Cover of SharePoint Online Governance, Security, and Compliance Field Guide
SharePoint Online Field Guides

SharePoint Online Governance, Security, and Compliance Field Guide

Microsoft Purview retention, sensitivity labels, DLP, and Copilot readiness for Microsoft 365 administrators

This is the companion page for SharePoint Online Governance, Security, and Compliance Field Guide. If the book is in your hands, start with the placement quiz: it tells you which chapters to read first. The chapter map, the hardest SharePoint questions answered in full, and the topics sitting just outside the book are all on this page.

Get the book on Amazon See where you are

What this guide covers

SharePoint Online and OneDrive do not have a compliance engine. They have three of them, stacked. The native SharePoint admin center owns sharing, site lifecycle, and quotas. SharePoint Advanced Management adds the governance and oversharing controls the base service leaves out. Microsoft Purview owns retention, labels, DLP, and eDiscovery from an entirely separate portal. None of these layers subsumes the others. They carry different licenses, and the licensing trigger that quietly unlocks the middle one is a Copilot seat you may already own without knowing it activates anything.

The failure mode that costs the most is silence. Configure a retention policy in the wrong place and nothing preserves. Publish a sensitivity label that never touches the Teams file tab you assumed it protected. Turn on a DLP policy before anyone reviewed simulation. In every case the portal saves cleanly and reports no error, so the gap surfaces during an audit instead of during setup.

This book is the connected account the documentation scatters across dozens of pages. It walks the full stack, names each silent failure before you hit it, and marks exactly which control lives in which portal and under which license gate. Every product specific is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab. You do not need a production tenant to follow along; a trial tenant is enough, and every walkthrough cleans up after itself.

Chapter map

  1. The SharePoint and OneDrive Governance and Compliance Stack
  2. Licensing and Prerequisites
  3. Retention Policies for SharePoint and OneDrive
  4. Retention Labels and Records Management in SharePoint
  5. Data Loss Prevention for SharePoint and OneDrive
  6. Sensitivity Labels for Files and the SharePoint Co-Authoring Pipeline
  7. Container Labels: Protecting SharePoint Sites and OneDrive with Sensitivity Labels
  8. SharePoint Advanced Management: Restricted Access Control and Content Discovery
  9. Data Access Governance Reports, Site Access Reviews, and Change History
  10. Conditional Access, Block-Download, and Unmanaged Device Controls
  11. OneDrive Governance: Sharing, Departed Users, and Retention
  12. Information Barriers and Auditing SharePoint Activity
  13. Before You Go to Production: Governance Readiness Checklist

Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.

Who it is for

This is for SharePoint and Microsoft 365 administrators, compliance and security engineers, and consultants who run governance projects that span the SharePoint admin center and Purview and need the moving parts connected rather than listed. It is also for anyone studying MS-102 (Microsoft 365 Administrator) or SC-401 (Information Security Administrator Associate) who wants depth beyond exam cramming.

See where you are

7 questions from this guide's territory (3 easy, 4 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of SharePoint Online Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

  • Cover of SharePoint Online Administration and Migration Field Guide
    Field guide

    SharePoint Online Administration and Migration Field Guide

    SharePoint Online has no servers for you to patch, which is exactly why its failures are harder to find.

  • Cover of SharePoint Online Content, Metadata, and Search Field Guide
    Field guide

    SharePoint Online Content, Metadata, and Search Field Guide

    The column nobody indexed. The term set left open.

    Publishing$12.99Companion page
  • Cover of SharePoint Online Permissions and Sharing Field Guide
    Field guide

    SharePoint Online Permissions and Sharing Field Guide

    You can build a textbook-correct site permission model and still watch an Anyone link walk a document out to an unauthenticated stranger.

  • Cover of SharePoint Online Sites and Architecture Field Guide
    Field guide

    SharePoint Online Sites and Architecture Field Guide

    Clearing the self-service site creation checkbox does not stop sites from appearing. Someone spins up a Team and a site appears anyway, through a pipeline the checkbox never touched.

    Publishing$12.99Companion page

The hard set (3 questions)

The hardest SharePoint questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

A user's Microsoft 365 account is deleted. By default, how long are that user's OneDrive files preserved, and who automatically receives access to them?

Correct answer: A. Files are preserved for 30 days and the user's manager automatically receives access

Microsoft Learn states that when a user's Microsoft 365 account is deleted, their OneDrive files are preserved for 30 days. By default, the deleted user's manager is automatically given access to the user's OneDrive. Both the retention period and the manager access behavior can be changed by the administrator.

Why the other options are wrong:

  • B. The default preservation period is 30 days, not 90, and access defaults to the manager, not the IT administrator.
  • C. Files are not deleted immediately upon account deletion. The 30-day preservation window applies before any deletion.
  • D. The default period is 30 days, not 180, and the manager does receive automatic access by default.

Memory hook: OneDrive orphan rule: 30 days, manager gets the keys. Both numbers are configurable, but 30 and manager are the out-of-box defaults.

Microsoft Learn: Compliant environment

An administrator applies a sensitivity label to a SharePoint team site. The label is configured with the 'Private' privacy setting and the 'Only people in your organization' external sharing option. A site owner later tries to change the site privacy from Private to Public in SharePoint settings. What happens?

Correct answer: C. The privacy setting is locked by the sensitivity label; the site owner must remove or change the label before altering privacy

Microsoft Learn states that when a sensitivity label sets privacy to Public or Private on a container (site or group), that setting is locked. Users cannot change the privacy setting while the label is applied. To change privacy, the site owner (or administrator) must first remove or change the sensitivity label from the site.

Why the other options are wrong:

  • A. The premise fails at the first step: the label locks the privacy setting, so the site owner cannot change it to Public at all while the label is applied. There is no partial change that flips privacy while leaving only the sharing control enforced.
  • B. Site owners cannot override the privacy setting enforced by a sensitivity label. The label locks the value until removed.
  • D. There is no 24-hour revert mechanism. The label continuously enforces the privacy setting; once changed via the label, the privacy follows the label.

Memory hook: Label = lock. Once a sensitivity label sets privacy, only removing or swapping the label unlocks the dial.

Microsoft Learn: Sensitivity labels Teams groups sites

A SharePoint document has a retention label that marks it as a record, and record versioning is enabled. The record is currently Locked. A user sets the Record status to Unlocked to make an update. What happens at the moment of unlocking?

Correct answer: C. A Copy to action copies only the latest version of the document into the Records folder of the site's Preservation Hold library, and the document becomes editable but still cannot be deleted.

When a locked record is unlocked, SharePoint performs a Copy to that stores ONLY the latest version (no prior versions) in the Records folder of the site's Preservation Hold library; that copy is flagged 'Record' in version history. The original then becomes editable but still can't be deleted, and 'Item is a Record' stays Yes. A retained record version is captured each time you unlock.

Why the other options are wrong:

  • A. Unlocking doesn't remove the record label; the item remains a record ('Item is a Record' = Yes) and merely becomes editable.
  • B. Only the latest version is copied (not all prior versions), and the document is not removed from the library.
  • D. It is the unlock action itself that copies the version to the Records folder; preservation happens at unlock, not at re-lock.

Memory hook: Unlock = snapshot: the LATEST version is copied to the Records folder; still a record, still undeletable.

Microsoft Learn: Record versioning

Exam prep? The SharePoint sampler scores you by topic and points you to the guide behind each miss.

Take the SharePoint sampler Every SharePoint practice question, with explanations