16.1 Sensitive Information Types
Key Takeaways
- Sensitive Information Types (SITs) are pattern-based classifiers in Microsoft Purview that detect sensitive data such as U.S. SSNs, credit card numbers, and passport numbers
- A SIT is built from a primary element (regular expression or keyword/function), supporting elements, a confidence level (low/medium/high), a proximity window, and an optional checksum/validator
- Microsoft ships 200+ built-in SITs; custom SITs are created in the Purview compliance portal under Data classification > Classifiers using keywords, keyword dictionaries, or regular expressions
- Exact Data Match (EDM) is a precision SIT that matches content against an actual data table you upload (e.g., a real customer list), reducing false positives compared with pattern-based SITs
- SIT matches are reviewable in Content explorer and Activity explorer, which show the matched items and the activities that produced the matches
Quick Answer: A Sensitive Information Type (SIT) is a pattern-based classifier in Microsoft Purview that detects sensitive data such as a U.S. Social Security Number, credit card number, or passport number. SITs are the detection engine underneath data loss prevention (DLP) policies, sensitivity-label auto-labeling, and Exact Data Match (EDM). Microsoft supplies 200+ built-in SITs, and you can build custom SITs from keywords, keyword dictionaries, or regular expressions.
What a Sensitive Information Type Is
A Sensitive Information Type (SIT) is a classifier that Microsoft Purview uses to detect sensitive data in content. When a DLP policy looks for credit card numbers in Exchange email, or an auto-labeling policy looks for U.S. SSNs in a SharePoint document, both rely on SITs to find the patterns. SITs are the detection layer that several Purview features consume, including:
- Data Loss Prevention (DLP) policies
- Sensitivity label auto-labeling (both client-side and service-side)
- Exact Data Match (EDM)-based classification
- Data classification dashboards and Content/Activity explorer
Anatomy of a SIT
A SIT is built from a defined structure. Understanding this structure is essential for tuning detection and reducing false positives on the MS-102 exam.
| Component | Purpose | Example |
|---|---|---|
| Primary element | The main pattern that must match for the SIT to fire | A regular expression like \d{3}-\d{2}-\d{4} for a U.S. SSN |
| Supporting element | Additional evidence that strengthens the match | A keyword list such as "SSN", "Social Security", "Social Security Number" |
| Confidence level | How sure Purview is the content is the sensitive data | Low, Medium, or High |
| Proximity | The character window within which the supporting element must appear near the primary element | Within 300 characters |
| Checksum / validator | A mathematical check that the value is structurally valid | The Luhn checksum for credit card numbers |
A high-confidence match generally requires the primary element plus a supporting element within the proximity window plus a passing checksum. A low-confidence match may require only the primary element, which produces more matches but also more false positives. Medium sits between the two. This is why a credit card SIT is usually configured for high confidence: the Luhn checksum filters out random 16-digit strings that merely match the regex.
Built-in SITs
Microsoft ships a large catalog of built-in SITs (over 200) covering common sensitive data types across regions: U.S. SSN, U.S. passport number, EU debit card number, IBAN, SWIFT codes, U.S. Individual Taxpayer Identification Number (ITIN), U.S. bank account number, driver's license numbers, and many more. Built-in SITs cannot be edited, but they can be referenced directly in DLP and auto-labeling policies. You can review the full catalog in the Purview compliance portal under Data classification > Classifiers > Sensitive info types.
Custom SITs
When a built-in SIT does not fit your organization's data, you create a custom SIT in the Purview compliance portal under Data classification > Classifiers > + Create sensitive info type. Custom SITs support several authoring methods:
- Keywords — a simple list of terms that should trigger the match (e.g., an internal project codename)
- Keyword dictionaries — large lists of terms, useful for industry-specific vocabularies such as medical diagnoses or drug names; keyword dictionaries can hold up to 100,000 terms per dictionary
- Regular expressions — regex patterns for structured identifiers such as a custom employee ID format
- Document fingerprinting — creates a SIT from a standard form template (e.g., a proprietary NDA form) so that filled-in copies of the form are detected
Custom SITs follow the same primary-element-plus-supporting-element-plus-confidence-plus-proximity anatomy as built-in SITs. They can be tested against sample content before they are published.
Exact Data Match (EDM)
Exact Data Match (EDM) is a more precise SIT that matches content against an actual table of sensitive values you upload, rather than against a regex pattern. For example, instead of matching any 9-digit number that looks like a SSN, EDM matches against the real list of customer SSNs in your CRM export.
EDM reduces false positives dramatically because any value not in your uploaded table is ignored. The workflow is: define the EDM schema, upload a data table (e.g., a CSV of customer identifiers) through the EDM upload agent, create the EDM-based SIT in the Purview portal, and then use the EDM SIT in DLP or auto-labeling policies. EDM SITs support hashed data and require a refresh when the underlying data table changes.
Testing and Reviewing SIT Matches
After a SIT is published, Purview continuously scans supported locations and populates two tools:
- Content explorer — shows the items that matched a SIT, with the sensitive data de-identified unless the viewer has elevated permissions. Useful for seeing where sensitive data lives.
- Activity explorer — shows the activities that produced or touched the matches (e.g., a file was uploaded, a label was applied), useful for understanding the context of matches.
Both tools require role-group membership: the Content Explorer Content Viewer and Content Explorer List Viewer roles control what users can see in Content explorer. Use these tools to tune SIT confidence levels, adjust supporting elements, and validate that EDM tables are still current.
Exam Tip
The MS-102 exam expects you to know the SIT anatomy (primary element + supporting + confidence + proximity + validator), the three custom-creation methods (keywords, keyword dictionaries, regular expressions), and the distinction between document fingerprinting (form-based) and EDM (table-based). Be ready to pick the right method for a scenario: a custom employee ID uses regex, a 50,000-term medical vocabulary uses a keyword dictionary, a proprietary form uses document fingerprinting, and a real customer list uses EDM.
You need to create a custom SIT that detects an internal employee ID formatted as three letters followed by a hyphen and four digits (e.g., ABC-1234). Which creation method should you use?
Which component of a SIT performs a mathematical structure check such as the Luhn algorithm for credit card numbers?
Your organization wants to detect a proprietary NDA form that employees fill in and store on SharePoint. Which SIT method fits this scenario?