This page explains the Capability and Confidence fields shown on each sensitive information type (SIT). Statements drawn from Microsoft's documentation are tagged Microsoft-documented with a source link; interpretation added by Lockbase Cyber is tagged Lockbase guidance.
Capability: Standard vs Advanced
Each SIT carries a Capability value of Standard or Advanced. In this dataset, Advanced SITs fall into two groups: Microsoft named entities — complex dictionary/pattern classifiers that detect broad concepts (e.g. All Full Names, All Physical Addresses, All Medical Terms and Conditions, Diseases) — and credential classifiers that detect secrets such as API keys, tokens, and connection strings (e.g. Azure Storage Account Key, Amazon S3 Client Secret Access Key). Standard SITs are the classic pattern-based detectors (regular expressions, keyword lists, and checksum functions) for well-structured identifiers such as routing numbers, passport numbers, and national IDs.
The Microsoft Purview portal surfaces this distinction as a Supported platforms column: Standard SITs show All, and Advanced SITs show Microsoft 365. Each card in the Sensitive Info Types tool mirrors that value.
| Standard | Advanced | |
|---|---|---|
| Supported platforms | All | Microsoft 365 |
| Detection method | Pattern-based: regex, keyword lists/dictionaries, and checksum functions, with supporting elements and proximity. | Named-entity classifiers (broad concepts like names, addresses, medical terms) and credential classifiers (API keys, tokens, connection strings). |
| Licensing | Broadly available. | Requires an E5 license — advanced classifiers and credential-scanning SITs are E5-only ("E5 license is required to make use of credential scanning SITs"). |
| Setup | Works out of the box. | Requires Advanced classification scanning and protection to be enabled. |
| Workload support | Full. | Narrower — not supported on on-premises repositories or Power BI. |
| In this dataset | — SITs | — SITs (— named entities + — credential) |
Lockbase guidance The Supported platforms values (All / Microsoft 365) are what the Microsoft Purview portal displays for each SIT. Microsoft's cmdlet reference doesn't formally define the underlying Standard/Advanced Capability field, so the deeper explanation below — that Advanced corresponds to E5-gated advanced classifiers — is Lockbase Cyber's interpretation, derived by correlating this export (— SITs) with Microsoft's documentation. In this data the Advanced set is exactly the named entities plus the credential-scanning classifiers, both of which Microsoft documents as requiring E5. The licensing, setup, and workload rows are Microsoft-documented facts about those classifiers (see Sources). Counts reflect the latest export.
Checksum validation
Microsoft-documented Some SITs include a checksum — a unique calculation that verifies a detected value is internally valid (for example, the Luhn check on a credit card number). Whether a SIT has one changes what the service needs to see before it flags a match:
- Checksum: Yes — the service can make a positive detection based on the sensitive data alone. A value that matches the pattern and passes the checksum is enough.
- Checksum: No — additional (secondary) elements must also be detected before the service makes a positive detection — typically a supporting keyword within the proximity window.
This is why the Sensitive Info Types list shows a Checksum validated field, and why the Match Tester flags a checksum-passing value on its own but requires a nearby keyword for SITs without a checksum.
Confidence levels & scoring
Microsoft-documented A match is scored on how much evidence was found. The primary element (the pattern, plus a checksum where one exists) establishes a base score; supporting elements — a keyword within the proximity window, a nearby date, etc. — raise it. More corroborating evidence → higher confidence. Microsoft maps these to three levels: Low = 65, Medium = 75, High = 85.
| Level | Score | Meaning |
|---|---|---|
| No match | 0–64 | Not enough evidence — the service does not flag it. |
| Low | 65–74 | Fewest false negatives but the most false positives. Returns low, medium, and high matches. |
| Medium | 75–84 | A balance of false positives and false negatives. Returns medium and high matches. |
| High | 85–100 | Fewest false positives but the most false negatives. Returns high-confidence matches only. |
Lockbase guidance The Match Tester scores each detection using the confidence tiers from Microsoft's rule package (the per-SIT `confidenceLevel` patterns), grouped into High / Medium / Low. The checksum/pattern alone gives a base score and a nearby supporting keyword raises it. For example a credit card number scores Low (65) on the checksum alone and High (85) with a nearby keyword or expiry date, while an IBAN scores High (85) on its checksum alone. Some SITs need more than one supporting element — e.g. EU passport numbers score Medium (75) with a passport keyword and High (85) only when a date (DD MM YY or a date keyword) is also nearby; the tester detects those dates. Exact scoring is defined per-SIT and is not consistent across SITs. The score-band ranges and the inconsistency caveat draw on community analysis (seppala365.cloud).
Sources
- Learn about sensitive information types — pattern components and confidence levels.
- Learn about named entities — advanced classifiers, E5 licensing, bundled vs unbundled.
- All Credential Types SIT — the credential-scanning classifiers (E5 required).
- Use named entities in your DLP policies — supported/unsupported workloads.
- Sensitive information type entity definitions — full list and confidence/accuracy mapping.
- General password SIT definition — describes how Checksum Yes/No affects positive detection.