Plaintext credential detection

For plaintext credentials in documents or files, start with Purview’s built-in All credentials sensitive information type rather than one broad password regex. It bundles supported credential detectors, including Microsoft Entra client secrets, Azure Storage keys, Azure SQL connection strings, and general passwords. Detection is pattern-based; it cannot reliably recognize every arbitrary secret. For Endpoint DLP, Microsoft specifically requires Advanced classification scanning and protection when using credential-scanning or bundled SITs. Confirm supported file types and endpoint configuration before testing. Use synthetic samples for each credential format, plus harmless lookalikes, then run the policy in simulation mode and tune false positives before enforcing restrictions. For an organization-specific format, create a custom SIT with its pattern and corroborating keywords. Detection does not secure the original secret: rotate exposed application credentials and move them into an appropriate secret store, such as Azure Key Vault.