NexlinksField Notes from a CTO & CISO
Menu
Practical perspectives on Microsoft technology and hybrid infrastructure. Read the October 2026 newsletter ↗

COMMUNITY QUESTIONS

Microsoft 365 & Security: Questions & Answers

Practical answers to questions I have received through LinkedIn, this website, community meetings, and online webinars.

Answers by Phil Kinsley. Collected February 2025 through October 2026.

Contributor names and identifying handles are omitted because permission to publish them was not requested at the time. Questions are edited for clarity.

Answers reviewed October 18, 2026. Submission dates are preserved below.

Licensing, supported platforms, and tenant configuration can change. Check the requirements that apply to your environment before making changes.

Have a question?

Send it privately to Phil. You can choose whether it may be published anonymously.

Ask a question ↗

Page 3 of 5 · Questions 31–45 of 69

Questions on this page
  1. Starting a usable sensitivity label scheme
  2. Deciding what to retain and what to delete
  3. Rolling out DLP without blocking normal work
  4. Understanding what a Teams retention policy covers
  5. Checking whether audit evidence will be available
  6. Preserving content with an eDiscovery hold
  7. Understanding Copilot and existing file permissions
  8. Explaining which Copilot experience employees should use
  9. Preparing a Microsoft 365 Copilot pilot
  10. Adding risk based Conditional Access
  11. Responding to token theft after a password reset
  12. Replacing standing administrator roles with PIM
  13. Removing guest access through recurring reviews
  14. Deciding where Defender XDR ends and Sentinel begins
  15. Reducing Sentinel costs while preserving detection

QUESTION 31 · Microsoft Purview

Starting a usable sensitivity label scheme

Submitted December 9, 2025 at 10:12 AM EST

We want sensitivity labels, but the proposed scheme has 18 choices. How would you start with something people can use while still protecting confidential documents?

Phil Kinsley:

Start with labels that change how people handle information. For example, Public can allow unrestricted sharing, while Confidential can identify material requiring restricted access. Agree the categories with the people who own the data before configuring protection.

A label name or header does not encrypt a document. Configure encryption, permissions, and content markings where required, then publish the label policy to a pilot group. Check the licenses for manual and automatic labeling separately.

Test coauthoring, external recipients, and recovery from a wrong label in the applications staff use. A label applied to a Team or SharePoint site controls supported container settings; it does not automatically label every file inside it. Add mandatory labeling or more categories only when users can reliably distinguish the initial choices.

QUESTION 32 · Microsoft Purview

Deciding what to retain and what to delete

Submitted December 19, 2025 at 3:48 PM EST

A manager wants every Microsoft 365 item retained forever because storage is cheaper than losing evidence. Is that a sound retention strategy?

Phil Kinsley:

Have records and legal owners approve the retention schedule. The administrator should know the content category, retention period, starting event, and disposal decision before creating a policy.

Use Purview retention policies for suitable workload or location-wide requirements and retention labels for item-level requirements. Retention labels and sensitivity labels are different: Confidential does not specify how long a file must be kept.

Check overlapping policies and holds before enabling deletion. A user can delete an item from view while a preserved copy remains available for compliance purposes. Test representative items and explain the expected behavior to records owners. Do not use an indefinite retention period simply because nobody has agreed when disposal should occur.

QUESTION 33 · Microsoft Purview

Rolling out DLP without blocking normal work

Submitted January 7, 2026 at 9:23 AM EST

We need to stop sensitive customer information leaving Microsoft 365, but a previous DLP pilot blocked legitimate documents. What would you change in the rollout?

Phil Kinsley:

Choose one transfer you need to control, such as a customer export being emailed externally. Identify the data pattern or sensitivity label and the workloads that must enforce the rule.

Run the policy in simulation or the relevant test mode first. Include approved sample data that should match and similar data that should not. Review the actual matched condition with the business owner before weakening it with a broad exclusion.

Pilot policy tips, override justification where allowed, and alert handling. Then enforce the same scenario and repeat the tests. Email, SharePoint, endpoints, and other applications have different coverage and licensing requirements. Record which paths you tested; one passing email test does not demonstrate that copying through an unmanaged browser or another application is covered.

QUESTION 34 · Microsoft Teams

Understanding what a Teams retention policy covers

Submitted January 19, 2026 at 1:54 PM EST

We configured a retention policy for Teams messages. Does that also retain the documents, meeting recordings, and other files people share in Teams?

Phil Kinsley:

Treat messages and files as separate retention locations. A Teams message-retention policy does not automatically retain the files linked in those messages.

Standard channel files are stored in the team's SharePoint site. Private and shared channels use separate sites. Files uploaded in chats commonly reside in the sender's OneDrive. Meeting recordings and transcripts have their own storage and retention behavior, which also varies with meeting type.

Make a short inventory of messages, files, recordings, and transcripts, with the location and policy for each. Test an item from every required type. Check what disappears from the user interface and what remains discoverable under retention or hold. This will expose gaps that a single setting labeled Teams can hide.

QUESTION 35 · Audit and evidence

Checking whether audit evidence will be available

Submitted January 29, 2026 at 4:09 PM EST

We have Microsoft 365 E3 and a few E5 users. An auditor asked for activity from last year. How do I determine what is available instead of assuming E5 gives the whole tenant longer audit history?

Phil Kinsley:

Check the person whose activity generated the event, the workload, and the retention policy. Assigning E5 to a few administrators does not give every user's activity the same retention.

Audit Standard generally retains records for 180 days. For appropriately licensed users, Audit Premium's default retains specified Entra, Exchange, SharePoint, and OneDrive records for one year; other activity can still have different retention. Custom policies and longer-retention add-ons need a separate review.

Search for a known event with a narrow UTC time range before promising an export. Preserve the search parameters and distinguish no matching activity from expired or unavailable evidence. An upgrade today cannot recover records that have already expired. Also keep Purview Audit retention separate from retention of logs in the Entra portal or a Log Analytics workspace.

QUESTION 36 · Microsoft Purview

Preserving content with an eDiscovery hold

Submitted February 5, 2026 at 10:39 AM EST

Our legal team asked IT to preserve a departing employee's email and project documents. What technical steps should happen before we delete the account?

Phil Kinsley:

Have the authorized case owner identify the custodians, content locations, and any approved query. Include relevant SharePoint and OneDrive sites, shared mailboxes, and Teams-related sources rather than assuming the employee's mailbox contains everything.

Create the hold in the authorized Purview eDiscovery case and check source resolution, errors, and deployment status. Microsoft says a new hold can take up to 24 hours to take effect. Verify preservation before deleting identities or removing licenses that the preservation design needs.

Check licensing and case permissions for the people and workloads in scope. Keep access termination moving separately: blocking sign-in does not require waiting for the hold to finish. Record who authorized the hold and who can later change or release it.

QUESTION 37 · Copilot and AI governance

Understanding Copilot and existing file permissions

Submitted February 17, 2026 at 2:16 PM EST

People keep telling us Copilot respects existing permissions, so there is no additional data security work to do. Is that enough assurance before we turn it on?

Phil Kinsley:

Microsoft 365 Copilot uses the user's existing authorization to organizational content. If an employee can already read an overshared library, Copilot can make that material easier to find; the permission check has not repaired the underlying oversharing.

Review broad groups, old links, sensitive sites, ownerless content, and outdated documents before expanding rollout. Give each owner a list of the specific files, groups, or links that need attention.

Pilot with users in different roles and test both permitted and denied access. Review encryption rights, sensitivity labels, and any discovery restrictions used during cleanup. Discovery restrictions can reduce what Copilot surfaces in supported scenarios, but they are not a replacement for correcting the actual permissions. Review agents and connectors separately because their authentication and data paths may differ.

QUESTION 38 · Copilot and AI governance

Explaining which Copilot experience employees should use

Submitted February 27, 2026 at 8:47 AM EST

Staff see several Copilot entry points and assume they all handle company data the same way. How should we explain the difference without giving everyone a licensing lecture?

Phil Kinsley:

Tell staff exactly which work-account experience is approved and what information they may put into it. Microsoft 365 Copilot, Copilot Chat, consumer Copilot, and third-party agents are not interchangeable privacy or access configurations.

For Microsoft 365 Copilot and Copilot Chat under the applicable enterprise terms, Microsoft states that prompts and responses are not used to train the underlying foundation models. Copilot Chat does not gain the same organizational grounding as a licensed Microsoft 365 Copilot experience merely because the user signs in with a work account. Uploaded files and agents can introduce additional data access.

Show users how to confirm the account and product they are using. Explain approved uploads, agent use, and external connections. Review web-search handling and third-party terms separately; the enterprise protection statement is not permission to send every category of company information through every feature.

QUESTION 39 · Copilot and AI governance

Preparing a Microsoft 365 Copilot pilot

Submitted March 6, 2026 at 11:28 AM EST

We have approval for 40 Copilot users. What concrete checks would you complete before assigning the licenses and asking people to experiment?

Phil Kinsley:

Pick two or three tasks the pilot should improve, such as locating approved project material or drafting from an internal policy. Name the users, the source material, and how you will judge the answer.

Before licensing the pilot, review access to the relevant SharePoint and OneDrive content. Resolve sensitive Anyone links, broad groups, missing owners, and outdated source documents. Configure labels and protection where needed.

Review agents and connectors with the same attention: who authenticates, which data is reachable, and whether a tool can act using a shared connection. Test an authorized user and a user who should be denied. Measure answer accuracy, time saved on the selected task, and access problems found. Usage totals alone will not tell you whether the pilot is ready to expand.

QUESTION 40 · Identity and access

Adding risk based Conditional Access

Submitted March 17, 2026 at 3:02 PM EDT

We already require MFA. With Entra ID P2 available, how would you introduce user-risk and sign-in-risk policies without creating another confusing set of prompts?

Phil Kinsley:

Sign-in risk assesses a particular authentication attempt. User risk concerns the likelihood that the identity is compromised. Risk-based Conditional Access requires the relevant Entra ID P2 or Entra Suite entitlement for users in scope.

Use separate policies so the response is understandable. For user risk, current guidance includes Require risk remediation: password users complete a secure password change after MFA, while passwordless users have sessions revoked and must reauthenticate. Check the required SSPR, password-writeback, or federation setup for the identity model.

For sign-in risk, require the appropriate authentication control and test the resulting experience. Start in report-only mode, retain emergency-access exclusions, and establish a help desk route for failed remediation. Do not disable or reset a real user's account merely to manufacture a predictable test risk score.

QUESTION 41 · Incident response

Responding to token theft after a password reset

Submitted March 30, 2026 at 9:44 AM EDT

We reset a compromised user's password, but we are worried an attacker still has a session. Does a password reset immediately end all Microsoft 365 and connected application access?

Phil Kinsley:

A password reset alone is not a reliable answer to token theft. Access tokens, refresh tokens, and application-owned session cookies have different revocation behavior.

Block the affected identity where required, revoke sign-in sessions, and investigate how the session was stolen. Review authentication methods, consent grants, mailbox access, and newly created credentials or other persistence. If the endpoint remains compromised, the attacker may steal another session after the user signs in again.

Check the affected applications individually. Entra session revocation prevents supported token renewal, while an already issued access token may remain usable until expiry unless the resource supports a relevant Continuous Access Evaluation event. Some applications need their own session termination. Verify that activity stops at the affected workloads rather than closing the incident when the password-reset command succeeds.

QUESTION 42 · Privileged access

Replacing standing administrator roles with PIM

Submitted April 7, 2026 at 1:07 PM EDT

Several IT staff have permanent Global Administrator because they occasionally need it. How should we introduce Privileged Identity Management without slowing ordinary support work?

Phil Kinsley:

Inventory permanent administrator assignments and map the common tasks to narrower roles before moving them into PIM. An unnecessarily broad role remains broad during its activation window.

PIM for Entra roles requires an appropriate Entra ID P2 or ID Governance entitlement. Make suitable everyday assignments eligible, then set activation duration, authentication, justification, notifications, and approval where needed. Test actual support work and what happens when the approver is unavailable.

Retain the independently protected, permanently active emergency Global Administrator accounts. For normal administrators, verify activation, expiry, and the resulting application access before removing the old permanent assignment. Some sessions or applications do not reflect a role change immediately, so test the resource rather than relying only on the assignment display.

QUESTION 43 · Identity governance

Removing guest access through recurring reviews

Submitted April 20, 2026 at 8:36 AM EDT

We have hundreds of guests and nobody knows which projects are still active. Can Entra access reviews clean this up, or will we just send owners another email they ignore?

Phil Kinsley:

Start with guest membership of selected project groups and give each review to a project owner who knows whether the relationship is still active. Configure recurrence, reminders, the decision deadline, and the treatment of unanswered reviews.

Check whether results are applied automatically. If not, somebody must apply them and verify processing completed. Test a guest whose access should remain and one whose access should be removed.

Removing membership from one reviewed group does not remove direct SharePoint permissions, other group memberships, or every application assignment. Check those paths before claiming the guest has no access. Guest identity deletion is a separate decision. Confirm the license for the particular review feature; basic reviews and newer ID Governance capabilities do not all have identical entitlements.

QUESTION 44 · Security operations

Deciding where Defender XDR ends and Sentinel begins

Submitted May 6, 2026 at 3:21 PM EDT

We already investigate incidents in Defender XDR. What would justify adding Microsoft Sentinel, especially now that the experiences are becoming more connected?

Phil Kinsley:

Defender XDR correlates incidents across supported security workloads. Sentinel provides broader SIEM collection, analytics, hunting, and automation for the data sources you connect. Use your investigation requirements to decide whether you need both.

For example, you may need to correlate a Microsoft identity incident with a firewall, another cloud, or a business application. Identify those sources and the detections they support before ingesting everything. Also compare retention and custom-query requirements with what is already available in Defender.

When integrating, test incident ownership, synchronization, analytics rules, and response automation. Check the connector documentation before retaining parallel rules that create duplicate incidents. A shared portal does not make ingestion, retention, or automation free, and it does not decide which team responds.

QUESTION 45 · Security operations

Reducing Sentinel costs while preserving detection

Submitted May 18, 2026 at 9:18 AM EDT

Our Sentinel bill keeps growing. Finance wants us to cut ingestion in half. How can we find savings without removing the logs our detections actually depend on?

Phil Kinsley:

Start with the tables and connectors responsible for the bill. For each expensive source, identify the detections, hunts, and investigation requirements that use it.

Remove duplicate collection and unnecessary verbosity only after checking those dependencies. Where the source supports ingestion-time filtering or transformations, test that the required events and fields still arrive. For Basic, Auxiliary, Analytics, or other supported storage choices, check query, alerting, retention, and charge differences rather than comparing ingestion price alone.

Pilot one source and exercise its affected detection before expanding. Track actual billable volume and retention charges. A Log Analytics daily cap can interrupt collection and is not a dependable way to preserve a known set of security events under a fixed budget. Use cost alerts and deliberate collection choices first.

← Back to Community & Technical Resources