SharePoint Security Best Practices using Conditional Access, Cloud Apps, Authentication Context

I`m always getting asked what are the most popular SharePoint Security Best Practices that you can consider that we can apply to our SharePoint sites for increased security controls and compliance once we have created our sites.
This video covers some best practices ranging from controlling user access, defining sensitivity labels, conditional access policies to apply to individual SharePoint sites using authentication contexts, lockdown using Microsoft Defender for Cloud Apps to prevent copy, download and printing of SharePoint content, policies to prevent unmanaged device access, web only access, mfa for internal and external users and lots more.
👌 Contents of this video 👌
00:08 Intro
01:22 Control access to SharePoint sites with Authentication Context
02:23 Define sensitivity labels using Microsoft Information Protection (MIP)
03:16 Apply an authentication context to a site using PowerShell
03:49 Create CA policy to use SharePoint Authentication Context
04:58 Connect SharePoint Conditional Access App in Cloud Apps
05:31 Defender for Cloud Apps block downloads sensitivity labels
06:30 Demo block downloads policy
07:07 Cloud Apps DLP policy to block cut, paste and print
08:56 Block Unmanaged Devices from SharePoint and OneDrive
10:05 Conditional Access Policy for Internal and External Users MFA
11:21 Block a Users SharePoint Access Using Conditional Access Policy
11:47 SharePoint and OneDrive External Sharing Configuration
12:27 SharePoint access control using web only access
15:52 Demo web only access
16:45 More SharePoint access control settings
👌 Check out my Social Media pages 👌
💡 Blog at Cloudinspired.com
www.cloudinspired.com
💡 Twitter(X)
/ cloud_inspired
💡 Subscribe here, new videos posted weekly
/ @cloudinspired
👌Documents referenced in this video 👌
💡Assign sensitivity labels to Microsoft 365 groups in Microsoft Entra ID
learn.microsoft.com/en-us/ent...
💡Apply an authentication context to a site using PowerShell
learn.microsoft.com/en-us/sha...
#sharepoint
#sharepointonline
#defender
#cloud

[@jc9923]

Would this be the optimal method for exempting one specific SharePoint site from all other CA policies? We limit access to our SPO environment via web browser to compliant systems only, but we have a site that we need exempted from those policies. If so, can that be accomplished without sensitivity labels?

[@CloudInspired]

Authentication Context is basically a tag that you can apply to SharePoint Online sites.
You can then create a conditional access policies to use the context to control access to the SharePoint site.
The sensitivity label method would be recommened to allow multiple settings to be applied as shown in the video.