Source Code trainable classifier doesn't work at Endpoint channel

Question

Source Code trainable classifier doesn't work at Endpoint channel

Haim Nazarovsky 0

Hi, I’d appreciate some assistance, please.

I’ve created two identical DLP policies using the Source Code trainable classifier—one targeting the email channel and the other for endpoint (Defender for Endpoint is installed on the machines).

The email policy is working perfectly, but the endpoint policy is not working at all.

I’ve already tried adjusting rule priorities, modifying the included groups, and changing the actions, but nothing has worked so far.

Do you have any suggestions or ideas on what might be going wrong?

Smaran Thoomu 35,375 Reputation points Microsoft External Staff Moderator

2025-10-07T12:36:12.3466667+00:00

Haim Nazarovsky Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

Smaran Thoomu 35,375 Reputation points Microsoft External Staff Moderator

2025-10-07T12:36:12.3466667+00:00

Haim Nazarovsky Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Pauline Mbabu 1,840 Microsoft Employee

Hello @Haim Nazarovsky ,

Thank you for reaching out.
I believe the issue might be due to limitations in File Type. Current endpoint DLP only applies advanced classification to Office documents and PDF files. This is a critical difference: if your source code is in .py, .cs, .java, or other plaintext code files, the endpoint DLP agent may not scan those file types for trainable classifier matches. https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings#advanced-classification-file-scanning-size-limits.

You can also Verify that Advanced classification scanning and protection is turned on in your Endpoint DLP settings. Endpoint DLP requires this cloud-assisted scanning to detect trainable classifier content. If it’s off (or if the device exceeded any set bandwidth limits), the policy won’t recognize content via trainable classifiers on the endpoint.

If you are still facing this issue after following the above, kindly reply back on the comments.
If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.

Haim Nazarovsky 0 Reputation points

2025-10-06T09:56:46.92+00:00

Thanks for the answer
As mentioned, the Source Trainable classifier doesn't rely on file extensions but rather on the content itself. Therefore, if a Word document contains code, it should still be recognized.

As noted earlier, the classifier successfully identifies it on the email channel but not on the endpoint.
Pauline Mbabu 1,840 Reputation points Microsoft Employee

2025-10-06T14:03:08.9+00:00

The File Type Limitation only applies to Endpoint DLP and not Email DLP. Email DLP can inspect a broader range of content.
But you are correct that the Source Trainable Classifier is content-aware for supported file types (Office and PDF). It will classify based on what is inside the file, so a Word document with code will be recognized as such.
Could you try and Test by copying a supported file type containing source code to a USB drive, printing it, or uploading it to a web service. -To see if the Policy will be triggered.

Share via

Source Code trainable classifier doesn't work at Endpoint channel

1 answer

Your answer