Work with the regular expression engine in Defender for Cloud Apps

Important

File policies retire on January 6, 2027. To maintain file-based data protection, migrate to Microsoft Purview DLP or auto-labeling policies.

Microsoft Defender for Cloud Apps supports regular expressions (RegEx) for pattern matching in content inspection and file policies. This article covers the supported RegEx syntax, known limitations, and provides examples to help you build effective expressions for your policies.

Regular expressions in Defender for Cloud Apps

The Microsoft Defender for Cloud Apps content inspection policies use RegEx for pattern matching. Content inspection may be applied as part of file policies.

Testing regular expressions

To test regular expressions, you can use the following websites:

• RegexPal regular expression tester - Make sure you select Case insensitive.

• Regex101 regular expression tester - Provides detailed analysis of the RegEx.

Limitations of regular expressions in Defender for Cloud Apps

The following limitations are imposed on custom regular expressions:

• The search is always case-insensitive

• Allowed quantifiers: {n,m} where n, m < 10

• All groups must be non-capturing, for example: (?:xxx)

  Instead of (group) use (?:group)

• Disallowed quantifiers: *, +, {n,}

  Instead of * use {0,9}

  Instead of + use {1,9}

• Disallowed back-references: \<number> or \k<name>

Regular expression examples

The following table gives you example expressions and if they would match or not.

Regular expression	Data	Matches
Colou?r (?:black|blue|white)	Color black Color white Color red	Yes Yes No
[a-z0-9]{1,9}@[a-z0-9]{1,9}\\.[a-z]{2,}	Some1@abc.com user@host.org @bad.com	Yes Yes No
20\d{2}-(?:0[1-9]|1[0-2])-(?:[0-2][0-9]|30|31)	2015-12-31 2015-01-09 1999-12-31	Yes Yes No
d.n't\s{0,10}c.r.	Don't care D!n'tcor0 Doesn't care	Yes Yes No

Next steps

Best practices for protecting your organization

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.