MS-4002 – Prepare security and compliance to support Microsoft 365 Copilot

Modules

Module 1: Implement Microsoft 365 Copilot

This module covers the essential tasks administrators must complete when implementing Microsoft 365 Copilot. Topics include prerequisites, data preparation for search, licence assignment, and extending Copilot functionality.

Learning objectives
By the end of this module, you will be able to:

• Identify the prerequisites for Microsoft 365 Copilot.
• Implement SharePoint Advanced Management as part of Copilot preparation.
• Prepare organisational data for Microsoft 365 Copilot search.
• Assign Microsoft 365 Copilot licences.
• Identify Microsoft 365 security features that mitigate data oversharing in Copilot.
• Explain how Copilot agents extend Microsoft 365 Copilot functionality.
• Promote adoption by establishing a Copilot Centre of Excellence.

Module 2: Manage secure user access in Microsoft 365

This module explores the tools and features available in Microsoft 365 to protect and secure user access, including Conditional Access, multifactor authentication, self-service password management, Smart Lockout, and security defaults.

Learning objectives
By the end of this module, you will be able to:

• Manage user passwords.
• Create Conditional Access policies.
• Enable security defaults.
• Describe pass-through authentication.
• Enable multifactor authentication (MFA).
• Describe self-service password management.
• Implement Microsoft Entra Smart Lockout.

Module 3: Manage permissions, roles, and role groups in Microsoft 365

This module examines Microsoft 365’s permission model, including the use of roles and role groups. It also covers role management best practices, delegation, and privilege elevation.

Learning objectives
By the end of this module, you will be able to:

• Explain how roles are used within the Microsoft 365 ecosystem.
• Describe the Azure role-based access control (RBAC) permission model in Microsoft 365.
• Identify the key responsibilities of common Microsoft 365 admin roles.
• Apply best practices when configuring admin roles.
• Delegate admin roles to partners.
• Implement role groups in Microsoft 365.
• Manage permissions using administrative units in Microsoft Entra ID.
• Manage SharePoint permissions to reduce oversharing risks.
• Elevate privileges to access admin centres by using Microsoft Entra ID Privileged Identity Management (PIM).

Module 4: Deploy Microsoft 365 Apps for enterprise

This module outlines how to implement Microsoft 365 Apps for enterprise through both user-driven and centralised deployment methods.

Learning objectives
By the end of this module, you will be able to:

• Describe the features of Microsoft 365 Apps for enterprise.
• Plan a deployment strategy for Microsoft 365 Apps for enterprise.
• Perform a user-driven installation of Microsoft 365 Apps for enterprise.
• Deploy Microsoft 365 Apps for enterprise with Microsoft Endpoint Configuration Manager.
• Identify options for centralised deployment management.
• Deploy Microsoft 365 Apps for enterprise using the Office Deployment Toolkit.
• Manage Microsoft 365 Apps for enterprise updates.
• Determine the correct update channel and application method for your organisation.
• Add Microsoft 365 Apps for enterprise to Microsoft Intune.
• Deploy Microsoft 365 Apps for enterprise security baselines.

Module 5: Implement Microsoft Purview Data Loss Prevention

This module examines how organisations can use Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data and define protective actions when DLP rules are triggered.

Learning objectives
By the end of this module, you will be able to:

• Create a data loss prevention implementation plan.
• Implement Microsoft 365’s default DLP policy.
• Create a custom DLP policy from a template and from scratch.
• Configure email notifications and policy tips for users when a DLP rule is applied.

Module 6: Implement sensitivity labels

This module explains how to implement sensitivity labels, covering administrative permissions, deployment strategy, label creation, configuration, publishing, and label lifecycle management.

Learning objectives
By the end of this module, you will be able to:

• Develop a deployment strategy for sensitivity labels that meets organisational requirements.
• Enable sensitivity labels in SharePoint Online and OneDrive for encrypted file usage.
• Create and configure sensitivity labels.
• Publish sensitivity labels by creating a label policy.
• Distinguish between removing and deleting sensitivity labels.

Module 7: Manage Microsoft 365 Copilot extensibility

This module explores administrative tasks related to extending Microsoft 365 Copilot, including managing Copilot agents and working with Microsoft Graph connectors.

Learning objectives
By the end of this module, you will be able to:

• Manage Copilot agents within integrated apps.
• Create connections between data sources and Microsoft Graph connectors.
• Monitor your organisation’s Microsoft Graph connectors.
• Manage how Microsoft Graph connector content is displayed in Microsoft Copilot.