Sensitive info types and classifiers
Every protection feature in Microsoft Purview starts with the same question: how do you recognise the sensitive content? Labels, DLP and retention all use the detection methods below.
Sensitive information types (SITs)
A sensitive information type detects content by pattern. Microsoft ships over 300 built-in SITs, such as Credit Card Number or U.S. Social Security Number. A SIT combines:
- a primary element: a regular expression, keyword list or function
- supporting elements, such as nearby keywords
- a confidence level (low 65, medium 75, high 85)
Create a custom SIT in the Microsoft Purview portal under Data classification. For a code such as pjt plus six digits plus sct, use a regular expression like pjt\d{6}sct.
Keyword dictionaries
A keyword dictionary is a large list of words used inside a SIT. Upload it as a text or CSV file, one term per line or comma separated. Use it for product names, project names or any list too long for a simple keyword list.
Exact Data Match (EDM)
EDM compares content with a table of real values (for example customers or employees). You save the table as a CSV or TSV, define a schema, hash the data with the EDM upload agent, and upload it. Pick EDM when a pattern alone gives too many false positives.
Document fingerprinting
Fingerprinting converts a blank form or template into a SIT. Files that use the same wording and layout match, even if the fields are filled in. Fingerprint the single template, not hundreds of samples. Create it with PowerShell (New-DlpFingerprint, then New-DlpSensitiveInformationType).
Trainable classifiers
A trainable classifier recognises content by meaning, not pattern. It is the right choice for contracts, resumes or source code.
| Type | How it works |
|---|---|
| Pre-trained | Built in and ready to use |
| Custom | You supply positive seed samples (at least 50, up to 500) from SharePoint Online, then test and publish |
Which to choose
| Content | Method |
|---|---|
| Structured IDs, card numbers | Built-in or custom SIT |
| Long word lists | Keyword dictionary |
| Real records in a table | EDM |
| Forms from a template | Fingerprint |
| Documents by type or topic | Trainable classifier |
Exam traps
- A fingerprint matches documents based on a template. EDM matches real data values from a table.
- Seed content for trainable classifiers lives in SharePoint Online, not OneDrive, Exchange or file shares.
- A dictionary is not a separate object type. It lives inside a SIT.
- Classifiers detect content. They do not protect it. Pair them with a label, DLP or retention policy.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. You need to add a list of 500 project code names that must be detected in email. What do you create?
Show answer
Answer: B.A keyword dictionary is created as part of a custom sensitive info type. Labels and retention do not detect content by themselves.
2. You must detect employee records by matching against a table of real employee IDs and names stored in a CSV file. Which feature fits?
Show answer
Answer: B.EDM matches content against hashed values from a structured table of real data, which gives very few false positives.
3. HR has a standard Offer Letter template. You need to detect forms that are filled in from that template. What should you use?
Show answer
Answer: A.A document fingerprint turns a template into a sensitive info type and matches documents built from the same pattern.
4. You are training a custom trainable classifier with seed content. Where must the seed files be stored?
Show answer
Answer: C.Seed content for a trainable classifier must be in a SharePoint Online site or library, with at least 50 positive samples (a larger set is better).