Managing Shadow AI with Microsoft Security

In this lab, you will investigate a real insider threat scenario using Microsoft's integrated security suite. You will navigate Microsoft Defender for Cloud Apps to uncover unsanctioned Generative AI applications, identify users and IP addresses responsible for unauthorized data uploads. You will then move into Microsoft Purview to trigger and review DLP policy alerts, interpret incident reports, examine sensitive information type matches. Finally, you will leverage Microsoft Intune to track down the specific endpoint device tied to the user at the center of the investigation.

• Identify and Investigate Shadow IT Activity Using Microsoft Defender for Cloud Apps
• Validate Data Loss Prevention Controls and Interpret Alerts Using Microsoft Purview
• Understand Policy Scope, User-Level Exceptions, and Override Workflows Across an Organization
• Connect Device Identity to User Activity using Microsoft Intune

• 2x Windows Jumpbox