SC-400 Exam Alignment
SC-400

Skill: Create and manage sensitive information types — Understand the role of SITs as the detection engine for DLP and auto-labelling, create custom SITs using keywords and regular expressions, configure EDM classifiers for exact data matching, and deploy trainable classifiers for content-based detection.

• Know the three SIT components: primary element (regex pattern), supporting evidence (keywords/other patterns), and confidence level (low/medium/high)
• Understand that Exact Data Match (EDM) matches specific values from a data schema — not pattern-based, must match actual data in your database
• Know that trainable classifiers use machine learning trained on sample documents — they classify by content meaning, not patterns or keywords
• Content Explorer requires the Content Explorer Content Viewer role to see individual item content; Content Explorer List Viewer to see counts only

Exam Tip: Rule of thumb: use built-in SITs for common regulated data (credit cards, NI numbers, passports); custom SITs for organisation-specific patterns (employee IDs, project codes); EDM when you need to match actual values in your employee or customer database; trainable classifiers when content is too varied for patterns (e.g. detecting “source code” or “HR policies” by meaning).

🔍 Sensitive Information Types (SITs)

A sensitive information type is a named pattern that Purview uses to detect sensitive content in files and emails. Every SIT has three components:

📋 Built-In Sensitive Information Types

Microsoft provides over 300 built-in SITs covering regulated data across many countries and industries.

🔧 Custom Sensitive Information Types

When built-in SITs don’t cover your organisation’s data, you create custom SITs. Common uses include employee ID numbers, internal project codes, patient reference numbers, and proprietary data formats.

# List all SITs — Publisher 'Microsoft' = built-in, your org name = custom
Get-DlpSensitiveInformationType | Select-Object Name,Publisher,Category | Sort-Object Publisher

# Get details of a specific SIT (patterns, confidence levels)
Get-DlpSensitiveInformationType -Identity 'Credit Card Number'

# Create a custom SIT via XML rule package (recommended for production)
New-DlpSensitiveInformationTypeRulePackage -FileData ([System.IO.File]::ReadAllBytes('.\EmployeeID-SIT.xml'))

# Test SIT classification against sample text
Test-DataClassification -TextToClassify 'Employee EMP-123456 joined Finance team' `
  -SensitiveInformationTypes @{Name='Contoso Employee ID'}

🎯 Exact Data Match (EDM)

EDM is a data-specific classification method that detects exact values from your organisation’s actual data — not just patterns.

🤖 Trainable Classifiers

Trainable classifiers use machine learning to detect content by its meaning and context, not by patterns or keywords.

🗺️ Content Explorer & Activity Explorer

💡 Best Practices

• Before creating custom SITs, search the 300+ built-in types first — Microsoft may already have a SIT for your country’s national ID format, passport, or tax number
• Always test custom SITs against representative sample documents before deploying to DLP policies — a poorly calibrated SIT causes false positives that frustrate users and create alert fatigue
• Use EDM for customer/employee PII databases where exact matching is required to avoid false positives — a regex for a 9-digit number matches millions of things; EDM matches only your actual employees’ SSNs
• Use Content Explorer as your starting point for any new DLP or labelling programme — it shows you how much sensitive data you have and where it lives before you start blocking or alerting

🎓 Interview Q&A

Next Module →Module 3: Sensitivity Labels→