Design security solutions for applications and data · Topic 1 of 5
Securing Microsoft 365 Workloads and Copilot
SC-100 Microsoft 365: Secure Score, Defender for Office 365 and Cloud Apps, Intune, Purview, and data controls for Microsoft 365 Copilot.
- 6 min
- Secure Score: score by identity, devices, apps and data. Improvement actions with status and comparison.
- Defender for Office 365: Safe Attachments, Safe Links, anti phishing, ZAP. Plan 2 adds Threat Explorer, AIR and attack simulation.
- Defender for Cloud Apps: discovery, connectors, Conditional Access App Control, app governance, SSPM.
What it is
Microsoft 365 holds a company's email, files, chats and meetings, and now increasingly feeds AI assistants. Securing it uses several products, each with a clear job: Microsoft Secure Score measures posture, Defender for Office 365 protects email and collaboration, Defender for Cloud Apps controls cloud app use, Intune manages devices, Microsoft Purview protects data, and Microsoft Entra protects identity. The newest requirement is making sure Microsoft 365 Copilot only uses and exposes data it should.
How it works
Evaluating posture with Microsoft Secure Score
Microsoft Secure Score (Microsoft Defender portal) measures the security posture of Microsoft 365 and connected apps.
- It scores identity, devices, apps and data (and infrastructure for connected workloads).
- Each improvement action has a point value, an implementation status (to address, planned, risk accepted, resolved through third party or completed) and impact guidance.
- It shows trends, and a comparison with organizations of similar size.
- Use it to evaluate posture for productivity and collaboration workloads and to prioritize: do high impact, low user friction actions first.
Metrics to track alongside it: percentage of users with MFA, phishing resistant methods in use, devices compliant, labeled content, DLP matches, and phishing and malware detections.
Defender for Office 365
| Feature | Purpose |
|---|---|
| Safe Attachments | Detonates attachments in a sandbox before delivery |
| Safe Links | Checks URLs at click time in email, Teams and Office apps |
| Anti phishing | Impersonation protection and mailbox intelligence |
| Zero hour auto purge (ZAP) | Removes malicious messages already delivered |
| Plan 2 extras | Threat Explorer, automated investigation and response, Attack simulation training, threat trackers |
| Teams and collaboration protection | Protects SharePoint, OneDrive and Teams content |
Defender for Office 365 is part of Defender XDR, so email attacks are correlated with endpoint and identity signals.
Defender for Cloud Apps
A cloud access security broker (CASB) for SaaS.
| Capability | Use |
|---|---|
| Cloud discovery | Find which apps employees use (shadow IT) from logs and Defender for Endpoint, and score app risk, including generative AI apps |
| App connectors (API) | Connect Microsoft 365 and other SaaS to scan content and settings, and detect anomalies |
| Conditional Access App Control | Reverse proxy session controls: block downloads, require labels, monitor sessions |
| Policies | Activity, file, anomaly detection, and session policies |
| App governance | Monitor OAuth apps and the permissions they hold, find overprivileged or risky apps |
| SaaS security posture management | Checks configuration of connected SaaS apps |
Microsoft Intune
Intune enrolls and manages devices, deploys compliance policies and security baselines, enforces app protection policies on personal devices, and supplies device compliance to Conditional Access, so only healthy devices reach Microsoft 365. It also deploys Defender for Endpoint settings and applies attack surface reduction rules.
Microsoft Purview for data in Microsoft 365
| Control | What it does |
|---|---|
| Sensitivity labels | Classify and protect content, with encryption and visual markings that travel with the file |
| Data loss prevention (DLP) | Detect and block or warn on sharing of sensitive information in Exchange, SharePoint, OneDrive, Teams, endpoints and other locations |
| Retention and records management | Keep or delete content on schedule |
| Insider Risk Management and Communication Compliance | Detect risky behavior and policy violations |
| Audit and eDiscovery | Investigate and respond |
| Data Security Posture Management | Find risks to data and recommend policies |
Data security and compliance controls in Microsoft 365 Copilot
Copilot uses the Microsoft Graph to find content the user already has permission to see. This is important: Copilot does not break access controls, but it makes over shared content much easier to find. So the first requirement is to fix permissions.
| Concern | Control |
|---|---|
| Oversharing | Review site and file permissions. Use SharePoint Advanced Management features such as data access governance reports, site access reviews and restricting discovery of sensitive sites. Use sensitivity labels with default labeling on sites and containers |
| Sensitive data in prompts and responses | Sensitivity labels carry over, and Copilot honors encryption usage rights. DLP policies can stop Copilot from processing content with specific labels or sensitive information |
| Visibility | Purview DSPM for AI shows AI activity and risks. Audit records Copilot interactions. eDiscovery and retention policies apply to Copilot prompts and responses, and Communication Compliance can review them |
| Insider risk | Risky AI usage detection in Insider Risk Management |
| Access | Conditional Access, MFA and compliant devices for Copilot users, and licensing by assigned users |
| Data location and use | Data stays within the Microsoft 365 service boundary and your tenant's data residency commitments, and prompts and responses are not used to train the underlying models |
Copilot also has built in protections against prompt injection and harmful content, but they do not replace permissions and labeling hygiene.
Choosing quickly
| Requirement | Answer |
|---|---|
| Measure Microsoft 365 posture and prioritize actions | Microsoft Secure Score |
| Detonate attachments and check links at click time | Defender for Office 365 Safe Attachments and Safe Links |
| Control downloads from a SaaS app for unmanaged devices | Defender for Cloud Apps Conditional Access App Control |
| Stop Copilot from using highly confidential files | Sensitivity labels and DLP policy for Copilot |
| Reduce what Copilot can find | Fix oversharing and permissions first |
| Find which AI apps employees use | Defender for Cloud Apps discovery |
A worked scenario
Before rolling out Microsoft 365 Copilot, a law firm finds many SharePoint sites shared with "Everyone". The architect uses SharePoint Advanced Management reports to find overshared sites, applies sensitivity labels with default labels on client matter sites, enables a DLP policy that blocks Copilot from processing "Highly Confidential" content, requires compliant devices through Conditional Access, turns on audit and retention for Copilot interactions, and tracks progress in Microsoft Secure Score.
What to remember for the exam
- Secure Score: score by identity, devices, apps and data. Improvement actions with status and comparison.
- Defender for Office 365: Safe Attachments, Safe Links, anti phishing, ZAP. Plan 2 adds Threat Explorer, AIR and attack simulation.
- Defender for Cloud Apps: discovery, connectors, Conditional Access App Control, app governance, SSPM.
- Copilot respects existing permissions, so oversharing is the main risk. Labels, DLP, DSPM for AI, audit and retention apply.
- Intune compliance feeds Conditional Access.
When a Copilot question mentions "users see confidential files they should not", the root cause is permissions, not Copilot.
How the exam asks about this
- "Detect risky OAuth apps with excessive permissions." App governance in Defender for Cloud Apps.
- "Provide users a simulated phishing campaign." Attack simulation training in Defender for Office 365 Plan 2.
- "Prevent Copilot from summarizing documents with a specific label." A DLP policy for Copilot, or label usage rights.
- "Record what users asked Copilot." Purview Audit.
Common mistakes
Enabling Copilot before cleaning permissions. It surfaces existing oversharing.
Treating labels as optional. DLP and Copilot controls rely on them.
Using Secure Score as a goal. It is a guide, not a guarantee.
Mixing up Cloud Apps and Office 365 protection. One is SaaS control, the other is email and collaboration.
Check yourself
What does Microsoft 365 Copilot use to decide which content a user can see?
The user's existing permissions, through Microsoft Graph.
Which Defender product detonates email attachments in a sandbox?
Defender for Office 365 Safe Attachments.
Which feature finds overprivileged OAuth apps?
App governance in Microsoft Defender for Cloud Apps.
Topic 1 of 5 in Design security solutions for applications and data
Test yourself on Design security solutions for applications and data
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.