The Data Loss Prevention (DLP) of Microsoft Purview is only effective if detection actually matches the data to protect. This is where the choice of classifier becomes structural: a poor mechanism creates noise, false positives, and repeated exceptions.
For Microsoft 365 and Purview teams, the right approach is to align each type of sensitive data with the appropriate detection method, taking into account the expected level of precision and available licensing scope.
Why the Choice of DLP Classifier Changes the Result
In Microsoft Purview, DLP policies do not detect all data in the same way. Three approaches coexist:
- Sensitive Information Types (SITs),
- Trainable Classifiers,
- Exact Data Match (EDM).
Their main difference lies in how Purview identifies the information:
- SITs: pattern-based detection,
- Trainable Classifiers: content understanding detection,
- EDM: detection by matching against an actual repository.
This distinction has a direct impact on three operational points:
- the level of precision,
- the volume of false positives,
- the administrative burden to maintain the DLP policy.
Good to Know
These three mechanisms are not mutually exclusive. In a mature DLP strategy, they often complement each other within distinct rules depending on the nature of the data and monitored channels.
Sensitive Information Types: The Right Choice for Structured Data
Sensitive Information Types are the historical building block of DLP in Purview. They rely on recognizable elements in the content:
- regular expressions,
- keywords,
- checksums,
- context or evidence elements.
This approach works well when data follows a stable schema. This is typically the case for identification numbers, business references, or regulatory fields.
Typical Use Cases for SITs
Built-in SITs already cover many common scenarios. They are suitable, for example, for:
- credit card numbers,
- natively supported national identifiers,
- personally identifiable information (PII),
- internal identifiers with a fixed format.
They can also be customized for formats specific to your organization. An identifier like DOM25004 fits perfectly into this logic, as does an internal account number constructed according to a strict rule.
What SITs Do Well, and Their Limitations
Their main advantage is simplicity. If the data is structured, implementation is quick and detection remains understandable for compliance teams.
On the other hand, SITs show their limitations quickly when:
- the content has no stable format,
- multiple documents share similar words without carrying the same sensitivity level,
- the rule relies more on document meaning than on a string of characters.
In other words, a SIT is very good at spotting a pattern. It is much less able to understand that a document is a contract, a CV, or an HR file if no strict marker identifies it.
Trainable Classifiers: Classifying Document Meaning, Not Just Form
Trainable Classifiers bring a different logic. Here, Purview does not look for a precise format. The engine relies on machine learning to recognize a content type based on examples and overall document characteristics.
This approach is useful when sensitivity stems from the nature of the document rather than an isolated identifier.
When to Favor Trainable Classifiers
The most relevant use cases are unstructured content, for example:
- HR documents,
- CVs,
- source code,
- contracts,
- legal documents.
In these scenarios, a simple regex is not enough. A document can be sensitive without containing a particular number or an easily normalizable sequence.
What You Need to Anticipate Before Using Them
Trainable Classifiers are powerful, but they require a more selective approach.
You should specifically verify:
- that the document category is sufficiently homogeneous,
- that the need focuses on a content type,
- that teams accept a detection logic less explicit than a regex.
The typical point of concern is explainability. With a custom SIT, it is easy to explain why an alert was triggered. With a trainable classifier, analysis relies on a broader set of signals. This often improves detection, but sometimes complicates discussions with business teams if governance is not clear.
Exact Data Match: The Most Precise Method for Real Records
Exact Data Match (EDM) aims for a different objective: trigger only when the data found matches an actual value from your organization.
The principle is simple. Purview compares the analyzed content against a protected reference dataset, for example:
- customer identifiers,
- employee identifiers,
- account numbers,
- patient identifiers,
- an authorized customer master list.
This method is particularly suited when pattern-based detection generates too much noise. A number can look like a customer identifier without being one. With EDM, the policy triggers only if the value actually belongs to the provided reference set.
Where EDM Delivers Real Value
EDM is often the best choice for:
- strongly reducing false positives,
- protecting critical business data,
- applying targeted DLP on authentic records.
The benefit is clear in environments handling large volumes of structured data with high precision requirements. This is often the case in finance, healthcare, or B2C environments with customer repositories.
The Trade-off Not to Underestimate
EDM is not a universal shortcut. This approach assumes genuine discipline in managing reference data. If the dataset is not up-to-date, detection loses its value.
Before moving to EDM, you must therefore validate:
- the quality of the source repository,
- its freshness,
- the update process,
- the ability to govern this content over time.
Caution
EDM improves precision, but does not replace good data mapping. If the reference set is incomplete or obsolete, the DLP strategy will create blind spots instead of reducing them.
Licensing: What Is Accessible Based on Your Subscription
The technical choice is also a licensing choice. Based on the information provided, Business Premium covers basic DLP with built-in and custom SITs, while advanced features like Trainable Classifiers and EDM require Purview Suite Add-On or Microsoft 365 E5.
| Method | Principle | Ideal Use Case | Indicated License |
|---|---|---|---|
| Sensitive Information Types | Detection by pattern, regex, keywords, and evidence | Structured data with recognizable format | Business Premium, Purview Suite Add-On, or Microsoft 365 E5 |
| Trainable Classifiers | Classification by machine learning of overall content | Unstructured documents such as HR, CVs, contracts, or source code | Purview Suite Add-On or Microsoft 365 E5 |
| Exact Data Match | Matching against actual reference records | Customer identifiers, employees, accounts, or patients with high precision requirements | Purview Suite Add-On or Microsoft 365 E5 |
This table gives a simple rule:
- if the data has a stable format, start with SITs,
- if sensitivity depends on document type, look at Trainable Classifiers,
- if you must detect only real values, orient yourself toward EDM.
How to Decide Between SITs, Trainable Classifiers, and EDM
In practice, the right choice depends on a few simple questions.
1. Does the Data Follow a Reliable Pattern?
If yes, SITs is often the fastest and most cost-effective option.
Examples:
- standardized internal reference,
- account number with fixed structure,
- known regulatory identifier.
2. Does Sensitivity Depend on Document Context?
If yes, Trainable Classifiers is generally more suitable.
Examples:
- a contract without a particular identifier,
- an HR document containing few formal markers,
- a code repository or sensitive technical excerpt.
3. Do You Need to Detect Only Data Existing in Your Organization?
If yes, EDM is the best answer.
Examples:
- list of active customers,
- employee database,
- patient repository,
- set of validated business identifiers.
Common Pitfalls in a Purview DLP Strategy
Several mistakes come up frequently during DLP policy design.
Using a SIT Where a Document Must Be Understood Globally
This is the most common mistake. An organization tries to detect contracts or HR files using keywords. The result is rarely stable.
Trying to Do Everything with EDM
EDM is precise, but more demanding in governance. It only makes sense if a reliable reference set already exists.
Ignoring Licensing Impact from the Design Phase
Building a strategy based on Trainable Classifiers or EDM without Purview Suite Add-On or Microsoft 365 E5 quickly blocks the project.
Not Distinguishing Between Precision and Coverage
A SIT covers broadly. EDM covers more finely. One is not inherently better than the other. It all depends on the trade-off sought between coverage, precision, and maintenance effort.
In Summary: What to Do Monday Morning
To move forward concretely, the security or compliance team can follow this sequence:
- inventory truly sensitive data by category,
- separate structured data, unstructured documents, and business repositories,
- associate each category with the right mechanism: SITs, Trainable Classifiers, or EDM,
- verify immediately the available licensing scope,
- test policies on a restricted scope before generalization.
If the organization starts with a Business Premium license, the most efficient approach is to begin with built-in and custom Sensitive Information Types. If it has Microsoft 365 E5 or Purview Suite Add-On, it can then refine detection with Trainable Classifiers and Exact Data Match for cases where precision becomes critical.
The key point is not to choose the most advanced classifier. It is to choose the one that actually corresponds to the form of data to protect.
