Updates to Assets Prevent Future Scan Updates
We've been working with Purview slowly over the last few days. Today I was able to scan some heavily used on-prem SQL server databases. Once the scan was complete I went into the assets, located the first asset I wanted to classify, and started to add a description. The minute I clicked Edit on the asset a warning appeared stating "Making a manual update to the asset will prevent future scans on this asset from updating it." As a software developer, I understand why this might be necessary, however as a member of the data governance team it concerns me. I need the ability to add classifications/glossary terms/contacts/descriptions to newly discovered assets, but I'd also like scanning to update the schema as the asset changes based on information found in scans. Is the functionality to edit an asset manually and receive updates from scans something that is on the roadmap? Will it be available in GA?
How to whitelist multiple company domains in Purview
Hi, we have a customer who has 8 to 9 different companies under their tenant, they are their sister companies. While applying the DLP policy, "Block access outside the organization" those company domains are picked up as external, wanted to know how we can exclude those? thoughts? Thanks Fahad.
Which searchable unique identifiers do eDiscovery and Content Search have in common, if any?
I can see Immutable ID and Item Identity are a match when comparing exports of overlapping data from eDiscovery against Content Search, but I can't actually search those values to find the exact data set that I need. Here's my use case: we have files that were tagged for hard deletion in an eDiscovery Review Set. I need to find those exact files in a Content Search, but attempts to find emails and their attachments using FileId, FamilyId, ConversationId have all failed. Content Search just ignores those queries and returns the entirety of whatever mailboxes I'm searching on. Email Message Id appears to be unavailable in Content Search and neither Item Identity nor Immutable ID are working either. How can I find the exact files that were tagged? Is there a unique identifier that can be used? We need to do a hard delete of these items, hence the need to pull them into Content Search. Any help or suggestions would be appreciated. So far, the best matching search I've been able to run is on received date (which includes the timestamp) but this is giving me too many results. Given the lack of columns and filtering in Content Search, having too many results is not ideal. Need to get the exact tagged set returned. And what about Compound Path? Which way should the slashes go for Content Search? I can't get it to return anything.
Restrict applying retention labels in sharepoint site documents
My organization is looking to use retention labels on documents within sharepoint sites, but wants to only allow sharepoint administrators or site owners to be able to do this. They don't want to allow sharepoint site members from applying a retention label in order to prevent other users from applying retention labels on non-relevant documents. Is this possible?
Onboarding Devices: "No authenticated user found"
Hi, I am looking to onboard a device in Purview for the purpose of testing some Endpoint DLP policies. I have ran the onboarding script locally and the device successfully appears on the 'Devices' screen. 'Real time protection/RTP' and 'Behavior monitoring/BM' both show as 'enabled' with a green tick, however under 'Valid User' it has a red cross and states: "Invalid: No authenticated user found. Without proper authentication, data classification is impeded. To ensure precise validation, we recommend re-onboarding to Active Directory". The device is in active directory. I have signed into the device with an account that is also in Active Directory. Is there anything additional that I need to do? Any help would be really appreciated - thank you!!!DLP rule - Document Property is: 'ComplianceTag:\0'
Is an expression like the one below supported by the "Document Property Is" condition when setting a DLP Policy in Purview? I'm trying to set a rule that applies a DLP alert to files in SharePoint that do not have a retention label applied to them. Would using the null character regex work for this? Document Property is: 'ComplianceTag:\0' Alternatively, is it possible to set a rule when a document property does NOT contain something?
Trainable Classifiers - Tips
Hello All, Just sharing some tips to assist with the process of data collection and the creation of trainable classifiers for the purpose of labelling/Data Loss prevention. -Regarding training Machine Learning to recognize a certain document type, It must have one or more recognizable aspects. Possible usable recognizable aspects of the data/document type: Keyword or metadata values (keyword query language) Previously identified patterns of sensitive information like social security, credit card, or bank account numbers https://learn.microsoft.com/en-us/purview/sit-sensitive-information-type-entity-definitions https://learn.microsoft.com/en-us/purview/sit-document-fingerprinting: recognizing an item because it's a variation on a template The presence of exact strings https://learn.microsoft.com/en-us/purview/sit-learn-about-exact-data-match-based-sits#learn-about-exact-data-match-based-sensitive-information-types -In the below examples, we focus on Document Fingerprinting and Previously identifiable Sensitive information Type. For e.g. Regarding positive samples, The below file samples display a pattern, CC info (dummy data), Include Keywords referring to CC info such CVV2/AMEX etc.... as well as SSN information. -This can be regarded as a pattern for positive detection. The above data samples (about 150 samples of a similar pattern) are stored in a folder in a dedicated SharePoint Site(In the below screenshot, Same items are used as false samples for another classifier). -Regarding Negative samples, It is the same concept, It can be also stored in a folder in a dedicated Sharepoint Site and have a unique pattern or fingerprint. for e.g. -The below samples represent Credential information (dummy), Need to be about 150 samples or so. The samples should strongly represent a uniform document/data type different from positive samples. Similarly the data is stored in a dedicated folder in a SharePoint Site: Once the trainable classifier is created and fed this information, It will successfully identify data type to facilitate detection and minimize potential false positive.
