Topic 2 of 6
Data classification
You can't protect what you don't know about. Before labeling, blocking, or retaining anything, Purview needs to recognize what's sensitive: a card number, a medical record, a contract. This article explains the tools that do it and how to see the results. The exam mostly asks when to use each type of classifier.
Contents
First, know your data
Data protection in Purview follows a logical order. Each step builds on the previous one:
Know
Classify: what sensitive data exists and where
Protect
Sensitivity labels and encryption
Prevent loss
DLP: keep it from going where it shouldn't
Govern
Retention and deletion according to rules
Classification is the first step: if a system doesn't recognize data as sensitive, no policy will protect it. That's why the same classifiers are reused in labels, DLP, retention, and insider risk.
Sensitive information types (SITs)
SITs are pattern-based classifiers. They detect data with a recognizable format: social security numbers, credit cards, bank accounts, passport numbers. Microsoft includes hundreds already defined for many countries.
Primary element
What you look for: a regular expression (with or without checksum validation), a keyword list, a dictionary, or a function.
Supporting elements
Evidence that raises confidence, like a valid expiration date near a card number.
Confidence level
Low, medium, or high. The more evidence, the more confidence. High gives fewer false positives but can miss real matches.
Proximity
The maximum distance in characters between the primary and supporting elements for them to count together.
How a SIT detects data
Example with a credit card number in a document:
Pattern: Finds a number matching the format of the major card brands (Visa, MasterCard, American Express…).
Validation: Checks the checksum (Luhn algorithm). A random sequence usually fails here.
Supporting evidence: Looks for a valid expiration date within 300 characters of the number.
Confidence: With only the validated pattern, confidence is lower; with supporting evidence, it rises to high.
Result: The item is classified and can be used by DLP, auto-labeling, or retention.
Kinds of SITs
| Kind | Description | Example |
|---|---|---|
| Built-in | Maintained by Microsoft. They can't be edited, but they can be copied as the basis for your own | Credit card number, IBAN |
| Named entity | Person names, physical addresses, and medical terms. Unbundled (one country or concept) or bundled (broad coverage) | All full names |
| Custom | Your own regular expressions, keywords, and dictionaries | Employee ID, project code |
| Exact data match (EDM) | You upload a hashed copy of a sensitive table and those exact values are matched | Your patients' record numbers |
| Document fingerprinting | Turns a standard form into a SIT to detect documents based on it | Patent application template |
Why EDM
A generic SIT detects any number formatted like a medical record, even if it isn't one of your patients. EDM only matches values that are actually in your database, so it greatly reduces false positives.
Trainable classifiers
Some sensitive content has no pattern: a contract, a résumé, source code, a harassing email. Trainable classifiers use AI and machine learning to recognize content by what it is, not by a pattern.
Pretrained
Created by Microsoft and ready to use: harassment, profanity, threats, financial, HR, and legal documents, source code, and many more.
Custom
For content specific to the organization. They're built from examples and published once their accuracy is good enough.
How a custom classifier is created:
Seed: Provide a folder with positive examples of the document type (and negative ones that aren't).
Test: The model runs on test content and predicts what is and isn't a match.
Verify: A person reviews the predictions and confirms or corrects them to refine the model.
Publish: Once accuracy stabilizes, it's published and becomes available to policies.
They only work with unencrypted items: if content is encrypted, the classifier can't read it.
SIT vs. trainable classifier
| Sensitive information type | Trainable classifier | |
|---|---|---|
| How it recognizes | Patterns, keywords, functions | Machine learning on examples |
| Good for | Formatted data: numbers, codes, identifiers | Document or message types with no fixed format |
| Question it answers | Does it contain this specific data? | What kind of content is it? |
| Example | Passport number | Contract, résumé, harassment |
Content explorer and Activity explorer
Once data is classified, the admin needs to see the results. Two tools answer two different questions:
Content explorer · what exists and where?
A snapshot of items with a sensitivity label, a retention label, or classified as a SIT, and their location (Exchange, SharePoint, OneDrive…). It lets you view the scanned content, which is why access is highly restricted to specific role groups: one to see the list of items and another to see their content. In the current Purview portal it appears as Data explorer.
Activity explorer · what's being done with it?
A history of actions on labeled or classified content: labels applied, changed, or removed, label downgrades (Confidential to Public), files copied to USB or a network share, printing. It receives endpoint DLP signals.
To remember it: Content = content (state); Activity = activity (actions).
Where classification is used
Sensitivity labels
Automatic or recommended labeling when a SIT or classifier is detected.
DLP
Policy conditions: block sending if the email contains card numbers.
Retention
Automatically apply retention labels to matching content.
Communication compliance and insider risk
Detect inappropriate messages or sensitive content leaving.
They also apply to AI interactions: the same SITs detect sensitive data in Microsoft 365 Copilot prompts and responses.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Detect credit card numbers in emails and files | Built-in SIT | A known pattern with checksum validation. |
| Detect employee IDs with a custom format (EMP-123456) | Custom SIT | A regular expression defined by the organization. |
| Detect only the patient record numbers that exist in your database | Exact data match (EDM) | It matches exact values, fewer false positives. |
| Recognize contracts even though they have no fixed pattern | Trainable classifier | It recognizes the document type by its content. |
| Detect harassment or threats in messages | Pretrained trainable classifier | Microsoft already trains them. |
| See how many documents with health data exist and on which sites | Content explorer | A snapshot of what exists and where. |
| See who downgraded a document's label from Confidential to General | Activity explorer | It logs actions on content. |
| Detect standard company forms, such as a patent application | Document fingerprinting | It creates a SIT from a form template. |
Common exam traps
❓ You want to detect contracts that follow no fixed pattern. SIT or trainable classifier?
Trainable classifier: it recognizes the document type with machine learning. SITs look for patterns.
❓ Can you edit a built-in SIT?
No. You can copy it and modify the copy as a custom SIT.
❓ A user downgrades a document from Confidential to Public. Where does the admin see it?
In Activity explorer. Content explorer shows what content exists, not activity.
❓ Can any compliance admin view content in Content explorer?
No. Access is restricted to specific role groups, because it lets you read sensitive content.
❓ Can a trainable classifier analyze an encrypted document?
No. It only works with unencrypted items.
❓ What reduces false positives when looking for real customer data?
Exact data match (EDM), which compares against the exact values in your database.
❓ Does a high confidence level detect more matches?
No. It detects fewer, but with fewer false positives. A low one detects more, with more false positives.
Did you get this topic?
Test what you just learned
An insurer wants to detect only the policy numbers that exist in its customer database, not any number with that format. What does it use?
Ready to test "Data classification"?
Original questions, each with a full explanation.
Start a mock exam