3.1 Document Fingerprinting

SC-401 treats document fingerprinting as the classifier you choose when the layout is stable and the values change. A patent application, a HIPAA authorization, an HR new-hire packet, or a Contoso customer intake form all share the same printed labels—Patent title, Inventors, Description—while every completed copy fills those blanks differently. Pattern-based sensitive information types (SITs) hunt for regexes and keyword dictionaries. Exact Data Match (EDM) looks up hashed employee IDs or account numbers from a reference table. Trainable classifiers score unstructured prose such as resumes or source code. Fingerprinting is none of those: Microsoft Purview converts the unique word pattern of a blank form into a SIT so Data Loss Prevention (DLP) can recognize filled copies of that form.

Why this method exists

Most organizations already have an established practice of using certain forms to transmit sensitive information. Microsoft's canonical example is a patent template. Legal wants to stop regular employees from emailing completed patents outside the company, optionally show a policy tip so the sender confirms the recipient is qualified, and still let the legal department send patents when counsel has a business need. You do not solve that with a regex for the word "Patent" (too many false positives) or with EDM (you do not have a table of every patent's filled-in title). You upload an empty patent form, turn it into a fingerprint SIT, and attach that SIT to a DLP policy. The same pattern works for government forms, HIPAA compliance forms, employee information forms, and custom forms your organization created.

The exam decision boundary is therefore: fixed form layout, changing field values, start from a blank template. If the question instead gives you a database of exact employee IDs, pick EDM. If it gives you unstructured resumes, source code, or harassment language, pick a trainable classifier.

How a fingerprint is stored

Documents do not have biometric fingerprints. The name is a metaphor: a frequently used template has a distinctive pattern of words. You upload a supported, text-based template. Purview extracts the text, requires the extracted length to be between 256 and 204,800 characters, and writes a small Unicode XML file that holds a unique hash of that text. As a security measure, the original document itself is not stored and cannot be reconstructed from the hash. That hash-backed SIT is what policies consume.

Two creation constraints matter on the exam. Text in embedded documents is not considered for fingerprint creation, so you must provide a sample template that does not contain embedded files. Documents to be scanned cannot be password protected and must contain all the text from the original form. If someone saves a completed patent but deletes the instructional paragraphs that were on the blank template, the fingerprint can miss.

Create a fingerprint in the portal and in PowerShell

In the Microsoft Purview portal, go to Data Loss Prevention or Information Protection > Classifiers > Sensitive info types, then choose + Create Fingerprint based SIT. Enter a name and description, upload the blank file you want as the fingerprint template, optionally adjust the requirements for each confidence level, review, and choose Create. That portal path is what the SC-401 bullet "Implement document fingerprinting" is pointing at.

You can do the same work in Security & Compliance PowerShell. Read the template bytes and call New-DlpSensitiveInformationType with -FileData, a -ThresholdConfig such as @{low=40;medium=60;high=80}, -IsExact $false for partial matching, and a description. Add the resulting SIT to a DLP policy with New-DlpComplianceRule and -ContentContainsSensitiveInformation. After SITs sync to Exchange, a mail flow rule can use New-TransportRule with -MessageContainsDataClassification. To change the template later, use Set-DlpSensitiveInformationType with new -FileData. To test classification text, use Test-DataClassification. To remove the SIT, use Remove-DlpSensitiveInformationType.

Creating a new fingerprint from a template that already has a fingerprint is not supported. Edit or migrate the existing fingerprint SIT instead of trying to clone it. To migrate an older fingerprint to the current feature set, open the SIT, choose Edit, and upload the same fingerprint file again.

Partial matching versus exact matching

A filled form is not identical to the blank template, so partial matching is the usual production setting. During template upload you set Low, Medium, or High confidence and designate how much of the fingerprint text must appear, as a percentage between 30% and 90%.

• Low confidence returns the fewest false negatives and the most false positives. It returns all low, medium, and high confidence matches.
• Medium confidence returns an average mix of false positives and false negatives, and it returns medium plus high matches.
• High confidence returns the fewest false positives and the most false negatives.

Exact matching is a different contract. Set the high confidence value to Exact. Only files that have exactly the same text as the fingerprint are detected. If the file has even a small deviation, it will not be detected. On the exam, exact matching is the wrong choice for "detect completed forms" and the right choice only when you must detect an unmodified copy of the template itself.

Where fingerprint SITs can be used

Fingerprint-based SITs can be used as a detection method in DLP policies scoped to Exchange, SharePoint, OneDrive, Teams, and Devices. Microsoft Information Protection (MIP) auto-labeling can use document fingerprinting as a detection method in Exchange, SharePoint, and OneDrive. Detection supports multiple languages, including dual-byte languages such as Chinese, Japanese, and Korean. To use document fingerprinting with devices, Advanced classification scanning and protection must be turned on in endpoint DLP settings.

Limits, licensing, and exam traps

Document fingerprinting does not detect sensitive information in password-protected files, files that contain images only, documents that do not contain all the text from the original form, or files larger than 4 MB. Fingerprints are stored in a separate rule pack with a maximum size of 300 KB; given that limit, you can create approximately 100 fingerprints per tenant.

Licensing is a common distractor. Microsoft recommends that E5 customers update existing fingerprints to take advantage of the full feature set. If you are an E3 customer and you do not upgrade, you will not be able to modify existing fingerprints or create new ones after April 2023. Existing fingerprints and the policies that use them should continue to work if you do nothing.

If an item describes a standard form whose labels stay put while employees type different values into the blanks, the answer is document fingerprinting from a blank template.