Scanning for the "All Full Names" SITs within files on prem limitations

jpcapone 1,491

I can confirm that the AIP Scanner is working properly because I can use it find some SITs within files on prem. However when I create a label and configure it to auto label files containing the All Full Names SIT, none of my test files that contain full names are not flagged. When I set the scan job to All for "info types to be discovered", none of the files with full names are flagged. I am placing files with full names there on purpose. If I test the All Full Names SIT directly with any file that was scanned, the items are discovered and reported in the test. Can anyone explain this behavior or is there any documentation that explains whats happening?

Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-01T13:25:50.18+00:00

Hi @jpcapone

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

It seems that you are experiencing an issue where the Microsoft Purview (previously known as Azure Information Protection) Scanner is not flagging files containing the "All Full Names" Sensitive Information Types (SIT) during your scan jobs, despite the SIT being detected when tested directly.

It's great news that the AIP Scanner is functioning as expected. However, there might be an issue with the configuration of the auto-labeling rule for the "All Full Names" Sensitive Information Type (SIT).

When you created the label and configured it to auto-label files containing the "All Full Names" SIT, did you ensure that the condition for applying the label was set appropriately? You can set the detection criteria to "All of these" or "Any of these" in the upper right of the autolabeling for items page of the label properties. The default setting for detection criteria is "All of these", which means that the asset must contain all the specified sensitive information types for the label to be applied.

For more details please refer: https://learn.microsoft.com/en-us/purview/concept-best-practices-sensitivity-labels#label-considerations

Here are few limitations that needs to be considered when scanning for the “All Full Names” Sensitive Information Type (SIT) within files on-premises using Microsoft Purview:

Advanced Classification: The “All Full Names” SIT is an advanced classifier, so you must enable advanced classification before using it

Keyword Highlighting: This feature is not supported for the “All Full Names” SIT, meaning keywords in a document that match the policy won’t be highlighted in the Contextual Summary view.

For details, please refer: https://learn.microsoft.com/en-us/purview/sit-defn-all-full-names

Instance Count Limits: The number of unique instances of a SIT in any single item must fall between the minimum and maximum values set in the rule criteria. The minimum value can be between 1 and 500, and the maximum value can be set to a specific number up to 500 or to “Any” for an undefined number.

For additional information, please refer: https://learn.microsoft.com/en-us/purview/sit-limits

File Size Limitations: There are limits on the maximum size of text that can be extracted from a file for scanning, which is typically around 2 MB.

Document to refer: https://learn.microsoft.com/en-us/purview/dlp-policy-reference

I hope this information helps. Please do let us know if you have any further queries.

Thank you.
jpcapone 1,491 Reputation points

2024-11-01T15:37:23.4433333+00:00

When you created the label and configured it to auto-label files containing the "All Full Names" SIT, did you ensure that the condition for applying the label was set appropriately? Here is a screenshot of the label settings.

Advanced Classification: The “All Full Names” SIT is an advanced classifier, so you must enable advanced classification before using it. Please confirm that this is the correct place to enable it. The documentation is very unclear about this:

Here is the scan job settings

Here is the output from the scanner NOT showing the SIT All Full Names.

Please advise

1 answer

jpcapone 1,491 Reputation points

2024-11-01T15:25:08.13+00:00

When you created the label and configured it to auto-label files containing the "All Full Names" SIT, did you ensure that the condition for applying the label was set appropriately?

Please review the settings below:

Advanced Classification: The “All Full Names” SIT is an advanced classifier, so you must enable advanced classification before using it.

The documentation is unclear on how to enable advanced classification but this is what I have found:

As configured, the label is actually assigned to the document but the SIT "All Full Names" is not listed as being found in the document.

Here is the scan job settings:

Please review the screenshots I have provided and let me know if there are any other changes to be made.
Please sign in to rate this answer.
Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-04T16:19:58.6633333+00:00

Hi @jpcapone

Thank you for providing the additional screenshots.

Based on the label settings and the scan job settings, it seems that you have correctly enabled advanced classification for the "All Full Names" Sensitive Information Type (SIT) and set the detection criteria to "Any of these". However, the output from the scanner does not show the "All Full Names" SIT being detected in your test files.

This could be due to limitations in the scanning process, such as the file size limit for text extraction during scanning or the instance count limit for SITs in any single item.

I recommend checking the file size and instance count limits for your test files, as well as reviewing the documentation on Sensitive Information Types (SITs) and the limitations of scanning for SITs in Microsoft Purview.

I hope this information helps. Please do let us know if you have any further queries.

Thank you.

jpcapone 1,491 Reputation points

2024-11-04T18:28:15.0466667+00:00

Shouldn't the instance count be irrelevant when searching for All Sensitive info types? Also, as you can see in my screenshots the instance count was 1 for the minimum. Should this be documented as a known issue or is there something else we are missing? Can this behavior be duplicated by Microsoft engineers?

Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-05T09:32:46.4266667+00:00

Hi @jpcapone

Apologies for the inconvenience.

I agree that this issue looks strange, and I wasn't able to reproduce this issue. If you have a support plan, could you please file a support ticket for deeper investigation and do share the SR# with us? In case if you don't have a support plan, please let us know here.

Thank you.

jpcapone 1,491 Reputation points

2024-11-05T15:19:24.0366667+00:00

Here is the ticket number

‎2411050040009384

Chandra Boorla 2,990 Reputation points Microsoft Vendor

2024-11-06T03:10:11.0266667+00:00

Hi @jpcapone

Thank you for providing the details.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Scanning for the "All Full Names" SITs within files on prem limitations

1 answer

Your answer