https://royexplains.com/how-tos/classification-policy/ https://royexplains.com/wp-content/uploads/2026/10/classification-policy.jpg Start with an information classification policy Before anyone opens the portal, agree on what you're protecting. We build a simple policy: four labels, what each one is for, and what should happen when content is shared. It sounds like paperwork. But every video after this one turns a column of that table into a setting in Purview. https://royexplains.com/wp-content/uploads/2026/10/classification-policy.mp4 43 2026-10-15T07:28:05+02:00 yes no https://royexplains.com/how-tos/sensitivity-labels-admin/ https://royexplains.com/wp-content/uploads/2026/10/sensitivity-labels-admin.jpg Create and publish sensitivity labels The policy becomes four labels. Strictly Confidential gets a header, a watermark and encryption, and a label policy makes labeling mandatory. Then Eli opens Word, and the labels are waiting for him. https://royexplains.com/wp-content/uploads/2026/10/sensitivity-labels-admin.mp4 64 2026-10-15T07:28:07+02:00 yes no https://royexplains.com/how-tos/label-priority/ https://royexplains.com/wp-content/uploads/2026/10/label-priority.jpg Sensitivity label priority The order of your labels isn't cosmetic. It's their priority. It decides what counts as lowering a label, which label an email inherits from its attachments, which label auto-labeling picks, and when a site raises a mismatch alert. We fix a label that has ended up in the wrong place, and see what Eli notices. https://royexplains.com/wp-content/uploads/2026/10/label-priority.mp4 79 2026-10-15T18:43:06+02:00 yes no https://royexplains.com/how-tos/custom-sit/ https://royexplains.com/wp-content/uploads/2026/10/custom-sit.jpg Build a custom sensitive info type The built-in types recognize card and identity numbers, but not your projects. We build Restricted projects, a sensitive info type with one pattern: a keyword list with the code names of three projects that must not be shared outside the organization. We name it for the admins, set the confidence level, find it with the Publisher filter and test it with a file. Then we look at where it can be used: DLP, eDiscovery and auto-labeling. https://royexplains.com/wp-content/uploads/2026/10/custom-sit.mp4 173 2026-10-16T22:32:34+02:00 yes no https://royexplains.com/how-tos/auto-labeling/ https://royexplains.com/wp-content/uploads/2026/10/auto-labeling.jpg Auto-labeling: let Purview apply the label Client-side, the user applies the label in the Office apps, helped by a default label or a recommendation. Server-side, an auto-labeling policy labels files already stored in SharePoint and OneDrive, based on conditions such as sensitive info types. We create a policy that gives every document with national identification numbers at least Confidential, let it replace lower labels, check the required simulation and turn it on. Two files are labeled, and a Strictly Confidential file keeps its higher label. https://royexplains.com/wp-content/uploads/2026/10/auto-labeling.mp4 197 2026-10-21T18:11:09+02:00 yes no https://royexplains.com/how-tos/dlp-exchange/ https://royexplains.com/wp-content/uploads/2026/10/dlp-exchange.jpg Labeled email and DLP Labels on their own stop nothing. We start the ring with email, where most information leaves the organization. Three rules: a policy tip for Internal, a business justification for Confidential, and a block for Strictly Confidential. https://royexplains.com/wp-content/uploads/2026/10/dlp-exchange.mp4 143 2026-10-15T07:28:10+02:00 yes no https://royexplains.com/how-tos/dlp-spo/ https://royexplains.com/wp-content/uploads/2026/10/dlp-spo.jpg Sharing labeled files and DLP Email is covered, so Eli shares a link instead. The same rules follow him to SharePoint and OneDrive, and that includes files shared in Teams, because that's where they're stored. https://royexplains.com/wp-content/uploads/2026/10/dlp-spo.mp4 150 2026-10-15T07:28:13+02:00 yes no https://royexplains.com/how-tos/dlp-endpoint/ https://royexplains.com/wp-content/uploads/2026/10/dlp-endpoint.jpg Endpoint DLP: labeled files on devices Some files never touch email or SharePoint. Endpoint DLP closes the gap on the device itself: copying to USB and uploading to private cloud services. It needs E5, A5, E7 or Purview Suite, and a few prerequisites, which we go through first. https://royexplains.com/wp-content/uploads/2026/10/dlp-endpoint.mp4 134 2026-10-15T07:28:16+02:00 yes no https://royexplains.com/how-tos/dlp-sit/ https://royexplains.com/wp-content/uploads/2026/10/dlp-sit.jpg DLP for sensitive information Labels only help when someone applies them. Sensitive information types look at the content itself. We keep it friendly: an IP address in an email gets a policy tip, not a block. That tip teaches more than a yearly security course. https://royexplains.com/wp-content/uploads/2026/10/dlp-sit.mp4 77 2026-10-15T07:28:18+02:00 yes no https://royexplains.com/how-tos/dlp-policy-priority/ https://royexplains.com/wp-content/uploads/2026/10/dlp-policy-priority.jpg DLP policy priority With a few policies in place, one email can match several of them. Many expect the policy at the top to win. It doesn't: the most restrictive action does. We look at policy order, rule order, the one option that does stop evaluation, and what Eli sees when two policies match. https://royexplains.com/wp-content/uploads/2026/10/dlp-policy-priority.mp4 91 2026-10-15T18:46:01+02:00 yes no https://royexplains.com/how-tos/living-with-encryption/ https://royexplains.com/wp-content/uploads/2026/10/living-with-encryption.jpg Living with encryption Encryption follows the content, which is great for protection and changes how people work. We open a Strictly Confidential file in Word, on iPhone and as a PDF, and watch a partner fail to sign in. This is why DLP stands in front, and encryption is the last line of defense. https://royexplains.com/wp-content/uploads/2026/10/living-with-encryption.mp4 70 2026-10-15T07:28:26+02:00 yes no https://royexplains.com/how-tos/strictly-confidential-in-email/ https://royexplains.com/wp-content/uploads/2026/10/encrypted-email.jpg Strictly Confidential in email Strictly Confidential gives everyone in the organization full rights, so colleagues read, reply and forward without noticing. A labeled attachment labels the email, DLP stops it on the way out, and if the file escapes anyway, a partner can't sign in to open it. https://royexplains.com/wp-content/uploads/2026/10/encrypted-email.mp4 121 2026-10-15T13:10:13+02:00 yes no https://royexplains.com/how-tos/export-to-pdf-2/ https://royexplains.com/wp-content/uploads/2026/10/export-to-pdf.jpg Export to PDF keeps the label Eli needs the board minutes as a PDF. Print to PDF warns him off, while File, Export keeps both the label and the encryption. Then we check who can actually open the PDF, and whether DLP still notices it. Spoiler: Edge and Acrobat can, Chrome can't, and DLP does. https://royexplains.com/wp-content/uploads/2026/10/export-to-pdf.mp4 89 2026-10-15T14:50:49+02:00 yes no https://royexplains.com/how-tos/site-label-library-label-file-label/ https://royexplains.com/wp-content/uploads/2026/10/site-labels.jpg Site label, library label, file label Put a label on a SharePoint site and many expect every file in it to be encrypted. It isn't. The site label controls who gets in and how content is shared, a library label gives new files a label, and only the file label protects the content itself. We lock down the Board site and see what Eli notices. https://royexplains.com/wp-content/uploads/2026/10/site-labels.mp4 101 2026-10-15T17:38:05+02:00 yes no https://royexplains.com/how-tos/restrict-a-site-to-compliant-devices/ https://royexplains.com/wp-content/uploads/2026/10/site-compliant-devices.jpg Restrict a site to compliant devices With a label on the Board site, we can ask for more than a valid sign-in. An authentication context connects the label to a Conditional Access policy that requires a compliant device. Three parts have to fit together. Eli tries both his work PC and his private PC. https://royexplains.com/wp-content/uploads/2026/10/site-compliant-devices.mp4 124 2026-10-15T17:40:13+02:00 yes no https://royexplains.com/how-tos/aud-unified-audit-log/ https://royexplains.com/wp-content/uploads/2026/10/aud-unified-audit-log.jpg The unified audit log When something has happened, the first question is who did what, and when. We look at how Exchange, SharePoint, OneDrive, Teams, Entra ID, Purview and Copilot feed the unified audit log, what's logged elsewhere, like Entra sign-in logs and Entra ID Protection, how long each license keeps the records, and the three ways to get them out. https://royexplains.com/wp-content/uploads/2026/10/aud-unified-audit-log.mp4 117 2026-10-16T17:51:17+02:00 yes no https://royexplains.com/how-tos/aud-search/ https://royexplains.com/wp-content/uploads/2026/10/aud-search.jpg Search the audit log A search in Audit is a job that runs in the background, in UTC. We find who deleted the customer list and an inbox rule created from an unknown IP address at night, and open the full record. Then we look at searches every investigator should know, how to export and preserve the results, and when Activity explorer is enough. https://royexplains.com/wp-content/uploads/2026/10/aud-search.mp4 153 2026-10-16T17:51:21+02:00 yes no https://royexplains.com/how-tos/activity-explorer/ https://royexplains.com/wp-content/uploads/2026/10/activity-explorer.jpg Follow up with Activity explorer Time to follow up. Labels and four DLP policies are live, but are they doing what you intended? Every policy writes to the unified audit log, and Activity explorer is the quickest way to check. We filter on DLP rule matches, read a business justification, and catch a label that was lowered. https://royexplains.com/wp-content/uploads/2026/10/activity-explorer.mp4 57 2026-10-15T07:28:21+02:00 yes no https://royexplains.com/how-tos/data-explorer/ https://royexplains.com/wp-content/uploads/2026/10/data-explorer.jpg Know your data with Data explorer The second half of the follow-up. Activity explorer shows what happens, Data explorer shows what you have and where it lives. We build a view for the security team, compare sensitive information types across workloads, and drill down to a single email. A good moment to decide who should see insight like this. https://royexplains.com/wp-content/uploads/2026/10/data-explorer.mp4 73 2026-10-15T07:28:23+02:00 yes no https://royexplains.com/how-tos/edisc-stale-data/ https://royexplains.com/wp-content/uploads/2026/10/edisc-stale-data.jpg Find stale data Old data costs storage and backup, carries risk, and Copilot can still find it. We create one eDiscovery case with two searches, one for SharePoint and OneDrive sites and one for Exchange mailboxes, both with a date before 2020. The statistics show how much is old and which sensitive information types it contains, and the top 100 report becomes a cleanup list, split between shared sites for site owners and OneDrive and mailboxes for each user. https://royexplains.com/wp-content/uploads/2026/10/edisc-stale-data.mp4 194 2026-10-16T22:10:56+02:00 yes no https://royexplains.com/how-tos/edisc-sensitive-data/ https://royexplains.com/wp-content/uploads/2026/10/edisc-sensitive-data.jpg Find sensitive data Data explorer counts sensitive data. eDiscovery shows where it is, and lets you combine it with age. In a separate case with eDiscovery (Premium), we search all SharePoint and OneDrive sites for IP addresses, read the statistics and the top 100, do the same for mailboxes, and narrow it down to what is both sensitive and older than 2020. And regex? That belongs in a custom sensitive information type. https://royexplains.com/wp-content/uploads/2026/10/edisc-sensitive-data.mp4 190 2026-10-16T22:11:00+02:00 yes no https://royexplains.com/how-tos/irm-what-is-insider-risk/ https://royexplains.com/wp-content/uploads/2026/10/irm-what-is-insider-risk.jpg What is insider risk? An insider already has the keys, so firewalls and sign-in controls don't help. We look at the indicators that give insider risk away, why a sequence says more than a single action, and how Insider Risk Management connects signals from identity, devices, data and apps. Then Ronny, on his way out, tries to take the customer list with him. https://royexplains.com/wp-content/uploads/2026/10/irm-what-is-insider-risk.mp4 89 2026-10-16T17:58:19+02:00 yes no https://royexplains.com/how-tos/irm-privacy/ https://royexplains.com/wp-content/uploads/2026/10/irm-privacy.jpg Before you turn it on: privacy Microsoft 365 already logs what people do, and Insider Risk Management goes further: it scores each user automatically. Both layers need a legal basis and the risk assessments your national law requires, in the EU and EEA a DPIA under GDPR. We look at the pseudonymization setting, why it's easy to work out who is behind a pseudonym, and what Eli actually notices. https://royexplains.com/wp-content/uploads/2026/10/irm-privacy.mp4 94 2026-10-16T17:58:23+02:00 yes no https://royexplains.com/how-tos/irm-prepare/ https://royexplains.com/wp-content/uploads/2026/10/irm-prepare.jpg Prepare Insider Risk Management Most of the work happens before you create anything. We assign role groups, and look at the one that has it all, run analytics for a baseline, go through the prerequisites for each template, and turn on the indicators, which are all off by default. https://royexplains.com/wp-content/uploads/2026/10/irm-prepare.mp4 110 2026-10-16T17:58:27+02:00 yes no https://royexplains.com/how-tos/irm-first-policy/ https://royexplains.com/wp-content/uploads/2026/10/irm-first-policy.jpg Create the first policy We build a Data leaks policy for all users, step by step through the wizard: the template, priority content, an exfiltration activity as the triggering event, indicators and sequences, and thresholds based on your users' activity. No HR connector needed. Then we see how far back the policy looks when Ronny emails the customer list. https://royexplains.com/wp-content/uploads/2026/10/irm-first-policy.mp4 129 2026-10-16T17:58:30+02:00 yes no https://royexplains.com/how-tos/irm-alert-to-case/ https://royexplains.com/wp-content/uploads/2026/10/irm-alert-to-case.jpg Handle an alert About a day later, the first alert arrives. We follow the analyst through triage: the alert in Needs review, the risk factors behind the score, the timeline around the triggering event, and the decision to confirm the alert and open a case. https://royexplains.com/wp-content/uploads/2026/10/irm-alert-to-case.mp4 95 2026-10-16T17:58:34+02:00 yes no https://royexplains.com/how-tos/irm-investigate-act/ https://royexplains.com/wp-content/uploads/2026/10/irm-investigate-act.jpg Handle a case The case is open. The investigator looks at the actual files in Content explorer, writes down the findings, sends Ronny a notice and resolves the case. We also look at when to escalate to eDiscovery, and what Ronny sees of it all. https://royexplains.com/wp-content/uploads/2026/10/irm-investigate-act.mp4 119 2026-10-16T17:58:39+02:00 yes no https://royexplains.com/how-tos/irm-adaptive-protection/ https://royexplains.com/wp-content/uploads/2026/10/irm-adaptive-protection.jpg Adaptive Protection The DLP ring treats everyone the same. Adaptive Protection lets Insider Risk Management give users a risk level, Elevated, Moderate or Minor, and DLP, Conditional Access and Data Lifecycle Management act on it. We turn it on with quick setup, look at the levels, and see Ronny blocked from copying a file to USB while Eli is not. https://royexplains.com/wp-content/uploads/2026/10/irm-adaptive-protection.mp4 109 2026-10-16T17:58:43+02:00 yes no https://royexplains.com/how-tos/irm-scenario-departing/ https://royexplains.com/wp-content/uploads/2026/10/irm-scenario-departing.jpg Scenario: Ronny leaves with the customer list Ronny has handed in his notice and wants to take the customer list with him. We follow him from the first download to his last day: what the audit log keeps, where DLP steps in, when IRM starts scoring, how Adaptive Protection tightens DLP for Ronny alone before his next three attempts, and how people make the final call. There is no portal in this one, just the story. https://royexplains.com/wp-content/uploads/2026/10/irm-scenario-departing.mp4 150 2026-10-16T17:58:47+02:00 yes no https://royexplains.com/how-tos/ir-responding-to-a-breach/ https://royexplains.com/wp-content/uploads/2026/10/ir-responding-to-a-breach.jpg Responding to a breach in Microsoft 365 A customer asks about Eli's new bank details, and Eli never sent that invoice. We go through the order of a response: lock the attacker out, export the logs that expire first, find the way in with Microsoft Entra, see what happened inside with Purview, work out who and what was affected, and check which reporting duties apply. The logs run on different clocks, so the order matters. https://royexplains.com/wp-content/uploads/2026/10/ir-responding-to-a-breach.mp4 170 2026-10-18T21:49:21+02:00 yes no https://royexplains.com/how-tos/ir-preserve-the-audit-log/ https://royexplains.com/wp-content/uploads/2026/10/ir-preserve-the-audit-log.jpg Preserve the audit log The audit log keeps 180 days with Audit Standard. An export keeps the evidence for as long as the case needs it. We use export_ual from GitHub with the Graph Audit Search API: what you need first, signing in with MFA, and an export of every record for Eli in the incident window. Then we look at the five files, the manifest that documents the export, verify the hashes, and find the inbox rule in the timeline. https://royexplains.com/wp-content/uploads/2026/10/ir-preserve-the-audit-log.mp4 157 2026-10-18T21:49:27+02:00 yes no https://royexplains.com/how-tos/ir-dsi-breached-mailbox/ https://royexplains.com/wp-content/uploads/2026/10/ir-dsi-breached-mailbox.jpg Investigate a breached mailbox with DSI The attacker had Eli's mailbox for hours. What did it contain? We set up Data Security Investigations with pay-as-you-go billing, start from the breached mailbox template and bring 2,732 items into the investigation. AI sorts them into categories, we narrow down to 57, and an examination gives each item a risk score, a summary and suggested next steps. It is AI-generated, so we check each one against the actual items. https://royexplains.com/wp-content/uploads/2026/10/ir-dsi-breached-mailbox.mp4 138 2026-10-18T21:49:33+02:00 yes no https://royexplains.com/how-tos/ir-findings-to-action/ https://royexplains.com/wp-content/uploads/2026/10/ir-findings-to-action.jpg From findings to action The findings decide whether to notify, and what to clean up. We add them to a mitigation list that finance and customer service can use, find the phishing email and put it in the purge queue. Before we run the purge, we look at what it can and cannot do. Then we read the history in Activities, keep the evidence and delete the investigation to stop the storage costs. https://royexplains.com/wp-content/uploads/2026/10/ir-findings-to-action.mp4 138 2026-10-18T21:49:39+02:00 yes no https://royexplains.com/how-tos/cm-what-is-compliance-manager/ https://royexplains.com/wp-content/uploads/2026/10/cm-what-is-compliance-manager.jpg What is Compliance Manager? How a standard becomes controls and improvement actions, what Microsoft has already done, how points are set, and why compliance score is not Secure Score. https://royexplains.com/wp-content/uploads/2026/10/cm-what-is-compliance-manager.mp4 203 2026-10-18T09:26:17+02:00 yes no https://royexplains.com/how-tos/cm-put-a-regulation-to-work/ https://royexplains.com/wp-content/uploads/2026/10/cm-put-a-regulation-to-work.jpg Put a regulation to work Choose premium regulations carefully, add ISO/IEC 27001:2022, find the Logging control, implement an action with evidence and let an assessor set Passed. https://royexplains.com/wp-content/uploads/2026/10/cm-put-a-regulation-to-work.mp4 217 2026-10-18T09:26:21+02:00 yes no https://royexplains.com/how-tos/cm-update-actions-in-bulk/ https://royexplains.com/wp-content/uploads/2026/10/cm-update-actions-in-bulk.jpg Update improvement actions in bulk Export actions, read the How To tab, keep only the rows you update, fill in status and dates, and check the score change before you confirm. https://royexplains.com/wp-content/uploads/2026/10/cm-update-actions-in-bulk.mp4 143 2026-10-18T09:26:26+02:00 yes no https://royexplains.com/how-tos/cm-regulation-from-pdf/ https://royexplains.com/wp-content/uploads/2026/10/cm-regulation-from-pdf.jpg A regulation from national law The Norwegian Digital Security Regulations as a PDF: AI extracts controls and maps existing actions. Check the draft, fill the gaps and publish. https://royexplains.com/wp-content/uploads/2026/10/cm-regulation-from-pdf.mp4 159 2026-10-18T09:26:31+02:00 yes no https://royexplains.com/how-tos/dspm-what-is-dspm/ https://royexplains.com/wp-content/uploads/2026/10/dspm-what-is-dspm.jpg What is DSPM? People and agents create and share data every day, and many tools give many partial answers. DSPM reads signals from Information Protection, DLP, Insider Risk Management and Data Security Investigations, and works before you have a single policy. We look at how it is built: three key posture metrics, objectives ranked by risk, a remediation plan with its estimated impact, and the AI apps and agents in use. https://royexplains.com/wp-content/uploads/2026/10/dspm-what-is-dspm.mp4 157 2026-10-19T15:18:43+02:00 yes no https://royexplains.com/how-tos/dspm-find-and-fix-oversharing/ https://royexplains.com/wp-content/uploads/2026/10/dspm-find-and-fix-oversharing.jpg Find and fix oversharing Copilot respects permissions, so too much access means too much in the answers. We follow the objective Prevent oversharing of sensitive data from trends and risk patterns to a remediation plan with five actions. The default data risk assessment covers the 100 most used SharePoint sites every week, and item-level scanning lets you fix single items right in DSPM. A label alone doesn't stop Copilot. Encryption or a DLP policy for Copilot does. https://royexplains.com/wp-content/uploads/2026/10/dspm-find-and-fix-oversharing.mp4 144 2026-10-19T15:18:49+02:00 yes no https://royexplains.com/how-tos/dspm-explore-assets-and-activity/ https://royexplains.com/wp-content/uploads/2026/10/dspm-explore-assets-and-activity.jpg Explore assets and activity in DSPM Activity explorer is covered in Investigate logs and user activity, and Data explorer in Explore your data. DSPM adds Asset explorer, which shows every asset with its owner, access and classification confidence, and a richer Activity explorer with a Risk Pattern filter and a tab of its own for AI activities. Then we build a custom report from sections and cards, and see that almost every label applied is Public. https://royexplains.com/wp-content/uploads/2026/10/dspm-explore-assets-and-activity.mp4 151 2026-10-19T15:18:56+02:00 yes no https://royexplains.com/how-tos/dspm-secure-ai-use/ https://royexplains.com/wp-content/uploads/2026/10/dspm-secure-ai-use.jpg Secure AI use with DSPM Copilot and agents, enterprise AI apps and the AI sites people open in a browser each need their own signal, and setup tasks decide what DSPM can see. We look at which AI apps are in use and which policies cover them, the agent inventory in AI observability, and the objective Prevent exfiltration to unsanctioned AI apps. Its remediation plan creates a DLP policy for browser and network, and network needs a SASE or SSE integration. https://royexplains.com/wp-content/uploads/2026/10/dspm-secure-ai-use.mp4 146 2026-10-19T15:19:02+02:00 yes no