MC1162966 – Microsoft Purview | Information Protection: Updates to Microsoft built-in Sensitive Information Types (SITs) (archived)

Product:

Purview, Purview Communication Compliance, Purview Data Loss Prevention, Purview Information Protection

Platform:

Online, World tenant

Status:

Change type:

Feature update, User impact, Admin impact

Links:

Details:

Summary:
Microsoft is updating five bundled EU Sensitive Information Types in Purview to improve detection accuracy by enhancing keywords and processors. The rollout began mid-September 2025, completing by mid-October 2025. No admin action is needed; existing policies will automatically benefit from improved detection.

Details:
[Introduction]
To improve detection accuracy across EU identifiers, we're updating the definitions of five Microsoft built-in out-of-box bundled (OOB) Sensitive Information Types (SITs). These bundled SITs include EU passport number, EU national identification number, EU social security number or equivalent identification, EU tax identification number, and EU driver's license number. Bundled SITs contain definitions for multiple EU nations within a single SIT. With this update, we've aligned the accuracy of bundled SITs with their standalone counterparts by enhancing supporting keywords and function processors.
[When this will happen:]
General Availability (Worldwide): Rollout began in mid-September 2025 and is expected to complete by mid-October 2025.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2025-10-01

updated:
2025-10-01

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Detection Accuracy Improvement
The update to bundled EU Sensitive Information Types (SITs) will enhance detection accuracy, potentially leading to fewer false positives and negatives in data loss prevention policies. This could improve user trust in the system but may also require users to adapt to changes in how sensitive information is flagged.
   - roles: Compliance Officer, Data Protection Officer
   - references: https://learn.microsoft.com/purview/sit-sensitive-information-type-learn-about

Policy Review Necessity
While no admin action is required, the update may necessitate a review of existing Data Loss Prevention (DLP) and Information Protection policies to ensure they align with the new definitions, which could temporarily disrupt workflows if not managed properly.
   - roles: IT Administrator, Compliance Officer
   - references: https://learn.microsoft.com/purview/sit-sensitive-information-type-learn-about

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft is enhancing its Microsoft Purview tool by updating certain Sensitive Information Types (SITs) to improve how well it detects sensitive data, particularly for European identifiers like passport numbers and social security numbers. Think of this update like upgrading a metal detector at an airport. Previously, the detector might have missed some smaller or less obvious items, but with the upgrade, it can now detect a wider range of items more accurately.

For those managing data protection policies, this means that the system will automatically become better at identifying sensitive information without requiring any manual changes. It's like having a software update on your phone that improves its performance without you needing to do anything other than ensuring it's connected to Wi-Fi.

This update will roll out over a month, starting in mid-September 2025 and finishing by mid-October 2025. If you're responsible for managing these policies, you don't need to take any action. However, you might want to let your compliance or security teams know about the update, similar to informing your team about a new feature in a tool you all use regularly.

Overall, this change is designed to make data protection more robust and efficient, much like how a new security feature in a building might make it safer without altering the daily routine of its occupants.