Announcing support for custom sensitive information types in the Security & Compliance Center

Wesley Holley is a program manager on the Office 365 team.

Core to protecting your organization’s data is identifying which data is sensitive and creating policies to govern its use.  We include over 80 sensitive information types out of the box to detect commonly used data types in regions around the globe; however, some information is proprietary in nature and is specific to your organization.  For example, your organization may need to protect employee ID numbers or other data with unique characteristics.  To better help you meet your data protection needs, we’re pleased to announce that you can now create your own custom sensitive information types for use in your Security & Compliance Center policies.

Where can I use custom sensitive types?

Previously only available for Exchange Online, this capability is now available across Exchange Online, SharePoint Online, OneDrive for Business, Outlook (2013+), OWA, Office Clients (ProPlus/2016), and supported mobile apps.  Now you can define the kinds of data you want to detect by creating your own sensitive types or modifying any of our out-of-box definitions.  Once defined in XML and uploaded to the Security & Compliance Center, your custom sensitive information types can be used in any of your DLP or Retention policies or eDiscovery queries, where we’ll automatically identify and protect your data across Office 365.  While managed in the Security & Compliance Center, custom sensitive types will still be available for use in Exchange Transport rules (ETRs) which are created in the Exchange Admin Center (EAC).

What kinds of data can I protect?

We provide a rich set of capabilities for you to detect your sensitive information including regular expressions, keyword lists, and built-in functions, along with a robust framework in which define your detection requirements.  To help you balance user productivity and risk of data exposure, we also allow you to create different versions of your sensitive types, varying in strictness, and trigger off them separately in your policy rules.  For example, a pattern alone might be a false positive, but if you’re risk averse, you may want to at least log the match or get a report when detected; however, if the pattern is found with other evidence like keywords or other patterns, you may want to take a more strict action such as encrypting the content.  We’ve designed this feature to give you the maximum flexibility possible.

What about my existing custom sensitive types in Exchange?
Any custom sensitive information types you’ve created in Exchange Online have been automatically migrated to the Security & Compliance Center.  Your existing policies or Exchange Transport Rules that use those custom sensitive types will continue to function normally.  Going forward you can manage all custom sensitive types in the Security & Compliance Center.
We’re excited to bring this powerful capability to the Security & Compliance Center and can’t wait for you to try it out! For more information, check out this article.