From the course: Microsoft Information Security Administrator Associate (SC-401) Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 25,300 courses taught by industry experts.

Manage forensic evidence settings

Manage forensic evidence settings - Microsoft 365 Tutorial

From the course: Microsoft Information Security Administrator Associate (SC-401) Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Manage forensic evidence settings

“

By this point, you should be getting very comfortable and familiar with creating policies within Purview. And creating an IRM policy is not an awful lot different. So let's just walk through and see how it differs, because there are some differences between an IRM policy and other policies in Purview. And of course, the reason we need policies, if If it wasn't obvious, was without policies, we're not going to be able to trigger alerts and investigations. So let's go. As you can see, fairly normal here. So we'll just call it data leak. We're gonna just put everybody in and now we can exclude users and groups, which I'm not going to do. And then you can see we can prioritize things. So I'm gonna leave it on the default. so we're going to prioritize SharePoint sensitivity label. It's going to use these indicators to prioritize. Then we can also look for a triggering event. We can actually give it a SharePoint site. We'll do the Zava Tiger Team there as a priority SharePoint site, and I…

Contents