Zied Berrima

Strengthening the data protection strategy in Microsoft 365 within a demanding regulatory context, without compromising business continuity or user experience. Initial Diagnosis: Audit revealing a weak security posture, exposed to data leaks without detection or awareness. Development of a corrective, progressive roadmap adapted to the business context. Validated Improvement Areas: Redesign of sensitivity labels with a reinforced security model for confidential data (e.g., blocking transfer, printing, copy-paste, restricted access). Structuring by business unit, hybrid classification (auto + manual), exploitation of Content/Activity Explorer, and optimization of DLP (expanded SITs, educational alerts). Securing the use of Microsoft Copilot: review of existing risk analysis, detection of quick wins, identification of sensitive exposures (e.g., open SharePoint sites). Deployment of protection labels to prevent the use of confidential data in Copilot, complemented by proactive monitoring via Communication Compliance. POC & Field Validation: Conducting a POC of restrictive labels covering critical uses (editing, sharing, co-editing, B2B, mobile). Tests conducted on managed devices to measure the impact of restrictions on productivity and validate effective protection without harming user experience. Deliverables & Skills Transfer: Writing and delivering project deliverables (status reports, technical design documents, administration guides, user guides). Facilitating skills transfer workshops for Purview administrators and L2 support teams. Contribution to structured project management in collaboration with project managers: participation in defining the RACI, planning (GANTT), scoping security/business needs, validating Steering Committee decisions, and change management support for stakeholders.

Role: Microsoft Cybersecurity Consultant Securing the Microsoft 365 environment: Zero Trust ENTRA ID and Data Protection via Purview

Duration: 05/2023 – 06/2024

Identity Protection: admins and VIPs with hardening action proposals: PAW and access via Trusted IP Address

Audit the proper implementation of MFA and secure methods: Auth Strength

Protection of VIP SharePoint sites: Auth context for Teams/SharePoint via Sensitive Label for M365 groups to secure access to sensitive sites/Teams

Audit Entra ID security posture via Purple Knight/identity secure score

Audit guests and apply governance: Authorized domains + Access Review + Conditional Access to require MFA and Terms of Use

Identity analysis and reporting via PowerShell: extraction of MFA statuses, detection of guest accounts in groups, and access compliance monitoring.

Review of sensitive data access policy:

Data protection via Purview: create a data DNA to protect it regardless of its location: classification and protection via sensitive labels and DLP: avoid data breaches and the use of data in public AI: ChatGPT

Hardening the environment before deploying M365 Copilot: Microsoft Purview: data classification and protection / Audit SharePoint, public Teams / sharing links / communication compliance via Purview to ensure compliant communication with M365 Copilot chat

Manage Exchange Online components: Respond to requests for adding mail domains Support and troubleshoot mail issues: message trace, EO rules Implement DMARC, DKIM, and SPF, and anti-spam rules. Attack simulator to ensure user vigilance: awareness Deploy MDO: Safe Link/Attachment for certain VIP accounts Participate in authentication method change projects at the script level following the deactivation of legacy authentication: unattended auth based on certificate for Service Principals Migrate mailboxes hosted by third-party providers