SC-401 - Data Classification

Data Classification Overview

Data classification in Microsoft Purview is the process of understanding what sensitive data exists in your organization and where it lives. Classification is the foundation for all downstream protection actions - you cannot protect what you cannot identify.

The Microsoft Purview compliance portal provides three main classification approaches:

• Sensitive Information Types (SITs) - pattern-based (regex + keywords) detection for structured data
• Trainable classifiers - machine learning models for unstructured data (documents about certain topics)
• Exact Data Match (EDM) - database-driven exact-token matching for known data sets

Sensitive Information Types (SITs)

A Sensitive Information Type defines a pattern - typically a regular expression combined with supporting evidence (keywords, checksums) - that Purview uses to detect sensitive content.

Microsoft provides 300+ built-in SITs covering common regulated data elements:

Custom SITs

When built-in SITs do not match your data, create custom SITs using:

• Pattern-based - define regex + optional keyword lists and confidence levels
• EDM-based - built on top of Exact Data Match for per-record exact matching
• Document fingerprinting-based - detects forms based on document structure

Confidence Levels

Every SIT match has three confidence levels:

Exact Data Match (EDM)

EDM enables detection of sensitive data that exactly matches records in a database - such as specific employee IDs, patient record numbers, or customer account numbers. Unlike regex SITs that use patterns, EDM compares content against actual data values.

EDM Architecture

EDM Setup Process

1. Create the EDM schema in the Purview compliance portal (define columns, mark searchable fields)
2. Prepare the CSV data file with sensitive records
3. Hash and upload the data using the EDM Upload Agent tool
4. Create an EDM-based SIT referencing the schema
5. Use the EDM SIT in DLP policies, auto-labeling, or Communication Compliance

Trainable Classifiers

Trainable classifiers use machine learning to identify documents by their content and context rather than by pattern matching. They are suitable for unstructured content categories like "HR documents," "source code," or "project contracts."

Types of Classifiers

Custom Classifier Training Process

1. Seed content - provide 50-500 representative positive examples in SharePoint
2. Training phase - Purview learns the model (may take 24+ hours)
3. Test phase - provide 200+ items (positive and negative) to evaluate accuracy
4. Publish - deploy the classifier for use in policies after achieving acceptable accuracy metrics

OCR and Document Fingerprinting

Optical Character Recognition (OCR)

Purview can extract text from images (JPG, PNG, TIFF, BMP) and PDFs to apply classification. OCR enables DLP and auto-labeling to detect sensitive information in scanned documents and screenshots.

• Enabled per-location in DLP and auto-labeling policies
• Supports images embedded in Office documents and PDFs
• Adds processing overhead - consider enabling selectively for high-risk locations
• Maximum image file size for OCR: 20 MB

Document Fingerprinting

Document fingerprinting converts a standard form or template into a SIT. Any document with a similar layout and filled-in content will be detected as a match.

Use cases:

• W-2 tax forms, patent applications, employee onboarding forms
• Any regulatory form that employees fill in with sensitive data
• Works by hashing the blank template structure (word patterns, not content)

Content Explorer and Activity Explorer

Both tools are found under Data Classification in the Microsoft Purview compliance portal and provide different views of your classified data estate:

Key Activity Explorer event types tracked:

• Label applied / changed / removed
• File created / modified / deleted (SharePoint, OneDrive)
• DLP policy matched
• Endpoint activities: file copied to removable media, printed, accessed by unallowed app
• Email sent with label, Teams message labeled