Watch Me Secure a Law Firm’s Data in Microsoft 365 (Step-by-Step)

0:00 Oh, hi Jonathan. It's Charles. Charles Bell from Hawthorne Bell LLP. We're a law firm. Hi, Charles. How are you? Did you say you were a law firm? Yes, that's right. We're actually one of the best law firms in London. So, why are you dressed like a judge? Have you ever tried to get a lawyer fancy dress outfit from Amazon? I mean, what do lawyers even wear? Fair point. Listen, Jonathan, I watched your video last week all about data loss prevention in Microsoft 365. It really piqu my interest. Oh god. Did you enjoy it? Yes, I did. But I thought it was very generic. You told us how to protect credit card information using

0:47 Microsoft templates. All very well and good, sir, but my firm doesn't really hold credit card information. I mean, we have so much data that we need to protect, but it's hardly generic. Yes, Charles, I know what you mean. But in that video, I was just showing the built-in Microsoft templates. Look, what I usually do is go into businesses just like yours, and I look at all the data and the data that they're trying to protect. From there, we can build out custom sensitive information types. We can configure data loss prevention policies and we can build sensitivity labels bespoke to your firm. Oh, that sounds perfect. Jonathan, look, I'm

1:33 going to send you an email about my firm's requirements. Could you please look at it and advise me at your earliest? Certainly, Charles. Thank you. Godspeed. Today we're diving in to the thrilling edge of your seat world of data protection in Microsoft 365. I've created a totally fictional law firm called Hawthorne and Bell and they have lots of confidential data that they're trying to protect. So in today's video, we're going to look at sensitive information types. We're going to look at data loss prevention policies and sensitivity labels. We're going to protect Hawthorne Bell's data like a digital Fort Knox. But before we get

2:19 into that, let's hop over to my computer screen because we've just received an email from Charles Bell. So, I've received this email from Charles Bell. Okay, so just to reiterate, Charles Bell is completely made up. I've even bought the domain just to make it appear a little bit more real. Perhaps this image here, perhaps this is Charles Bell. He's the managing partner of a law firm. Anyway, he sent an email to the Bearded 365 guy. He's telling me about his firm. His reputation is built on trust as with a lot of firms, especially with law firms. And he said at the bottom here, he doesn't know the technical details, but what he does know is he needs to protect this type of data. So, he's got some client case numbers. They're used

3:06 to track legal matters internally. We need to protect those. He's got some proprietary legal contract templates. There's some client entity names that are using high-profile cases and of course some personal identifiers like national insurance. Now you could receive an email just like this from someone in your business or a customer or something like this. They are saying we need to protect this kind of data. So, what I've done, I've gone and spoken to Charles. I've not really because it's made, it's all made up, but I've gone and spoke to Charles and we've come up with a little fictional law firm profile. So, the name of the company, what they specialize in, where they're

3:51 based, but I've looked at Charles's requirements in a bit more detail, and we can see here, look, he wants to protect client case numbers. Now, they always go in this format here. HB, the year, and then a random fourdigit code on the end. He needs to protect national insurance numbers. He also needs to protect some legal contract templates. Again, as an example here, these are usually the same. And then we've got some random digits on the end. So, that's what Charles needs to protect. What do we do next? Okay, so we've looked at Charles's requirements, but how does Microsoft 365 know what data is sensitive for Hawthorne Bell? The answer

4:38 is they don't. So, we've got to tell it. And to do that, we create something called sensitive information types. This is the basis for all your data protection in Microsoft 365. And now I'm going to show you how to do it. Let's go. Okay, so to begin with, we need to create something called sensitive information types. Now, it's worth noting that Microsoft doesn't really understand our data. So, what we've got to do is almost program our requirements into Microsoft 365. For example, we need to tell Microsoft that data containing our client case numbers exists in this format. Okay? So we we're teaching

5:23 Microsoft what our sensitive data looks like. That's the first step. So to do that, we go to I'm no here to the Hawthorne Bell Microsoft 365 admin center. Now when it comes to data protection, most things happen here in Microsoft Purview. So I'll launch that now. And from there I go to solutions data loss prevention. And from there I go to classifiers, sensitive information types. Now Microsoft have built in lots of sensitive information type templates. Here you can see publisher Microsoft. I've covered these in some previous videos. So I'm not going to talk too much about those today. What I am going

6:09 to do is create a sensitive information type. So the first one we're going to look at is the top one here, client case numbers. Okay. Okay, so just hopping back to here. So we will give this a name. The name is client case numbers sit and that's just sensitive information type. We also have to enter a description. So I'll do that now. There we are. Client case numbers are used to track legal matters internally. I'll then click on next. Now we're on to the crucial part. We've got to create a pattern. So a pattern is teaching Microsoft what to look out for in our data so Microsoft can spot that it's a sensitive information type. Okay. So we create a pattern by clicking on here.

6:56 And now it opens this page here. So we got to create a new pattern. Now the confidence level I'm just going to leave at the moment. I will circle back to it shortly. But to start with I'm going to focus on the primary element. So what we're saying is what is the primary thing that Microsoft needs to look for to know this is a client case number document. Okay. And in our case it's going to be this, isn't it? Okay. They all start with this kind of reference. So it's HB 2025 and then a random number. So how do we program that into Microsoft Purview? So just coming back here. So adding a primary element, we've got a few different things we can do. I'm going to choose something called a regular expression. Okay? Also known as

7:45 red jacks. Now, if you want, you can learn all about red jacks if you want. Look at all that. Or like me, you might not really want to learn that. Okay. So this is a perfect reason why we can use things like co-pilot. Okay, just hang on a second. I'm going to give this reg x a name. Okay, client case numbers. What is going to be the regular expression? Let me go over to co-pilot. Okay, and I will give co-pilot this command. Here we

8:31 are. I'm creating a sensitive information type in DLP in 365. I'm using the regular expression. Can you please create me a reject for the data that has this format? The last four digits will be random. Okay. What can co-pilot do for me? Copilot can give me the red jacks. Okay. So that is nice and simple. There's an explanation if you want to know more about it. So it tells you exactly what that means. This at the end means matches exactly four digits 0 to nine. Okay, we've got some further options here. But what I will do is simply just copy this and go back over to DLP. And that is going to be my regular expression. Okay,

9:17 I'll click on done. Okay, so we've given it a regular expression and that might be enough. But what we can do because we want once we start configuring DLP, we want it to be accurate. The last thing we want is people getting frustrated because data that actually isn't a client case number is getting blocked. No one's going to be happy. It's that balance between usability and security. So what we can also do just to show you is add some supporting elements. Okay? So maybe add in something like a keyword list. So just go along with me here for now. I'll give this an ID. This is just a unique identifier. I'll call it client case number list. We've then got case

10:04 insensitive and case sensitive. Okay, that all should make sense. So I'm going to type some keywords in here. Okay, so client, case number, legal matter, file reference, case ID, confidential. Click on done. So now what we're saying is Microsoft this sensitive information type if it includes this regular expression. So if it includes data that's in this format here and within the document if it's got some of these keywords we are pretty confident looping back to this that this is going to be a client case number. Okay. Okay, so we're looping back to this now. So what I'm

10:52 saying is the more primary elements, the more supporting elements that we can plug in here, the more confident we are that this is in fact going to be a client case number. Okay, does that make sense? I hope it does. So I'm happy to click on create here now and I've got my pattern. I'm going to click on next. We're going to set this as high confidence and we're going to review and we're going to create. Okay, this sensitive information type has been created. I can now click on done and it's going to take me back to here. Now, how do we know we've configured that correctly? How do we know that it works? Well, if I go and find this one here,

11:38 it's this one here. Client case numbers sit. Okay, I open that up and you can see here, look, I've got a little test button here. So, when I click on that, it's going to test against any file that I upload. Now, funny enough, look what I've got here. Look, I've got a word document from Hawthorne Bell and it's a confidential legal document. You can see it's got things like confidential in, but it's got one of these case numbers. Look, can remember we created a a redex for that. So, it's got some things in there that I would think should be picked up now, okay? Because we've we've created this. Now, this is just testing. We've created no DLP policies or anything like this. This is just the early stages. But we need to know how

12:23 sensitive information type actually works. So, what I do is I can go to that document and I can open it and I can click on test. And you can see here, look match results. We've detected the following. So low confidence, medium confidence, we've also got a high confidence. So it goes to all that. It tells us the matches. It tells us the supporting elements. So I'm pretty confident now that the sensitive information type that I've just created has worked. Okay. So that is the first thing we've done. We've created a sensitive information type for client case numbers. The next thing I'm going to tackle, I'm going to leave this one for now. We'll we'll loop back to that. But we've also

13:09 got some legal contract templates, okay, with a different format. Okay, so let's head back to here again. We'll go to sensitive information types and we'll create another sensitive information type. We'll give this a name, legal contract templates. Does what it says on the tin. We also need to enter a description. Okay, I've just basically copied this from Charles's email. Okay, click on next. Again, we've got to create another pattern. So, I'll click on here. Again, the primary element is going to be a regular expression. So, let's head back to Copilot, which is open here. Here we are. And let's give C-pilot

13:55 another command. Okay, what about this? creating a sensitive information type. So it's going to be this format. LCT will always remain the same. That stands for legal contract type template. 2025 is a year. So it's going to change every year. And the G is also random but will be three letters followed by three numbers. What can co-pilot do for us? It can do this. Okay. So it's give us our regular expression. You can see here the explanation. Let's copy that. Okay, that's done the leg work for us. Let's go back to our pattern here and we will give this an ID first. Okay, this is not overly important. It's just so you can identify

14:41 it. We will plum our regular expression into there and we click on done. Okay, going back here, let's add some supporting elements. Okay, so let's go with keyword list again. Again, case insensitive. So these are some of the references that could be included in that document as well. Okay, give it an ID. Okay, happy with that. Click on done. And again, we'll set this as high confidence and we will click on create. We'll click on next. Click on next. And we will create this sensitive information type. When we're happy, click on done. Okay, it's now time to test our sensitive information type. So, I'll just try and find it here. It's this one, legal

15:28 contract templates. Now, going back to my word document I used before, you can see I've also got a reference in here. Look for legal contract templates identified as this reference number. So, by testing with this document again, it should be picked up. I will close that. I will click on test. I will point it towards this fire here and click on open and test. And you can see look, we've got some matches and we've got some supporting elements. Okay. So, I'm happy that our new sensitive information type actually works. Okay. Okay. The next thing that we're trying to protect, if we go back to our law firm profile, there's some confidential client names. Okay. So,

16:16 we're obviously not going to do these as a regular expression. So, how we would do these, if I go back to here, let's go back to sensitive information types and let's create a new sensitive information type. We will give this a name, confidential client names. We'll also give it a description, something like that. Click on next. Let's get into another pattern. Okay, as I said, we're not going to give it a regular expression. So, I think for our primary element, we will give this a keyword list. Now, you might have noticed as well, we've got a choice between keyword list and keyword dictionary. So, let's clear this up. What is the difference between a keyword

17:02 list and a keyword dictionary? Well, a keyword list is fairly simple. You've seen me input these before. or there's just a bunch of words or phrases that we want Microsoft to look for. Words like client or case number. A keyword dictionary is more advanced. It's going to group keywords into categories. So, we might have client names in one group. We might have legal terms in another. So, a keyword dictionary is great when you want to detect combinations of concepts. Maybe think of it like this. A keyword list is like a a shopping list. Okay, a keyword dictionary might be an entire recipe

17:48 book. Okay, I don't know if that's a good analogy or not, but that's the best I can think of. So, a keyword dictionary, much more advanced. Okay, again, for this, I'm going to choose a keyword list. Okay, I'm going to give this an ID, confidential client names, keyword list. We'll enter a couple of clients that Hawthorne Bell are working with who are confidential at the moment. Okay. Okay. Arden Holdens Belmore Capital for this one. Okay. I click on done. I'm not going to add any supporting elements, but you can, you know, you can add a reg x for the supporting elements. You know, you can do any of those things. We've got some groupings we can play with, but I'm going to keep it fairly simple here. I've probably set this as medium

18:34 confidence because we've got no supporting elements. I will click on create. I will click on next. Medium confidence and I will create that sensitive information type. Okay, that has been created. So, click on done. Let's go and find it in here. Confidential client names. Our trusty word document that we've used before. Look, we've got Ardan Holdens and we've got Belmore Capital. They are both in this document. Okay. Close it down. Let's test. Upload. Let's get this in here. Click on test. And there we are. So, we've got some low confidence. We've got no supporting elements because remember we didn't add

19:19 those. And we've got some medium confidence as well. So, we're happy with that sensitive information type. Now, I mentioned previously going back to our profile that UK national insurance numbers. I was going to come back to the reason is if I go back to sensitive information types and I type in here in fact I will type in U.K because that's where we are. You can see here look we have UK national insurance. This is a good example of a template. Microsoft have already created this. Okay. So we don't have to create a sensitive information type for that. So what happens next? So, we've created some sensitive information types, but at this point, nothing is getting protected

20:06 in Microsoft 365. We've simply laid the foundations. To get some protection, we now need to use those sensitive information types when we create data loss prevention policies. What we're going to do now is create four DLP policies for Charles at Hawthorne Bell. Let's go. Okay, it's now time to start building our data loss prevention policies. Okay, based on the sensitive information types that we've created. So I'm back in Purview. I'm in data loss prevention and you can see at the top we've got a section called policies. Now at the moment Hawthorne Bell don't have any policies. So we are starting from fresh. So I click on create a policy.

20:54 In here, we've got some templates that Microsoft have created. So, if you're in Australia, they've got a a template to protect Australian financial data. We've got medical and health. We've got privacy. So, there's some templates there to get you started. I'm going to choose custom. I'm going to choose custom policy here because we're building our DLP policy from scratch. Click on next. It's going to pull this information through. Uh but obviously we want to rename our policy. So I will give this a name now. Okay. Hawthon and Bell client case protection. Okay. We don't have to put a description in here, but I'm going to do. Okay. You can

21:39 make this much more detailed if you want, and I probably urge that you should do, especially if you've got a lot of people who are looking after your data in your organization. Click on next. Now it takes us onto admin units. Now I've got a Microsoft 365 business premium license in here. We need an E5 license to take advantage of admin units. An admin unit is maybe your organization is quite big and you've got an office in Australia, an office in America, and you've got different kind of IT departments looking after each. You might create different admin units and say okay. So they can look after their specific data loss prevention policies, but for our example, we're not interested in that. So click on next.

22:25 And then we want to choose where we want to apply these policies. And you can see I've got all these options here. I'm going to keep this nice and simple and make it kind of cloud only. Exchange email, SharePoint sites, one drive accounts, and teams chats. I'm going to scope it to all groups, all sites, all users. But you can go in here and you can amend it. Okay, so you can just target it at certain users, certain sites, certain groups. Okay, I will then click on next. We want to create and custom customize advanced DLP rules. So click on next. Okay, we need to create a rule. And this takes us to this page here where we create a rule name. Look at conditions,

23:12 actions, using user notifications, all the good stuff. First of all, we've got to give the rule a name. So, we'll do that now. There we go. Block external sharing of client case numbers. It does what it says on the tin. Now, we look at conditions. We can give it a description if we want. I won't do for this one. Define the conditions that must be met for this policy to be applied. Okay. The first condition content is shared from Microsoft 365 with people outside of my organization. So basically what I'm saying this rule is when people are trying to share the internal any data with internal client case numbers on

23:57 them I want DLP to block them. Okay. So the first condition is detects when content is sent in email teams or channel messages or shared in SharePoint one drive with people outside of my organization. Okay. So let's dig deeper. That content needs to contain. So we can give I will just click on add at the moment. Sensitive information type in here client case numbers. Okay, so this condition here, take it from the top, content is shared from Microsoft 365 with people outside of my organization and it contains client case numbers. So it's kind of building upon

24:44 that. This is a group name. This is default at the moment. You can change this to something else to make it stand out a little bit more. So I'll do that. Client case sharing. You can see it's pulled the high confidence over there and the instant count. Okay, so you can choose that. You might want a different instance count. So how many instances has it has it been detected? I'm just going to choose one. Okay, so that's our conditions. The next step is actions. So when these conditions are met, what actions do we want? Okay, we've got one here. restrict access or encrypt the content in Microsoft 365 locations. So, we're going to block users from receiving that email or accessing that data and we're going

25:31 to block it for people outside of our organization. Okay, nice and easy that isn't it? Come down a little bit more. The next section here is user notifications. Do we want to use notifications to inform users and help educate them? This is off. It absolutely needs to be on. Okay. Do we want to notify users with policy tips or email notifications? Yes, we do. So, you got your email notifications there. You can customize all those. Okay. We can customize the email body, the subject, all these good stuff. Okay. I won't do that, but you can do. We then notify the user who sent, shared, or last modified the content. Great. I think you need to

26:18 build on that. So the person who sent, shared or modified the content, yeah, notify them. If you've got an IT department, uh, compliance officer or someone else who needs to know, notify those as well. Okay, we go on to policy tips. This is kind of education. So we want to customize that. So we could put something like this. Okay, so this will educate them. We've also got a section here which is quite handy which is called user overrides. So do you want users to be able to override this policy? So they might be sending something out and they that they're able now to override it and send that data. You might choose this to switch this on or off. This is a good

27:04 idea. If they are going to override it, they've got to type in a business justification. Okay. Why are they doing that? So that's up to you and your organization. We've then got incident reports. So I recommend you switch all these on here. You've got a severity level in the admin alerts. So do you want this if this is triggered, do you want this to be low, medium, or high? You might want this as high. Okay. Uh you want to let people know that's all okay. We can add remove users notifications. So you can do a lot here. Once you're happy, click on save and that will go on to the next page. There's a bit of a summary of what we've created. Click on next. We've got a couple of options here. Look, we can run this policy in simulation mode. If you're starting out

27:49 with DLP, this is a good idea. If people in your organization are educated and suddenly they're getting messages, it's a good idea. You can look at your policies and you can see what's getting triggered. You can amend them. You can do all those good stuff. Uh you've even got an option here to turn on the policy if it's not edited within 15 days. Why 15 days? I have no idea. Who chose that? Uh, but anyway, for my example, I'm just going to turn this policy on immediately. Okay, I'm going to click on submit. Okay, that has been created. Let's create another one so you can learn how to do it. We'll go a little bit faster now. Custom custom policy. Next. Give it a name. There we go. Give it a description. Click on next. Admin units. Click on next. We're okay

28:34 with that. Again, we will protect these. We're going to talk about endpoint DLP, by the way, in a video next week. Okay, click on next for that. We're going to create a rule. We'll give this a name. Okay, add a condition. Content is shared from Microsoft 365 with people outside of my organization. Add a condition. Content contains sensitive information type legal contract templates. The difference when we get on to the national insurance one is we will still go to here but we would just type because it's already there basically. So we would just choose it from there. That's the only difference. Okay. Legal contract templates. Yes, please click on add. Okay, that's gone in there. I don't

29:21 know how but I'll remove that. So there's our uh conditions again our actions. We can do that. That's absolutely fine. and we will go through the notifications. Okay, we'll just leave those because we've seen that in the previous bit. We'll leave this as it is. Okay, we'll choose these and we will save. And there we are. Click on next. We'll turn all these on. What I would do, I'll submit that. That will start. And what I will also do as I said rather than go through this I will create our other two DLP policies and I will come back when they are done. Okay. Our DLP policies has been created. Let me just touch on priorities here. Um

30:08 this has got a priority of 0 1 2 and three. The lower the number the higher the priority. Okay. You can go in here you can move down. You can move up. You can change these. The best practice is to have your most restrictive and critical rules with a lower priority. Okay? So if this was my most restrictive, I would assign that as a zero. If I've got some general purpose rules, they might have a higher number. Okay? Because the high priority rules like zero will match take action and the lower priority rules will be skipped. Okay? So that is that. So there's our DLP policies now in place. What do we do next? Okay, so we've created some

30:56 sensitive information types. We've tested them and we've built them into some shiny new DLP policies. I think Hawthorne and Bell's data is now harder to leak than a briefcase inside a vault inside a submarine. But I think we need to test these DLP policies. Let's do that. We've got a user at Hawthorne and Bell called Sha Walton. Now Shawn is a bit of a loose cannon. He doesn't know much about data protection and he keeps trying to leak data. Let's see what happens when Shawn tries to leak data in Microsoft 365. Okay, so I'm in Sha Walton's mailbox. Okay, as I've said, Shawn Walton is a bit of a loose cannon.

31:41 He spreads information that he shouldn't do. He's not really up to date on data protection. So what he's going to do now, he's going to send a new email externally to me, Jonathan Edwards. Okay, the subject is going to be something like this data you requested. Put some email body there's some email body as per our discussion. Here is our internal client case reference. Remember this. This is the format that we created in our sensitive information type and we blocked using our DLP policy. You can see at the top, look, we've got a policy tip that's appeared because this email has been scanned and this has appeared. This document contains internal client case numbers. Please take extreme care. Now, we put this so

32:27 this is our own policy tip. We can customize this and that's what we did. Sean can show the details and it says some more details and it says in here look to send this message without removing the information you must first select an override again we allowed overriding you don't have to do that but you can do so you can allow people to override it by entering a business justification now Sean is the type of guy who would ignore this and he would go ahead and click send and this is what would happen there so your organization won't allow this message to be sent until the information is removed. So, we know this is working beautifully using emails. Now, popping over to Teams. Look

33:13 here up. Sean has tried to send Jonathan because he got frustrated with it. So, he thought, well, I tell you what, I'll just send him it via Teams. Hi, Jonathan. How are you? The client, this is the reference number. And guess what? Look, this message was blocked. So, he's tried using emails. He's charged using Teams and everything is getting blocked. Okay, we're also now in Sean Walton's one drive. Okay, I've got this document here. And if we open that up in a moment, we should get a policy tip that appears. This item conflicts with a policy in your organization. Now, I want to make something very clear. So when I tested the email and the teams

34:00 yesterday, they blocked they scammed the messages and they blocked them immediately and my intention was to just show you the one drive and show you it blocking it immediately. The one drive wouldn't work yesterday. Okay. So I left it I'm now kind of filming this bit the day after. Um there is a difference between how DLP enforces email and teams and how DLP enforces one drive and sharepoint. So with email and teams the message is scanned and it's blocked before sending before delivery. Okay. With one drive and sharepoint it's kind of asynchronous. So the file is scanned after upload and enforcement can sometimes be delayed. It can take time and it can be missed. Okay. And you

34:48 might be thinking, well, that's not very good. But in a moment, uh, in the next section of the video, we're going to talk about something called sensitivity labels, which hopefully gets around that. Hey, we're not finished yet. Okay, so we've proved that our DLP policies work nicely. DLP is great for catching data after it's been written, but what if we could label and protect data as it's getting created? Sounds good. Enter sensitivity labels. Sensitivity labels are Microsoft's way that we can attach a virtual handle with care sticker to our emails, our data, and our Teams channels. With sensitivity labels, we can classify documents with what data is

35:34 inside them. But sensitivity labels aren't there just to look pretty. They can do so much more. You can encrypt the data. You can control who has accessed that data at all times. You can make sure that people can access that data when they're offline. Plus, sensitivity labels works beautifully with data loss prevention. As with all IT security, it should be an onion approach. Different layers providing different services. And that is the case with DLP and sensitivity labels. Should we have a look? Okay, let's talk about sensitivity labels. Now, when you go into a business, you've got to look at their

36:20 data, look at what they're trying to protect, look at DLP, and then design some sensitivity labels for that business. So, if I was going into a company like Hawthorne and Bell, I might design some labels a little bit like this. Okay. Now, I've done some videos on sensitivity labels before. I think one of the key points when it comes to sensitivity labels is not to have too many because people will just get really confused. I think four, five, six is a good number to have. Obviously, Hawthorne Bell are completely made up, but we've looked at um protecting some confidential client data. We've looked at protecting some legal contract templates with DLP. So, this would be a

37:09 nice uh starting point for their sensitivity labels. Okay, I'm going to jump straight into this one here. Okay, this is going to protect their client case numbers. Okay, so let's head back over to Microsoft Purview and we want to go to solutions and we want to go to information protection and within here we want to look at sensitivity labels. Okay, I will click on create a label and I will give this label a name. Something like that. The display name I will set as the same. And then we've got a description for users. Okay, this is to guide users on when they would use this label. So, you got

37:54 to try and be as descriptive as you possibly can. That might be a good description. Um, we've got a description for admins. So, you don't have to put anything in here. So I won't on on this occasion. And you can give it a color. Okay. We'll go with purple for this one. We'll click on next. And then we get on to the scope. Okay. So we can define the scope for this label. Where can users use this label? Okay. Files, other data assets, emails, meetings, and you can also enable. I've not done it in this tenant, but you can run some PowerShell commands, which I advise that you do to protect things in Teams and 365 groups and SharePoint sites. So, highly recommend that you do that. But for this test, I'll just leave this as it is. Click on next. Okay. So,

38:41 we'll click on control access and apply content marking. Okay. And that's okay for this example. You can go and protect teams, meetings, and chats as well. Now, we get on to the access control. So, we want to assign permissions now or let users decide. Well, for me, I'm going to assign permissions now. So then I go down to here, assign permissions to specific users or groups. So this is where you would assign permissions. You would build some Microsoft 365 groups and assign permissions that way. What I'll do for my example, because we've just got a really small company, I'm just going to choose Charles Bell and Sha Walton here. Okay. And then we can also choose permissions. Okay. So we've

39:28 got editor, we've got owner. It tells us everything we can do here with the different levels of permissions. I will leave this as as owner and click on save. Click on save again. And then we can look at if user access to the content expires. Okay, you can limit the user access to specific dates or number of days after the label is applied. We've also got allow offline access. So this is do we want people to have access to the data without being connected to Microsoft 365. Again we can configure that always, never, or only for a number of days. Okay. We can then click on next. We've then got some content marking. So we'll definitely have that.

40:15 We will add a watermark and we'll customize this text. Okay. We'll put on here something like that. Click on save. We'll add a header. Again, we'll customize the text and put the text in here. Click on save. We'll add a footer as well. Put the footer text in here. Something like that. Click on save. Okay. Click on next. And now we get to this section, auto labeling for files and emails. And I think this is the real magic with sensitivity labels. This is where sensitivity labels and data loss prevention work together. They are both complimentary services to protect your data in Microsoft 365. They both do similar things but also do different

41:01 things. Okay. When it comes to data loss prevention, it's like an airport scanner scanning luggage for prohibitive items. When it comes to sensitivity labels, these are like the labels you might put on luggage. Things like handle with care or VIP or something like that. So in any organization it's good to have both DLP and sensitivity labels working together and this section is where they both are kind of integrated. If I just show you what I mean if I switch this to on. So detect content that matches these conditions content contains add. Now this screen will become very familiar because we did all this didn't we in data loss prevention. So I'm going to look for my client case numbers.

41:48 Click on add. And then you can see here look when content matches these conditions automatically apply this label. Take it from the top. Okay. So this is going to be scanning data. And if a user is creating emails or files or anything like that that contains client case numbers, then this label we are creating will automatically apply. and all the security that comes with this label will automatically apply. So things like access control, offline access, content marking, all of those things is going to apply. Okay, we've also got a message that we can apply to users. We can show users a sensitivity label has automatically been applied. So

42:34 I think this is the real magic when it comes to sensitivity labels, when it comes to data protection. Once you're happy with this, you can click on next. We've got things we can do with groups and sites. Because I've got not enabled that with PowerShell, I can't click on any of those. Click on next. And there we go. So, I will create that sensitivity label. Okay. Once we've created a sensitivity label, it's time to publish it. Okay. So, we will click on there. We will create a new label policy to publish. Okay. So, we choose the label. It's this one here. Click on add. Click on next. Admin units. No. All the users and groups, but we can publish it to different users, different groups. Click on next. And then we've

43:21 got some policy settings. So, we can put on here that users must provide a justification to remove a label or lower its classification. Again, we can say that users, we need to require them to apply a you a label to their email document. So, they have to do that when they're saving documents or when they're sending emails. This is an ideal thing to do, but because I've only got one label, I'm not going to bother. We've also got some links to custom help pages that you can put in as well to educate users. Let's click on next. I'm not going to You can put a a default label to documents. Okay, so we looked at this one here. If I just go back to this page here, we could maybe have the default as internal. Okay, if we created

44:07 all these, but it depends on your business. I'm not going to select a default one there. Again, same with emails. Click on next. Same with teams and meetings and calendar events. Click on next. Click on next. And now we create a name for the policy. Okay. Click on next and click on submit. And that should publish the label. Okay. Policy created. It can take up to 24 hours to publish the label to the users app. So I click on done and I'll come back to that as soon as I can. Back to Sean Walton's mailbox. So how do these sensitivity labels carry through to here? Well, let's start a new email. Okay, pop up that.

44:53 We can put the tour and you can put some email body in there. But you can see now, look, I've got this tab here, sensitivity. And you can see that our confidential client label is there. So I can simply apply that manually to this email and all the security we've configured with the label will be applied to this email. Now you can see that Sha has manually added this but if you remember when we were setting up the label you've got various options. We've got auto labeling where if you put some data in this email this label will automatically apply. We've also got settings such as we've got to force people to choose a label before they can do anything. Okay? So, they can write an email, but before I send it, they've got to choose what label it is. So, again,

45:38 it's an extra step for users, but it does help to protect your data. That's email going over to things like Microsoft Word. Again, we've got this here. Look, and we've got that confidential client label there. Again, we can automatically apply labels based on the data. So you can see that labels along with DLP are very very powerful. So with DLP stopping data leakage and sensitivity labels locking things down from the start, Hawthorne Bell and now data secure. I hope you've enjoyed this video. I look forward to seeing again