 and Plan 2 features
- Configuring threat intelligence sources and feeds
- Understanding automated investigation and response (AIR)
- Reviewing incident queues and triaging alerts
- Interpreting attack chain visualizations
- Using threat investigation reports to trace campaign origins
- Blocking malicious senders and domains at scale
- Creating custom detection rules with threat indicators
- Importing IOCs for proactive threat hunting
- Setting up real-time alerts for high-priority threats
- Integrating with SIEM via Microsoft 365 Defender API
- Using the Threat Explorer to identify attack patterns
- Reviewing indicators of compromise (IOCs) in email headers
- Analyzing suspicious URLs and file hashes
- Simulating phishing attacks with Attack Simulation Training
- Building custom phishing scenarios for user awareness
- Tracking user click rates and improving training programs
- Generating executive reports on threat readiness
Module 7: Collaboration Security in Teams, SharePoint, and OneDrive - Securing Microsoft Teams: external access and guest settings
- Managing org-wide and team-level privacy configurations
- Controlling guest access to Teams and channels
- Enabling and auditing external sharing in SharePoint Online
- Setting up sharing policies by group or sensitivity
- Requiring sign-in for shared links to OneDrive and SharePoint
- Blocking anonymous access to shared content
- Using access reviews to clean up stale permissions
- Scheduling regular reviews for guest accounts and sharing links
- Detecting overexposed files using sensitivity labels and audit logs
- Automatically applying labels to newly created files
- Configuring DLP policies for SharePoint and OneDrive
- Blocking or encrypting files containing credit card numbers, PII, etc
- Setting up alerts when sensitive data is shared externally
- Using the file policy tips in Office apps for real-time warnings
- Managing retention and deletion policies for Teams content
- Archiving and preserving Teams for compliance
- Auditing file access and sharing activities across platforms
Module 8: Advanced Security Configuration and Automation - Using PowerShell to automate security configurations
- Connecting to Exchange Online, Azure AD, and Security & Compliance
- Scripting bulk role assignments and policy deployments
- Exporting audit logs for third-party analysis
- Creating custom scripts for Secure Score improvement
- Enabling API access with service principals and app-only tokens
- Securing automation with certificate-based authentication
- Integrating with Azure Logic Apps for automated workflows
- Building playbooks for common threat scenarios
- Sending alerts to Microsoft Teams channels or Slack via connectors
- Automating response actions based on Defender incidents
- Scheduling recurring compliance checks with scripts
- Backups and configuration snapshots for disaster recovery
- Documenting and versioning security policies
- Using GitHub or Azure Repos for policy as code
- Integrating with CI/CD pipelines for governance as code
- Validating configurations before deployment
Module 9: Comprehensive Auditing, Logging, and Reporting - Understanding audit log retention periods and limits
- Searching audit logs for user, admin, and app activities
- Filtering logs by operation, user, severity, or date
- Exporting audit log data in standard formats
- Setting up alert policies for suspicious activities
- Creating custom alerts for bulk file deletions or downloads
- Detecting impossible travel and anomalous location access
- Monitoring administrative changes to RBAC or policies
- Tracking mailbox folder permission modifications
- Generating executive dashboards from audit data
- Using Power BI to visualise O365 security events
- Connecting Microsoft 365 logs to external SIEMs
- Formatting data for Splunk, QRadar, or ArcSight ingestion
- Mapping Office 365 events to MITRE ATT&CK framework
- Analysing lateral movement and persistence techniques
- Correlating email, identity, and endpoint logs for full context
- Producing audit-ready reports for regulators or internal review
Module 10: Real-World Implementation Projects - Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance
Module 11: Certification Preparation and Career Advancement - Review of key domains covered in the course
- Self-assessment quiz to test mastery of core concepts
- Hands-on simulation checklist for real-world readiness
- Preparing your Certificate of Completion portfolio
- Best practices for showcasing certification on LinkedIn and resumes
- Translating course skills into job interview talking points
- Positioning yourself for promotions or security specialist roles
- Using the certificate to support audit evidence packages
- Continuing your journey: recommended Microsoft certifications
- Microsoft SC-300, SC-400, and MS-500 alignment overview
- Building a personal cloud security lab for ongoing practice
- Joining security communities and staying current
- Accessing The Art of Service alumni resources
- Receiving job board alerts for security-focused roles
- Requesting a recommendation letter upon successful completion
- Connecting Office 365 to Microsoft Intune for device compliance
- Enforcing conditional access based on device compliance state
- Configuring compliance policies for mobile and desktop devices
- Integrating Azure AD Hybrid Join for on-prem to cloud identity
- Using device identity for access decisions in conditional access
- Managing app-based conditional access for mobile clients
- Implementing app protection policies (MAM) without device enrollment
- Securing data in Outlook, Teams, and OneDrive on unmanaged devices
- Wiping corporate data from lost or compromised devices remotely
- Auditing device compliance and access history
- Monitoring device risk with Microsoft Defender for Endpoint
- Enabling automatic remediation of non-compliant devices
- Using device trust levels in access policies
- Integrating third-party EDR solutions with O365 controls
- Building consistent enforcement across BYOD and corporate-owned fleets
Module 5: Data Protection and Information Governance - Overview of sensitivity labels and their role in classification
- Creating and publishing sensitivity labels in the Microsoft 365 compliance center
- Applying encryption to documents and emails via labels
- Configuring label policies for automatic or user-assigned classification
- Enforcing label use for specific departments or high-risk content
- Protecting data in Teams, SharePoint, and OneDrive with labels
- Using retention labels to manage data lifecycle
- Setting up retention policies for sites, mailboxes, and teams
- Preventing deletion with deletion prevention labels
- Implementing event-based retention for legal or compliance triggers
- Creating legal holds for investigations without user impact
- Using the Content Search tool to identify high-risk data
- Exporting search results securely for review
- Configuring eDiscovery cases for internal investigations
- Setting up communication compliance policies to detect policy violations
- Monitoring for harassment, discrimination, or data leakage in chats
- Using trainable classifiers to detect custom data types
Module 6: Threat Detection and Response with Microsoft Defender - Introduction to Microsoft Defender for Office 365 capabilities
- Differences between Plan 1 and Plan 2 features
- Configuring threat intelligence sources and feeds
- Understanding automated investigation and response (AIR)
- Reviewing incident queues and triaging alerts
- Interpreting attack chain visualizations
- Using threat investigation reports to trace campaign origins
- Blocking malicious senders and domains at scale
- Creating custom detection rules with threat indicators
- Importing IOCs for proactive threat hunting
- Setting up real-time alerts for high-priority threats
- Integrating with SIEM via Microsoft 365 Defender API
- Using the Threat Explorer to identify attack patterns
- Reviewing indicators of compromise (IOCs) in email headers
- Analyzing suspicious URLs and file hashes
- Simulating phishing attacks with Attack Simulation Training
- Building custom phishing scenarios for user awareness
- Tracking user click rates and improving training programs
- Generating executive reports on threat readiness
Module 7: Collaboration Security in Teams, SharePoint, and OneDrive - Securing Microsoft Teams: external access and guest settings
- Managing org-wide and team-level privacy configurations
- Controlling guest access to Teams and channels
- Enabling and auditing external sharing in SharePoint Online
- Setting up sharing policies by group or sensitivity
- Requiring sign-in for shared links to OneDrive and SharePoint
- Blocking anonymous access to shared content
- Using access reviews to clean up stale permissions
- Scheduling regular reviews for guest accounts and sharing links
- Detecting overexposed files using sensitivity labels and audit logs
- Automatically applying labels to newly created files
- Configuring DLP policies for SharePoint and OneDrive
- Blocking or encrypting files containing credit card numbers, PII, etc
- Setting up alerts when sensitive data is shared externally
- Using the file policy tips in Office apps for real-time warnings
- Managing retention and deletion policies for Teams content
- Archiving and preserving Teams for compliance
- Auditing file access and sharing activities across platforms
Module 8: Advanced Security Configuration and Automation - Using PowerShell to automate security configurations
- Connecting to Exchange Online, Azure AD, and Security & Compliance
- Scripting bulk role assignments and policy deployments
- Exporting audit logs for third-party analysis
- Creating custom scripts for Secure Score improvement
- Enabling API access with service principals and app-only tokens
- Securing automation with certificate-based authentication
- Integrating with Azure Logic Apps for automated workflows
- Building playbooks for common threat scenarios
- Sending alerts to Microsoft Teams channels or Slack via connectors
- Automating response actions based on Defender incidents
- Scheduling recurring compliance checks with scripts
- Backups and configuration snapshots for disaster recovery
- Documenting and versioning security policies
- Using GitHub or Azure Repos for policy as code
- Integrating with CI/CD pipelines for governance as code
- Validating configurations before deployment
Module 9: Comprehensive Auditing, Logging, and Reporting - Understanding audit log retention periods and limits
- Searching audit logs for user, admin, and app activities
- Filtering logs by operation, user, severity, or date
- Exporting audit log data in standard formats
- Setting up alert policies for suspicious activities
- Creating custom alerts for bulk file deletions or downloads
- Detecting impossible travel and anomalous location access
- Monitoring administrative changes to RBAC or policies
- Tracking mailbox folder permission modifications
- Generating executive dashboards from audit data
- Using Power BI to visualise O365 security events
- Connecting Microsoft 365 logs to external SIEMs
- Formatting data for Splunk, QRadar, or ArcSight ingestion
- Mapping Office 365 events to MITRE ATT&CK framework
- Analysing lateral movement and persistence techniques
- Correlating email, identity, and endpoint logs for full context
- Producing audit-ready reports for regulators or internal review
Module 10: Real-World Implementation Projects - Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance
Module 11: Certification Preparation and Career Advancement - Review of key domains covered in the course
- Self-assessment quiz to test mastery of core concepts
- Hands-on simulation checklist for real-world readiness
- Preparing your Certificate of Completion portfolio
- Best practices for showcasing certification on LinkedIn and resumes
- Translating course skills into job interview talking points
- Positioning yourself for promotions or security specialist roles
- Using the certificate to support audit evidence packages
- Continuing your journey: recommended Microsoft certifications
- Microsoft SC-300, SC-400, and MS-500 alignment overview
- Building a personal cloud security lab for ongoing practice
- Joining security communities and staying current
- Accessing The Art of Service alumni resources
- Receiving job board alerts for security-focused roles
- Requesting a recommendation letter upon successful completion
- Introduction to Microsoft Defender for Office 365 capabilities
- Differences between Plan 1 and Plan 2 features
- Configuring threat intelligence sources and feeds
- Understanding automated investigation and response (AIR)
- Reviewing incident queues and triaging alerts
- Interpreting attack chain visualizations
- Using threat investigation reports to trace campaign origins
- Blocking malicious senders and domains at scale
- Creating custom detection rules with threat indicators
- Importing IOCs for proactive threat hunting
- Setting up real-time alerts for high-priority threats
- Integrating with SIEM via Microsoft 365 Defender API
- Using the Threat Explorer to identify attack patterns
- Reviewing indicators of compromise (IOCs) in email headers
- Analyzing suspicious URLs and file hashes
- Simulating phishing attacks with Attack Simulation Training
- Building custom phishing scenarios for user awareness
- Tracking user click rates and improving training programs
- Generating executive reports on threat readiness
Module 7: Collaboration Security in Teams, SharePoint, and OneDrive - Securing Microsoft Teams: external access and guest settings
- Managing org-wide and team-level privacy configurations
- Controlling guest access to Teams and channels
- Enabling and auditing external sharing in SharePoint Online
- Setting up sharing policies by group or sensitivity
- Requiring sign-in for shared links to OneDrive and SharePoint
- Blocking anonymous access to shared content
- Using access reviews to clean up stale permissions
- Scheduling regular reviews for guest accounts and sharing links
- Detecting overexposed files using sensitivity labels and audit logs
- Automatically applying labels to newly created files
- Configuring DLP policies for SharePoint and OneDrive
- Blocking or encrypting files containing credit card numbers, PII, etc
- Setting up alerts when sensitive data is shared externally
- Using the file policy tips in Office apps for real-time warnings
- Managing retention and deletion policies for Teams content
- Archiving and preserving Teams for compliance
- Auditing file access and sharing activities across platforms
Module 8: Advanced Security Configuration and Automation - Using PowerShell to automate security configurations
- Connecting to Exchange Online, Azure AD, and Security & Compliance
- Scripting bulk role assignments and policy deployments
- Exporting audit logs for third-party analysis
- Creating custom scripts for Secure Score improvement
- Enabling API access with service principals and app-only tokens
- Securing automation with certificate-based authentication
- Integrating with Azure Logic Apps for automated workflows
- Building playbooks for common threat scenarios
- Sending alerts to Microsoft Teams channels or Slack via connectors
- Automating response actions based on Defender incidents
- Scheduling recurring compliance checks with scripts
- Backups and configuration snapshots for disaster recovery
- Documenting and versioning security policies
- Using GitHub or Azure Repos for policy as code
- Integrating with CI/CD pipelines for governance as code
- Validating configurations before deployment
Module 9: Comprehensive Auditing, Logging, and Reporting - Understanding audit log retention periods and limits
- Searching audit logs for user, admin, and app activities
- Filtering logs by operation, user, severity, or date
- Exporting audit log data in standard formats
- Setting up alert policies for suspicious activities
- Creating custom alerts for bulk file deletions or downloads
- Detecting impossible travel and anomalous location access
- Monitoring administrative changes to RBAC or policies
- Tracking mailbox folder permission modifications
- Generating executive dashboards from audit data
- Using Power BI to visualise O365 security events
- Connecting Microsoft 365 logs to external SIEMs
- Formatting data for Splunk, QRadar, or ArcSight ingestion
- Mapping Office 365 events to MITRE ATT&CK framework
- Analysing lateral movement and persistence techniques
- Correlating email, identity, and endpoint logs for full context
- Producing audit-ready reports for regulators or internal review
Module 10: Real-World Implementation Projects - Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance
Module 11: Certification Preparation and Career Advancement - Review of key domains covered in the course
- Self-assessment quiz to test mastery of core concepts
- Hands-on simulation checklist for real-world readiness
- Preparing your Certificate of Completion portfolio
- Best practices for showcasing certification on LinkedIn and resumes
- Translating course skills into job interview talking points
- Positioning yourself for promotions or security specialist roles
- Using the certificate to support audit evidence packages
- Continuing your journey: recommended Microsoft certifications
- Microsoft SC-300, SC-400, and MS-500 alignment overview
- Building a personal cloud security lab for ongoing practice
- Joining security communities and staying current
- Accessing The Art of Service alumni resources
- Receiving job board alerts for security-focused roles
- Requesting a recommendation letter upon successful completion
- Using PowerShell to automate security configurations
- Connecting to Exchange Online, Azure AD, and Security & Compliance
- Scripting bulk role assignments and policy deployments
- Exporting audit logs for third-party analysis
- Creating custom scripts for Secure Score improvement
- Enabling API access with service principals and app-only tokens
- Securing automation with certificate-based authentication
- Integrating with Azure Logic Apps for automated workflows
- Building playbooks for common threat scenarios
- Sending alerts to Microsoft Teams channels or Slack via connectors
- Automating response actions based on Defender incidents
- Scheduling recurring compliance checks with scripts
- Backups and configuration snapshots for disaster recovery
- Documenting and versioning security policies
- Using GitHub or Azure Repos for policy as code
- Integrating with CI/CD pipelines for governance as code
- Validating configurations before deployment
Module 9: Comprehensive Auditing, Logging, and Reporting - Understanding audit log retention periods and limits
- Searching audit logs for user, admin, and app activities
- Filtering logs by operation, user, severity, or date
- Exporting audit log data in standard formats
- Setting up alert policies for suspicious activities
- Creating custom alerts for bulk file deletions or downloads
- Detecting impossible travel and anomalous location access
- Monitoring administrative changes to RBAC or policies
- Tracking mailbox folder permission modifications
- Generating executive dashboards from audit data
- Using Power BI to visualise O365 security events
- Connecting Microsoft 365 logs to external SIEMs
- Formatting data for Splunk, QRadar, or ArcSight ingestion
- Mapping Office 365 events to MITRE ATT&CK framework
- Analysing lateral movement and persistence techniques
- Correlating email, identity, and endpoint logs for full context
- Producing audit-ready reports for regulators or internal review
Module 10: Real-World Implementation Projects - Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance
Module 11: Certification Preparation and Career Advancement - Review of key domains covered in the course
- Self-assessment quiz to test mastery of core concepts
- Hands-on simulation checklist for real-world readiness
- Preparing your Certificate of Completion portfolio
- Best practices for showcasing certification on LinkedIn and resumes
- Translating course skills into job interview talking points
- Positioning yourself for promotions or security specialist roles
- Using the certificate to support audit evidence packages
- Continuing your journey: recommended Microsoft certifications
- Microsoft SC-300, SC-400, and MS-500 alignment overview
- Building a personal cloud security lab for ongoing practice
- Joining security communities and staying current
- Accessing The Art of Service alumni resources
- Receiving job board alerts for security-focused roles
- Requesting a recommendation letter upon successful completion
- Project 1: Build a Zero Trust access model for finance team
- Define user groups, identify high-risk apps, and assign roles
- Create conditional access policies with MFA and device compliance
- Apply sensitivity labels to financial documents automatically
- Set up DLP to block unapproved sharing of financial data
- Configure audit alerts for data access anomalies
- Project 2: Remediate Secure Score gaps in 72 hours
- Download current Secure Score report and prioritise findings
- Implement top 5 high-impact fixes: MFA, CA policies, logging
- Document changes and re-evaluate score improvements
- Present results to IT leadership with before-and-after metrics
- Project 3: Respond to a simulated Business Email Compromise (BEC)
- Simulate a compromised executive mailbox
- Use audit logs to trace initial compromise vector
- Isolate account, revoke sessions, and reset credentials
- Scan for forwarded rules or mailbox delegates added
- Quarantine malicious emails sent from compromised account
- Generate incident report with timeline and remediation steps
- Project 4: Deploy end-to-end protection for a new project team
- Create a private Microsoft Team with strict membership
- Enable DLP and sensitivity labels for project documents
- Restrict external sharing and guest access
- Schedule access reviews every 30 days
- Set up retention and legal hold policies in advance