Microsoft Information Protection: Updated data classification confidence levels and customization

Microsoft is renaming the confidence levels (also called match accuracy) of data classification from a numerical scale to three distinct levels: high, medium, and low. In addition, you will soon be able to customize built-in classifiers (sensitive information types) in the Microsoft 365 compliance center.

This is message associated with Roadmap IDs 68915 and 68916.

When this will happen

Microsoft will roll out these changes from mid-January through the end of February 2021.

How this will affect your organization

First, sensitive information types are currently labeled with numerical values to reflect confidence: 85, 75, and 65. With this change, Microsoft is renaming the classification to high, medium, and low, respectively. Each level reflects the degree of supporting evidence detected along with primary element. Your existing polices will be automatically migrated to these renamed confidence levels.

• A high confidence level has the most supporting elements and results in the fewest false positives but the most false negatives.
• A low confidence level has most false positives but the fewest false negatives.

Your existing policies in the following solutions will soon reflect these updated classifications, and you will notice an improvement in the accuracy of your policy match results:

• Auto-labeling policies
• Communication compliance
• Data loss prevention policies
• Retention labels
• Sensitivity labels

Second, you will soon be able to copy built-in sensitive information types and edit the copied versions to fine tune them.

When creating a custom information type, you’ll notice an improved user interface and new capabilities. Changes include the ability to use validators (such as a Luhn check) for regular expressions. There are additional checks to help refine detection, including options for excluding specific matches as well as defining starting and ending characters.

What you need to do to prepare

You might want to notify your users about this new capability and update your training and documentation as appropriate.

Learn more

• Customizing sensitive information types
• Data classification in the Microsoft 365 compliance center