Exercise - Create a custom sensitive information type for Woodgrove's transaction pattern

  • 12 minutes

Woodgrove Bank's transaction records follow a predictable reference-number pattern. You've determined a sensitive information type (SIT) is the right classification technique for this data shape—now build and test one.

Important

Prerequisites for this exercise:

  • Access to a Microsoft 365 E5 tenant with permissions to create sensitive information types in the Microsoft Purview portal.
  • Sample content containing the fictitious Woodgrove transaction-reference pattern, described below—create a small test file yourself if your lab doesn't provide one.

Woodgrove's transaction references follow the fixed format WG- followed by eight digits, a hyphen, and a single uppercase check letter—for example, WG-48213077-K. Use this format for both the pattern definition and your test content.

Task 1: Create the custom sensitive information type

  1. Sign in to the Microsoft Purview portal at purview.microsoft.com with your SIT-creation permissions.

  2. Go to Data classification > Sensitive info types, then select Create sensitive info type.

  3. Name it Woodgrove transaction reference and add a description noting the fixed format.

  4. Under Define patterns, select Add pattern, then add a primary element using a regular expression that matches the format:

    WG-\d{8}-[A-Z]

  5. Set the confidence level to High and the character proximity to a small window (for example, 300 characters), since this is a self-contained, fully formatted pattern with no separate supporting evidence needed.

  6. Review and create the sensitive information type.

Task 2: Test the custom SIT against sample content

  1. Create a small test file (a Word document or plain text file) containing several lines, at least two of which include a correctly formatted reference like WG-48213077-K, and at least one line with a similar but invalid pattern (for example, missing the check letter, like WG-48213077).
  2. Back in the Purview portal, open the sensitive information type you created and select Test.
  3. Upload your test file and run the test.
  4. Confirm the tool detects both valid references as matches, and confirm the invalid line does not match—proving the pattern is specific enough to avoid false positives on similar-looking but incorrectly formatted text.
  5. Reflect: this is exactly why a SIT was the right choice here. Woodgrove's transaction references are predictably formatted—a pattern-matching technique reliably catches them with low false-positive risk, which is the deciding factor you weighed in the previous unit.

You've now built and tested a custom sensitive information type for Woodgrove's transaction-reference pattern—ready to plug into a sensitivity label or DLP policy in the units ahead.