Discovery & Posture Management

Goal: Understand the 300+ built-in detectors before creating custom ones.

Key SITs for Higher Education:

Click-Ops:

1. Navigate to Microsoft Purview portal → Solutions → Information Protection → Classifiers → Sensitive info types
2. Review the list of built-in SITs
3. Test a Built-in SIT:
   • Click on U.S. Social Security Number (SSN)
   • Click Test and enter: 123-45-6789
   • Verify detection works as expected

Goal: Create a classifier for your institution's unique identifier format.

Click-Ops (Purview Portal):

1. Go to Information Protection > Classifiers > Sensitive info types
2. Click + Create sensitive info type
3. Name: TAMU Employee/Student UIN
4. Description: Detects TAMU UINs with supporting keywords
5. Patterns: Click + Create pattern
   • Confidence level: High confidence
   • Primary element: Regular Expression
     • Value: \b\d{3}-?00-?\d{4}\b
   • Supporting elements: Keyword list
     • Add: "UIN", "Universal ID", "Student ID", "TAMU ID"
   • Character proximity: Anywhere in the document
6. Click Create

PowerShell:

Connect-IPPSSession

$RulePackageXML = @"
<?xml version="1.0" encoding="utf-8"?>
<RulePackage xmlns="http://schemas.microsoft.com/office/2011/mce">
  <RulePack id="$(New-Guid)">
    <Version major="1" minor="0" build="0" revision="0"/>
    <Publisher id="$(New-Guid)"/>
    <Details defaultLangCode="en-us">
      <LocalizedDetails langcode="en-us">
        <PublisherName>Your University</PublisherName>
        <Name>Custom SIT Package</Name>
        <Description>Custom sensitive information types</Description>
      </LocalizedDetails>
    </Details>
  </RulePack>
  
  <Rules>
    <Entity id="$(New-Guid)" patternsProximity="300" recommendedConfidence="85" relaxProximity="true">
      <Pattern confidenceLevel="85">
        <IdMatch idRef="Regex_UIN"/>
        <Any minMatches="1">
          <Match idRef="Keyword_UIN"/>
        </Any>
      </Pattern>
    </Entity>
    
    <Regex id="Regex_UIN">\b\d{3}-?00-?\d{4}\b</Regex>
    
    <Keyword id="Keyword_UIN">
      <Group matchStyle="word">
        <Term>UIN</Term>
        <Term>Universal ID</Term>
        <Term>Student ID</Term>
      </Group>
    </Keyword>
  </Rules>
</RulePackage>
"@

$TempFile = [System.IO.Path]::GetTempFileName() + ".xml"
$RulePackageXML | Out-File -FilePath $TempFile -Encoding UTF8
New-DlpSensitiveInformationTypeRulePackage -FileData ([System.IO.File]::ReadAllBytes($TempFile))
Remove-Item $TempFile

Goal: Detect documents related to specific high-risk grants (CUI/ITAR).

Click-Ops:

1. Navigate to Microsoft Purview portal → Solutions → Information Protection → Classifiers → Sensitive info types
2. Click + Create sensitive info type
3. Name: Research Grant ID
4. Patterns:
   • Primary element: Regular Expression
     • Value: \b[A-Z]{2,5}-\d{4}-\d{4,6}\b
   • Supporting elements: Keyword list
     • Add: "Grant", "Award", "Principal Investigator", "PI", "NSF", "NIH", "DOD", "DOE", "DARPA"
5. Click Create

Goal: Visualize where sensitive data lives across M365.

Click-Ops:

1. Navigate to Microsoft Purview portal → Solutions → Information Protection → Content explorer
2. Locate your custom sensitive information types
3. Click on each SIT to analyze distribution:
   • SharePoint: Are UINs appearing in "Public" sites?
   • OneDrive: Are faculty storing student rosters personally?
   • Exchange: Are UINs being emailed externally?
4. Export summary report for leadership

Goal: Use machine learning to detect document types that patterns can't identify.

Built-in Classifiers (A5):

Creating a Custom Classifier (e.g., Academic Transcripts):

1. Navigate to Microsoft Purview portal → Solutions → Information Protection → Classifiers → Trainable classifiers
2. Click + Create trainable classifier
3. Name: Academic Transcript
4. Seed Content:
   • Create SharePoint site: Trainable Classifier Seed Content
   • Upload 50+ positive examples (redacted transcripts)
5. Training:
   • Wait 24-48 hours for processing
   • Review items and mark as Match or Not a match
   • Provide 200+ feedback responses
6. Publish when accuracy reaches >80%

Goal: Monitor what's happening to sensitive data in real-time.

What Activity Explorer Tracks:

Click-Ops:

1. Navigate to Microsoft Purview portal → Solutions → Information Protection → Activity explorer
2. Set date range (default: last 30 days)
3. Filter by Activity: LabelApplied, DLPRuleMatch
4. Filter by SIT: Your custom UIN type
5. Export for compliance reporting

Goal: Detect data by matching against an actual database of known values.

Why EDM for Higher Ed:

• SITs detect any pattern match
• EDM detects only values in your student database
• Dramatically reduces false positives

High-Level Process:

1. Create EDM Schema: Define columns (UIN, Name, Email)
2. Prepare and Hash Data: Export from Banner, hash with EDM Upload Agent
3. Create EDM-based SIT: Link to your schema
4. Test and Deploy: Use in DLP for highest accuracy

Click-Ops:

1. Navigate to Microsoft Purview portal → Solutions → Data Security Posture Management
2. DSPM will aggregate data from other tools (24-48 hours)
3. Configure Posture Score Goals:
   • Click Settings
   • Set target score (current + 10 points)
   • Define priority data types (FERPA, Research)
4. Review Data at Risk:
   • Filter by sensitivity label status
   • Export for remediation planning
5. Analyze Oversharing:
   • Review files shared with "Everyone"
   • Flag for access review

Key Metrics:

Goal: Assess Copilot exposure risk before enabling M365 Copilot.

Pre-Copilot Checklist:

• DSPM posture score ≥ 70
• <100 overshared sensitive files
• "Highly Confidential" content has restricted access
• Research data excluded from general access