Reading Time: 5 minutes

Thank you for continuing to follow the Microsoft Purview blog post series.

Building on Part 9 of this series, where I walked through creating a custom Sensitive Information Type (SIT) from scratch, this post explores the purpose and creation of a fingerprint based Sensitive Information Type (SIT).

So, what exactly is a fingerprint SIT?

Unlike traditional SITs that look for patterns like credit card numbers or national insurance details, fingerprint SITs are designed to detect specific, structured documents. Document fingerprinting creates a SIT based on the document’s structure rather than keywords, enabling detection of exact or similar versions of the original document.

Document fingerprinting in Microsoft Purview allows you to take a standard form used within your organisation and create a Sensitive Information Type (SIT) based on its contents. This makes it easier to protect sensitive information by identifying and classifying commonly used documents, such as HR forms, client lists, internal financial reports, employee performance forms, patent templates, government forms or contract templates, that may appear throughout your organisation.

These types of files often contain sensitive information that’s unique to your organisation, and that’s where fingerprinting SITs shine. By uploading a sample document, Microsoft Purview creates a digital “fingerprint” of its contents. This allows you to identify and protect documents that follow a specific template or structure, helping prevent them from being shared outside the organisation. A fingerprint based SIT can then be utilised in Data Loss Prevention (DLP) policies to detect and restrict the sharing of these documents, whether via email, Teams, SharePoint, or OneDrive, ensuring sensitive content stays within trusted boundaries.

Think of this feature like human fingerprints. Just as every person has a unique fingerprint, documents also have unique word patterns and structures. When you upload a file, Microsoft Purview analyses its contents and creates a digital “fingerprint” based on that pattern. This fingerprint can then be used to detect other documents that follow the same structure or contain similar content, making it much easier to identify and protect sensitive files across your organisation.

Document Fingerprinting supports the same file types that are supported in transport rules used within Microsoft Exchange. For a list of supported file types see the image below (Click the image to enlarge).

Source: Supported File Types

Note:
Microsoft Purview converts the word pattern into a document fingerprint, which is a small Unicode XML file containing a unique hash value that represents the original text. As a security measure, the original document itself isn’t stored in Microsoft 365; only the hash value is stored. The original document can’t be reconstructed from the hash value.

For example, if you set up a Data Loss Prevention (DLP) policy to prevent regular employees from sending emails containing HR onboarding documents, Purview uses the HR Onboarding fingerprint SIT you created to detect and block those messages. However, your HR department may have a legitimate business need to share HR onboarding documents externally. In such cases, you can create exceptions in your DLP (Data Loss Prevention) policy for specific departments, or allow users to override the policy with a business justification which can be audited. More on DLP later in this blog post series.

While document fingerprinting is a powerful feature, it does have some limitations. It won’t detect sensitive information in the following cases:

• Password protected files
• Image only files
• Documents that don’t closely match the original form used to create the fingerprint
• Files larger than 4 MB

Now that you have an understanding of how fingerprint Sensitive Information Types (SITs) work and how they’re used in Microsoft Purview, let’s explore how to create a custom fingerprint SIT.

1. Access the Microsoft Purview portal at purview.microsoft.com

2. In the left-hand navigation pane, click Solutions, then select Information Protection.

3. In the left-hand pane, expand Classifiers, then click Sensitive info types.

4. Click + Create Fingerprint based SIT

5. Provide a name and description for your new fingerprint SIT. This helps identify its purpose and usage within your organisation. Click Next

6. Upload the sample document that represents the structured data you want to detect. This document should be a clean, representative version of the form or template you want to fingerprint.

For this demo, I’ll be uploading the following Word document:

This document includes structured fields such as employee details, contact information, onboarding tasks, and policy acknowledgements, making it ideal for fingerprinting in Microsoft Purview.

7. Configure confidence levels or leave the defaults for now

Understanding Confidence Levels
When creating a fingerprint Sensitive Information Type (SIT), Microsoft Purview allows you to set confidence levels, these determine how certain the system must be before it considers a match valid.

There are typically three levels:

• Low: The system is less strict and may detect loosely matching documents. Useful for broader detection but may result in more false positives.
• Medium: A balanced level that requires a reasonable match to the fingerprint. Often used in most scenarios.
• High: The system is very strict and only detects documents that closely match the original fingerprint. Ideal for highly sensitive content where accuracy is critical.

Choosing the right confidence level depends on how precise you want the detection to be and the sensitivity of the document you’re protecting. As you evaluate the results, you can adjust the confidence level to better balance accuracy and coverage based on your organisation’s needs.

8. Take a moment to review the name, description, uploaded document, and confidence level settings. Once you’re satisfied, click Create to generate your custom fingerprint Sensitive Information Type (SIT).

Your new SIT will now be available for use in policies such as Data Loss Prevention (DLP) or Information Protection. We will utilise this fingerprint SIT in later blog posts to demonstrate how it can be applied to protect sensitive documents across your organisation.

Thanks for following this blog post series!

Stay tuned for the next post, where I’ll explore trainable classifiers.