0:00–0:20
Labels lecture + mini-lab
0:20–0:35
Tenant tidy
0:35–1:40
Assessment
1:40–2:00
Debrief
0:00 – 0:20Labels · 20 min
Sensitivity labels — condensed lecture and hands-on setup
DLP protects data in transit. Sensitivity labels protect data at rest — the label travels with the file no matter where it goes.
- What sensitivity labels do — labels are metadata stamps applied to files and emails. Each label can: display a visual marking (watermark, header, footer), apply encryption (restricting who can open, edit, print, or forward the content), apply content marking in Office apps, and connect to DLP policies as an additional condition. A file labelled "Confidential — Finance" carries that designation into every workload, every device, and every sharing scenario.
- Label hierarchy — labels are organised as parent labels and sublabels. Example: parent = Confidential, sublabels = Finance, HR, Executive. Users see the parent/sublabel structure in Office apps. The more specific the sublabel, the more targeted the protection.
- Auto-labelling vs manual — labels can be applied manually by users (they see the label picker in Word, Excel, Outlook, Teams) or automatically by policies that detect content matching SITs or conditions (e.g. auto-apply "Confidential — Finance" to any file containing a credit card number). Auto-labelling policies require additional configuration and run in simulation mode first — covered in Week 8.
- Labels and DLP — DLP policies can use label conditions: "if a file is labelled Confidential — Finance AND is being emailed externally, block it." This creates a two-layer protection: the label marks the sensitivity, the DLP policy enforces the governance. Together they are more powerful than either alone.
Mini-lab — create two sensitivity labels before the assessment (15 min)
- Navigate to purview.microsoft.com → Information protection → Labels → + Create a label
- Label 1: Parent label — Confidential. No protection settings on the parent — it is a container only. Publish to all users.
- Label 2: Sublabel under Confidential — Finance. Settings: Content marking — add a header "CONFIDENTIAL — FINANCE ONLY". Encryption — Do not configure encryption now (Week 8 topic). Publish to all users.
- Publish both labels via a label policy: + Create label policy → name: LL — Label Policy → assign to all users → default label: None → users must justify downgrading a label.
- Labels take 24 hours to fully propagate to Office apps — students won't see them in Word today, but the structure will be visible in Purview and usable in assessment questions about label architecture.
Instructor note: Keep this section tight — 20 minutes total including the mini-lab. Sensitivity labels are introduced here as a concept and a basic configuration. The full label deployment (encryption, auto-labelling, Office app integration, SharePoint defaults) is Week 8's primary topic. The goal today is that students understand the label model well enough to answer assessment questions about how labels interact with DLP.
0:20 – 0:35Tenant tidy · 15 min
Pre-assessment self-audit
- Defender for M365 — LL — Safe Attachments and LL — Safe Links policies active in security.microsoft.com
- Anti-phishing — phishing threshold: Aggressive, three VIP users protected
- Defender for Endpoint — WIN-CLIENT-01 showing Onboarded in Assets → Devices
- Intune compliance — LL — Windows Baseline Compliance includes Defender risk level: Medium max
- DLP — LL — Financial Data Protection policy active, both SITs, all five workloads
- Sensitivity labels — Confidential and Confidential/Finance labels created and published
- Unified audit log enabled in Purview
Assessment boundary: At 0:35 no further configuration changes unless directed by the assessment. The instructor will pre-seed the incident conditions in the tenant before class — a phishing-originated external file share to be investigated in Section A.
0:35 – 1:40Assessment · 65 min
Week 7 assessment — the Lakeview Logistics security incident
A combined phishing + data exfiltration incident. Students investigate using Threat Explorer and DLP alerts, contain it, and recommend hardening.
| Section | What is assessed | Marks |
|---|
| Section A — Threat investigation | Using Threat Explorer, locate a specific suspicious email sent to Priya Nair. Determine: sender, delivery action, authentication results, detection technology, and whether it reached the inbox. Then investigate whether a Finance file was shared externally — use DLP alerts and SharePoint Manage access. | 25 pts |
| Section B — Containment | Recall the phishing email from all affected mailboxes using Threat Explorer. Revoke the external sharing link on the Finance file using SharePoint Manage access. Verify both containment actions succeeded. | 25 pts |
| Section C — Control gap analysis | Written: explain why the phishing email was not blocked by Safe Attachments or Safe Links, and why the file was not caught by DLP before it was shared. Identify the specific control gap in each case. | 25 pts |
| Section D — Hardening recommendation | Implement one control that would have prevented or detected either incident earlier. Options: apply a sensitivity label to the Finance file (and explain how a label-based DLP condition would have helped), tighten the anti-phishing policy (higher threshold or additional protected users), or configure a DLP rule that uses the Confidential/Finance label as a condition. Implement and document. | 25 pts |
Instructor note — pre-seed the incident: Before class: (1) Send an email from an external free-mail address to priya.nair@[studentsubdomain] with a subject like "Invoice Payment Required" and a link. This creates a phishing-pattern email in Threat Explorer. (2) In the Finance SharePoint site, upload a document called "Payroll-Q4.docx" and create an "Anyone with the link" sharing link — this is the external share students must find and revoke. Both actions take 5 minutes per student tenant. Section A requires navigating to Threat Explorer and SharePoint Manage access specifically — the correct path is the assessment of knowledge.
1:40 – 2:00Debrief · 20 min
Assessment debrief & Week 8 preview
- Walk Section A — show the Threat Explorer path (Filter: Recipient = Priya Nair, view = All email → find the message → click → Authentication results tab). This is the navigation that distinguishes students who know the tool from those who are searching blindly.
- Walk Section C — the phishing email control gap: if the email arrived without a malicious attachment or URL (just a request to call a number), Safe Attachments and Safe Links have nothing to detect. The gap is that social engineering via phone isn't covered by technical controls. The anti-phishing impersonation detection would only help if the sender was spoofing a known VIP.
- Ask: "Looking at the full seven-week security stack — email, device, identity, simulation, DLP, labels — what single addition would most improve Lakeview Logistics's security posture?" — open synthesis, prime Week 8 (Purview compliance — retention, eDiscovery, audit — is the governance layer that makes security work long-term)
- Week 8 preview: Compliance and governance — Microsoft Purview eDiscovery, retention policies (legal holds, automatic deletion), compliance scores, audit log analysis, and GDPR data subject requests. Everything built in Weeks 1–7 needs to be governed and auditable. Week 8 is the capstone that ties governance to law.
Assessment rubric — marking guidance
| Criterion | Full marks | Partial | No marks |
|---|
| Section A | Both the phishing email (via Threat Explorer) and the external share (via SharePoint Manage access + DLP alerts) correctly identified with all required metadata fields recorded | One found correctly, one not found or wrong path used | Neither found |
| Section B | Email recalled from all affected mailboxes via Threat Explorer, external sharing link revoked in SharePoint, both verified as closed | One contained and verified, one not attempted or not verified | Neither contained |
| Section C | Precise explanation of why Safe Attachments/Links didn't help (no attachment/URL to detect), and why DLP didn't catch the share (label-based condition absent, or share happened before DLP propagated) — technically accurate | Gap identified but explanation imprecise or confuses the controls | Gap not identified or explanation fundamentally wrong |
| Section D | Appropriate control chosen, correctly implemented in tenant, clear reasoning for why it addresses the specific gap — implementation verified | Control chosen but not implemented, or reasoning doesn't address the gap | Control not chosen or not relevant |
Learning outcomes — by end of Week 7, students can…
Investigate email threatsUse Threat Explorer to locate, analyse, and recall suspicious emails
Configure email defencesDeploy Safe Attachments, Safe Links, and anti-phishing impersonation policies
Onboard to EDRUse Intune to deploy Defender for Endpoint and wire risk levels to compliance
Run attack simulationsLaunch and interpret credential harvest simulations and training campaigns
Deploy DLP policiesCreate cross-workload DLP policies with SITs, rules, and endpoint restrictions
Describe sensitivity labelsExplain the label hierarchy model and how labels interact with DLP conditions