💡 Our Technical Review in summary
Summary
Microsoft is standardizing the detection logic for all out-of-box (OOB) Sensitive Information Types (SITs) within Microsoft Purview by removing “relaxed proximity matching.” Previously, some OOB SITs allowed for a broader distance between supporting elements (such as a keyword and a regex pattern) to trigger a match. Moving forward, all OOB SITs will utilize stricter proximity rules to enhance detection precision and minimize false positives. This change is currently active across all environments, including Production, GCC, GCC High, and DoD.
Impact
- Reduced False Positives: Administrators may notice a decrease in “noisy” or incorrect detections, as the stricter rules require sensitive data and their associated keywords to be closer together in a document or email.
- Potential Drop in Detections: Content that previously triggered a DLP policy or auto-labeling event under relaxed rules may no longer be flagged. This could lead to a perceived gap in protection if your organization relies on broad matching for specific workflows.
- DLP and Classification Consistency: Enforcement behavior across Data Loss Prevention (DLP) and Information Protection labels is affected, as the underlying SITs used for identification have been tightened.
- Scope of Change: This update applies exclusively to Microsoft’s pre-defined OOB SITs. Any Custom Sensitive Information Types created by your organization are unaffected and will maintain their existing proximity configurations.
Action Required
- Audit Existing Policies: Review your current DLP and data classification policies that rely on OOB SITs. Monitor for a significant drop in incident volume that might indicate valid data is no longer being detected.
- Perform Gap Analysis: If your organization requires broader detection (e.g., a keyword appearing further away from a sensitive number), test these scenarios in a non-production or “Test Mode” environment.
- Transition to Custom SITs: If the stricter OOB proximity rules are too restrictive for your business needs, create Custom Sensitive Information Types. You can clone the logic of the OOB SIT and manually configure the proximity character count to meet your requirements.
- Update Documentation: Ensure internal compliance and security teams are aware that detection thresholds have shifted toward higher precision.
Microsoft Official Update
Service: N/A
Category: stayInformed
Severity: normal
[Introduction]
We are updating Microsoft Purview’s out-of-box (OOB) sensitive information type (SIT) detection logic to improve accuracy and reduce false positives. As part of this update, the relaxed proximity matching behavior previously used in some OOB SITs will be removed. After this change, all OOB SITs will consistently use stricter proximity rules for more consistent and precise detections.
[When this will happen:]
General Availability (Production, GCC, GCC High, DoD): Available now
[How this affects your organization:]
Who is affected:
- Organizations using Microsoft Purview out-of-box sensitive information types in data classification or Data Loss Prevention (DLP) policies.
What will happen:
- OOB SITs will stop using the relaxed proximity behavior previously applied in some detection rules.
- All OOB SITs will consistently use stricter proximity matching rules going forward.
- Content that previously matched under relaxed proximity conditions may no longer trigger a detection unless it meets the stricter proximity requirements.
- This may result in fewer detections in scenarios that relied on broader proximity matching.
- Custom sensitive information types are not affected and can still be configured to use broader proximity logic if required.
[What you can do to prepare:]
- Review existing DLP and classification policies that rely on OOB SIT detections.
- Test policy behavior in a non-production environment if broader proximity matching is required for certain workflows.
- Create custom sensitive information types if your organization needs relaxed proximity logic.
Learn more: Sensitive Information Types in Microsoft Purview
[Compliance considerations:]
| Question | Explanation |
|---|---|
| Does the change modify, interrupt, or disable Data Loss Prevention (DLP) policies or enforcement? | Stricter proximity detection may reduce the number of matches, which could indirectly affect DLP behavior. |
| Does the change modify Information Protection labels or sensitive information types? | Out-of-box SITs are updated to retire relaxed proximity matching and use stricter proximity logic. |
