Microsoft Default SIT for Credit Card Number is not working correctly.

Hey, that’s correct

This causes false positives

• Plain 16‑digit numbers with separators (spaces, hyphens) that pass the Luhn checksum.
• Strings near generic words like “card,” “payment,” “visa,” “master,” “exp,” “cvv,” “mm/yy,” “billing,” etc.
• Numbers embedded in structured layouts (tables, receipts) where proximity evidence is weak.

You cannot modify the built‑in SIT, only adjust policy confidence or replace it with a custom SIT. This is the safest way to reduce false positives without losing protection.

Few ways:

Increase confidence level in DLP policy

• In your DLP rule, set Confidence Level = High for Credit Card SIT.
• High confidence requires Luhn + supporting keywords (e.g., “card number”, “expiry”, “cvv”), reducing false positives.

Require more supporting evidence

• In the policy, configure:
• Proximity window: tighten from default (300 chars) to 64 chars.
• Minimum supporting keywords: require at least 2 (e.g., “credit card” AND “expiry”).
• This ensures detection only when the number appears in a realistic card context.

Add negative keywords or exclusions

• Use exceptions in the DLP rule for terms like:
• tracking, ticket, receipt, order, reference, AWB, SR or any pattern you noticed a lot
• This prevents IDs with those labels from triggering.

Create a custom SIT (recommended)

• Define:
• Regex for card number format.
• Luhn check (Purview supports Func_Luhn).
• Supporting keywords: “cvv”, “expiry”, “cardholder”, “billing”.
• Require expiry date pattern nearby for extra accuracy.

Please let me know after trying if this reduces false results.