Microsoft 365 Mobility and Security (Exam MS-101)

Understand how the threat landscape has evolved with mobile access and shadow IT, and protect data across employees, partners, and customers on unmanaged devices beyond traditional boundaries.

Learn how spoofing exploits the SMTP protocol, where messages carry a 5321.mailfrom return address and a 5322.from address visible to users, creating trusted-looking messages that can mislead employees.

Protect organizations against spam and malware by understanding how spam reduces productivity and how malware delivers payloads, deletes information, and may encrypt information or grant remote access.

Learn how an account breach in Office 365, including Exchange Online, OneDrive, and SharePoint, enables credential access and privilege escalation to global admins, creating parallel attack paths.

Examine how compromised accounts trigger data exfiltration, deletion, and spillage across SharePoint, OneDrive, email, and Teams. Understand how attackers bypass protections, deploy ransomware, and cause accidental exposure through downloads.

Explore how Microsoft 365's secure score measures your security posture, compares your score with organizations of the same size, and guides improvements via a dashboard and a secure score API.

Understand how to improve your Microsoft 365 security posture using Secure Score improvement actions and prioritize changes over 30 to 90 days, including multi-factor authentication for privileged roles.

Discover how privileged identity management enables just-in-time admin access in Azure Active Directory, with elevation, MFA, activity tracking, alerts, and access reviews tied to a premium plan requirement.

Learn how privileged access management layers on top of privileged identity management to enforce just enough access with elevation approvals, scope policies, and an exchange-based workflow.

Azure Identity Protection monitors sign-ins across Azure Active Directory for cloud-based Microsoft 365 apps, flags risky sign-ins from unusual locations or devices, and enforces automated responses and conditional access.

Activate Azure Identity Protection in the portal by creating the AD Identity Protection resource for your tenant, then pin it to your hub for quick access near Azure Active Directory.

Configure Azure Identity Protection to enforce sign-in risk and user risk policies, applying to all or selected users, with block or multi-factor authentication and password writeback for dark web credentials.

Configure alerts for Azure Identity Protection and investigate risk events to drill into flagged users, resolve sign-in issues, and address vulnerabilities such as users without MFA registration.

Exclude certain users from Azure Identity Protection sign-in risks, to avoid false positives when multi-factor authentication is unavailable, using observation mode and adjusting thresholds from high to medium as needed.

Utilize Exchange Online Protection to filter mail via reputation checks, multiple scanners, and heuristic clustering. Extend security with ATP’s safe attachments and safe links checks.

Learn how Zero Hour Auto Purge detects previously undetected spam and malware in Exchange Online, moving unopened messages to junk and stripping malicious attachments, extending protection after delivery.

Learn to protect your organization from spoofing and phishing with Exchange Online, using SPF, DKIM, and DMARC authentication, plus Spoof Intelligence to approve or block spoofers.

Configure Exchange Online anti-spam filters in the Exchange admin center, create separate spam and high-confidence spam policies, apply them to users or groups, and enable quarantine notifications.

Set up Exchange malware policies by editing the default or creating a policy, enable quarantine with admin release, customize notifications, and apply to specific users or groups.

Create a safe attachment policy with Advanced Threat Protection in Security and Compliance Center, enabling safe attachments for Exchange Online, SharePoint, OneDrive, and Teams, with Dynamic Delivery as default.

Create a mail transport rule in the Exchange Admin Center to bypass safe attachments for internal senders by setting the X-MS-Exchange-Org-Skip-Safe-Attachment-Processing header.

Modify the default organization-wide safe links policy, create additional policies, blacklist or whitelist URLs, and assign safe links to specific groups or individuals for real-world time URL scanning.

Create a mail transport rule in the Exchange admin center to bypass Safe Links for emails within the organization. Set the header X-MS-Exchange-Organization-SkipSafeLinksProcessing to disable Safe Links processing.

Monitor exchange online protection and security center reports to view spoof detections, top senders, and spam detections, and set up scheduled weekly or monthly reports with view details.

Discover the Microsoft Intelligent Security Graph, which ingests billions of data points, applies machine learning to automate responses, and reveals attack trends to protect your organization.

Explore the Microsoft 365 security dashboard to monitor global threat trends, malware detections, and threat intelligence, drill down into incidents, and educate users against email threats.

Explore the Threat Explorer in the security compliance center to view malware activity, drill down by family and delivery origin, and inspect targeted users, logins, and region-based filters.

Protect on-premises authentication with Microsoft Advanced Threat Analytics, leveraging cloud-based machine learning to detect malicious, abnormal, and security-risk activities across the cyber-attack kill chain.

Configure advanced threat analytics on premises by installing the ATA Center, meeting prerequisites like Server 2012 R2 and .NET 4.6.1+. Install and configure the gateway based on server location.

Explore ATA role management with administrator, user, and viewer permissions, and how to handle local versus domain groups, move the ATA center, and back up, migrate, and restore MongoDB configuration.

Discover how cloud app security helps monitor app usage, protect data, and enforce policy with cloud discovery, connectors, and conditional access for sanctioned and unsanctioned apps.

Configure cloud app security to enable cloud discovery, upload log files from on-premises systems in an automated way, connect Office 365 and other apps, and customize alerts and reports.

Learn to control cloud apps with policies, using templates to monitor malware, enable data loss prevention, content inspection, and governance actions in SharePoint.

Explore discovered apps by evaluating their trustworthiness scores and compliance, tagging unsanctioned apps, generating a cloud discovery executive report, and creating firewall block scripts to enforce policy.

Review and manage alerts in cloud app security by opening, investigating exposures, and marking them as open, resolved, ignored, or dismissed; deleted alerts cannot be recovered.

Enable in-place archiving in Microsoft 365 to provide an online archive mailbox in Outlook; move mail between primary and archive to relieve quotas, though archives are not cached offline.

activate in-place archive for users from the security and compliance center or the exchange admin center, and note that disabling for 31 days creates a new empty archive.

Explore in-place records management in SharePoint to convert documents to records for long-term retention. Learn automated and manual declaration, keeping records in place or moving them to a record center.

Activate in-place records management at the site collection level in SharePoint, configure site-wide and library record declaration settings to declare items as records, and prevent edits and deletion by others.

Explore messaging records management in Exchange Online, using retention policies to auto-archive or delete mail by time and location, with default, policy, and personal tags.

Create retention tags in the Exchange admin center, including default, policy, and personal tags. Build a sample retention policy and apply it to users, enabling archive moves and controlled deletions.

Troubleshoot non-running mrm policies by inspecting the managed folder assistant schedule, policy tags, and legal holds; for small mailboxes, force a manual run via PowerShell to test changes.

Apply information rights management in Exchange to control what recipients can do with email, forward, modify, or print, with automatic and manual policies in Outlook and Outlook on the Web.

Turn on tenant IRM and rely on Azure RMS to encrypt SharePoint library documents, even after download. Set viewing, printing, and seven-day expiry to control use.

Discover how Exchange Online enables sending encrypted messages to internal and external recipients with Office Message Encryption, rights management services, built-in certificates, and one-time passcodes.

Explore how to use role-based access control in Microsoft 365 by selecting, editing, and creating roles in the Security and Compliance Center, and assign them to users to manage permissions.

Master GDPR compliance in Microsoft 365 by using the compliance center to run assessments, enforce retention, and fulfill data subject requests with e-discovery and content search exports.

Build an ethical wall in Exchange Online using a mail transport rule to block or forward for approval email between brokers and marketing groups, with an arbiter to review exceptions.

Apply retention policies to preserve or delete data across SharePoint, OneDrive, mail, and Teams, using preservation holds, recoverable items, and inclusion or exclusion rules to meet compliance.

Create and configure retention policies in the security and compliance center, choosing keep or delete rules, start counting, locations, and optional advanced criteria like words or GDPR.

Apply data loss prevention across the Microsoft 365 environment to protect sensitive information in OneDrive for Business, SharePoint, and Teams by detecting patterns, context, and rules, with blocking and notifications.

Troubleshoot policy tips by verifying Outlook settings, adjusting the sensitive data threshold, enabling notifications, and ensuring the full Office suite is installed for tips in Outlook, Word, Excel, and PowerPoint.

Learn how Azure Information Protection guards documents and emails in the cloud and on premises using unified labels, auto or manual, with the protection client and RMS connector.

Plan Azure information protection by exploring four subscription levels: free, Office 365 encryption, P1 labeling, and P2 classification, activate when needed, create labels in Azure, deploy client, and train users.

Enable the Aadrm Super User feature with the Azure RMS PowerShell module to access all protected content. Add users or groups, then protect or decrypt documents in bulk with Protect-RMSFile.

Choose encryption key management for Azure information protection; Microsoft managed key, bring your own key, or hold your own key, with Azure key vault controlling access and key rollover.

Create and apply Azure Information Protection labels in the portal to encrypt documents, set permissions and markings, and distribute labels via global and custom policies to groups such as brokers.

Protect corporate data on personal devices with Windows Information Protection, distinguishing corporate from personal data, encrypting corporate data, and remotely wiping only corporate data when devices are lost or untrusted.

Plan and enforce Windows information protection by ensuring devices run Windows 10 version 1607 or later, enrolling in MDM or MAM, and designating trusted apps, networks, and enterprise data protection.

Set up Windows information protection in the Azure portal with Intune app protection policies for Windows 10 devices enrolled in MDM, to block copy-paste of work product.

Explore content search in Microsoft 365, enabling scalable searches across emails, documents, and instant messaging without eDiscovery limits, accessible to eDiscovery managers in the Security and Compliance Center.

Learn to create and run content searches in the Security and Compliance Center as a discovery manager, select locations, enter keywords, preview results, and export reports or data.

Identify data custodians, apply preservation holds, and index, search, review, and export custodial and noncustodial data to support advanced e-discovery and litigation responses.

Audit across your Microsoft 365 environment tracks user activity in Teams, SharePoint, and OneDrive via the Security and Compliance Center, with 90-day retention and logs managed in Exchange Online.

Explore audit logs in the security and compliance center, filtering by date range up to 90 days and IP, and export results up to 50,000 with per-page paging.

Configure an audit policy in SharePoint Online to track edits, check-outs, adds, and deletes across document types by using site content types and enabling auditing in site collection administration.

Plan for device management by adopting modern management with Azure Active Directory, Intune, and co-management with Configuration Manager to enable cloud-based control alongside on-premises resources.

Discover co-management prerequisites: synchronize on-premises AD with Azure AD via Azure AD Connect, ensure SCCM 1709 or newer, and join devices to both ADs and manage them with Intune.

Explore enabling co-management by linking on-premise Configuration Manager with cloud Intune, configuring automatic enrollment, workload distribution, and GPO vs MDM policy precedence in a hybrid environment.

Decide where to manage workloads between on premises System Center Configuration Manager and Intune cloud, aligning compliance, resource access, updates, endpoint protection, device configurations, and Intune managed apps.

Explore how the Microsoft Store for Business delivers a private store to acquire and distribute packaged apps to Windows 10 devices, with corporate ID access and automatic updates.

Configure the Microsoft Store for Business by meeting prerequisites—internet connectivity, Windows 10 devices, Windows Update service, and Azure Active Directory—sign in as a global administrator to activate the private store.

Explore how to manage the Microsoft Store for Business, including setting permissions, assigning admin or purchaser roles, purchasing and distributing apps, and reclaiming licenses for efficient tenant management.

Explore mobile application management to configure and enforce app-level policies across Windows 10, Android, and iOS devices without device enrollment, protecting corporate data with app protection policies.

Configure mobile application management in Azure Active Directory using Microsoft Intune for the finance group, set terms of service and compliance URL, and enforce policies.

Enable single sign-on for SaaS apps with Azure Active Directory by adding apps from the app catalog, then assign access to users and sign in via the my apps panel.