How to create keyword list / dictionary with AND operations

Question

As I have checked and tried, if multiple keywords within a keyword dictionary / list. The default behavior is OR operations.

How do I change this to make it a AND operation as I need to detect all the words listed in the SIT in order to trigger the policy.

As far as I know, I'm creating each keyword list as a supporting element to force a AND detection or combining multiple keyword list in DLP policy. So just wondering if there's any other approach that can achieve these easily?

Answer 1

Hi @Marcus Wong Theen Nam

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

In Microsoft Purview, when you specify multiple keywords in a keyword dictionary or list, the default behavior is to perform an OR operation. This means that the search results will include all assets that contain at least one of the specified keywords.

Currently, Microsoft Purview DLP does not natively support the enforcement of strict AND logic within a single Sensitive Information Type (SIT) or keyword list. This limitation can pose challenges for organizations that need to detect data containing multiple specific keywords simultaneously.

Creating multiple custom SITs and combining them in a DLP policy or using regex patterns and proximity matching are effective ways to detect data containing multiple specific keywords simultaneously.

For more details, please refer the below mentioned documentation:

Create custom sensitive information types

Learn about using regular expressions (regex) in data loss prevention policies

I hope this information helps, please do let us know if you have any further queries.

Thank you.