Choose a classification technique for a data shape
Relecloud's finance team generates three very different shapes of data on any given day for Woodgrove Bank. A transaction record carries a reference number that always follows the same format. An account roster lists a fixed set of known account numbers that rarely change. A case file captures a dispute investigation in free-form prose, with no two documents structured quite the same way. Each shape needs to be classified before a sensitivity label can protect it, but no single classification technique handles all three equally well. Microsoft Purview gives you three options—sensitive information types (SITs), exact data match (EDM), and trainable classifiers—and the technique you pick determines whether that classification is precise or noisy.
That distinction matters more than it first appears. A classification technique that can detect a data shape isn't automatically the right choice for it. The real question is which technique detects that shape with the fewest false positives, because every false positive an admin has to review erodes trust in the whole system and eventually leads to real matches getting missed in the noise.
Guiding question: Suppose you reversed the pairing for two of Woodgrove Bank's data shapes—using a keyword-based sensitive information type to scan for matches against the entire known account roster, instead of using exact data match. Which approach produces more false positives, and why? Keep your answer in mind as you read through each technique below.
Detect predictable patterns with sensitive information types
Sensitive information types identify content that follows a standardized, predictable format. A SIT combines a few detection mechanisms: pattern matching through regular expressions, supporting keywords, the proximity of that evidence to the pattern, and checksum validation where applicable, all of which feed into a confidence level. Because Woodgrove Bank's transaction reference number always follows the same structure, a SIT recognizes it reliably without any custom setup—built-in SITs are quickly deployable with minimal configuration, which makes them the right fit whenever data is widely recognized and formatted consistently.
That reliability comes with a limit, though. A SIT recognizes a shape, not a specific value. It can confirm that a string looks like a transaction reference number, but it can't confirm that the number belongs to an actual, known transaction. That's a meaningful gap when the data you're protecting is a specific, enumerable set of values rather than a general pattern.
Learn more about sensitive information types.
Minimize false positives with exact data match
Woodgrove Bank's account roster is exactly the kind of data shape where a pattern match falls short. The roster is a known, fixed list—Relecloud already has every valid account number on file—so the goal isn't to detect a pattern, it's to confirm a match against specific values. Exact data match closes that gap. You upload the roster into a securely hashed reference table, and EDM only flags content when it matches an entry in that table exactly, which minimizes false positives compared to pattern-based detection alone. The table can hold up to 100 million rows and refreshes on a daily schedule, so as Woodgrove Bank opens or closes accounts, the reference data stays current without you having to redeploy anything. Because the table is hashed, Relecloud's sensitive account data stays protected in the process, and it isn't shared with anyone, including Microsoft.
This is also the answer to the guiding question above. A keyword-based SIT scanning for account numbers only recognizes that a string looks like an account number—it has no way to confirm the number is actually one of Woodgrove Bank's. Pointed at a roster of that size, it flags every plausible-looking number regardless of whether it's real, producing far more false positives than EDM's exact-match approach against the same data. Reverse the pairing back, using EDM for a genuinely fixed, enumerable list, and the false-positive rate drops because only true matches surface.
Learn more about exact data match based sensitive information types.
Recognize free-form content with trainable classifiers
The third data shape, Woodgrove Bank's dispute case files, doesn't fit either pattern-based or exact-match detection. No two case files use quite the same structure, so there's no regular expression to write and no fixed list of values to hash. This is where trainable classifiers fit: instead of matching a pattern, a trainable classifier learns from examples you provide, using machine learning to recognize organization-specific or proprietary content that built-in SITs can't reliably catch. Trainable classifiers work well for complex, contextual data—documents with varied structure and unpredictable format, the same way legal documents with varying clauses and formats resist a single fixed template.
Sometimes the strongest result comes from combining techniques rather than choosing just one. Pairing a pretrained trainable classifier with a custom SIT sharpens detection further—for example, combining a "Business Context" classifier with a custom SIT built to catch contract sums over $100,000 flags content that matches the broader business context and meets a specific financial threshold, which is more precise than either technique running alone.
| Technique | Detects | Best for |
|---|---|---|
| Sensitive information type (SIT) | A predictable shape via regex, keywords, proximity, and checksum | Widely recognized, consistently formatted data (a transaction reference number) |
| Exact data match (EDM) | An exact match against a hashed reference table (up to 100M rows, daily refresh) | A known, fixed, enumerable list—minimizes false positives (the account roster) |
| Trainable classifier | Learned patterns from examples, via machine learning | Free-form, contextual content with varied structure (dispute case files) |
Know what feeds auto-labeling
Choosing the right technique for a data shape carries through to labeling: sensitive information types, trainable classifiers, exact data match (EDM) SITs, and document-fingerprinting SITs can all drive auto-labeling. EDM SITs are supported for both service-side auto-labeling (SharePoint, OneDrive, Exchange Online) and client-side auto-labeling (Word, Excel, PowerPoint, and Exchange desktop clients), and document fingerprinting is a supported auto-labeling detection method as well. That means if Woodgrove Bank's account roster relies on EDM, an EDM match can trigger an automatic label directly—while still keeping EDM's low false-positive advantage, because only true matches against the roster surface. The technique you pick for each data shape follows through into labeling rather than ruling it out.
Learn more about exact data match based sensitive information types and document fingerprinting.
Choosing the right classification technique for each of Woodgrove Bank's data shapes is only half the picture. Once content is classified correctly, that decision has to turn into a label a user actually sees and applies—a label that might protect a single file, or an entire site. The next unit picks up right there, with how sensitivity labels and their scope put that classification to work.