Session Abstract

It is 4:55 PM, the end of the business day. You're about to leave when your manager asks you to send the latest report to an external recipient before 5:00 PM. To save time, you ask Microsoft 365 Copilot to draft the email, find the right document, and prepare everything for sending. With the clock ticking, you click Send. Moments later, Microsoft Purview Data Loss Prevention detects sensitive information. A policy is triggered, an alert is raised, and activity starts appearing across Purview. But what actually happened? Did the email leave the organization? Which content triggered the policy? Was the action blocked, overridden, or attempted another way? In this session, we investigate the incident from the perspective of a security analyst. Using DLP alerts, Audit, and eDiscovery, we reconstruct the full sequence of events and follow the data trail to uncover exactly what happened. Then we replay the same scenario with the right controls in place. We use Classification, Sensitivity Labels, and DLP to protect the information and explore what happens when a user attempts to bypass those controls through relabeling, label downgrades, or alternative workflows. Through one rushed end-of-day email, you'll see how prevention, detection, investigation, and evidence collection come together in Microsoft Purview, and why a breach that never happened can be just as valuable as one that did.

Bram de Jager

Bram de Jager is a seasoned professional with a passion for architecting robust solutions within the Microsoft ecosystem. His expertise lies at the intersection of Data Security & Compliance and Information Management in the Microsoft 365 environment. Bram’s commitment to excellence has earned him the prestigious Microsoft Certified Master (MCM) certification, a testament to his deep technical knowledge and practical experience. As a Microsoft 365 & Security Architect at Advice Matters, Bram leverages his expertise to design and implement secure and efficient Microsoft 365 solutions. Whether it’s configuring compliance features, managing identities, or safeguarding sensitive data, Bram ensures organizations can harness the full potential of Microsoft’s productivity suite and helps navigate their cloud journey. His dedication to enhancing data security and protection within the Microsoft 365 ecosystem makes him an invaluable asset to organizations seeking to thrive in the digital age. Bram’s commitment extends beyond technical excellence. He actively contributes to the community as a Microsoft MVP, sharing insights, best practices, and real-world experiences through conferences, webinars, and blog posts. He is active as a board member of two user groups in The Netherlands: the DIWUG and DSSCC. His passion for continuous learning and knowledge dissemination makes him a sought-after speaker at industry events. When not immersed in technology, Bram enjoys exploring Europe with the family, workout at the gym or play tennis, and savoring a good cup of coffee. Connect with Bram on LinkedIn to stay updated on his latest endeavors and insights.