Microsoft Purview Interview Questions and Answers Part 3 - Classifications and Sensitive Data

Microsoft Purview Interview Q&A · Part 3 of 10

In this post we are going to cover classifications in Microsoft Purview: how Purview finds sensitive data like credit card numbers and national IDs across your data estate. These are 7 real Purview interview questions, asked the way they come up on a real project, and the last one is a scenario where an auditor wants a list of every table that holds personal data, with its owner.

A classification is a tag that says what the data is: Credit Card Number, Email Address, U.S. Social Security Number. Purview puts these tags on columns and files when it scans your sources. Interviewers ask about it because it is the first thing compliance teams want from Purview, and because the details (scan levels, scan rule sets, thresholds) are where most projects go wrong.

Part 3 of the Real Time Microsoft Purview Interview Questions and Answers series on TechBrothersIT.

On this page

1. The short answer
2. Question 1: Compliance asks: where in our data estate do we store credit card numbers and national IDs? How does Purview find them?
3. Question 2: A column full of employee IDs is never classified. What are system classifications, and why might a column not get one?
4. Question 3: Your company uses its own customer number format, CUST- followed by eight digits. How do you create a custom classification and classification rule?
5. Question 4: You created the custom rule, but the next scan still doesn't apply it. What did you forget?
6. Question 5: A manager asks: aren't classifications the same thing as sensitivity labels? What is the difference, and how do they connect?
7. Question 6: The scan tags a notes column as containing phone numbers, but it's mostly free text. How does sampling and the match threshold work, and how do you handle false positives?
8. Scenario 7: An auditor wants a report of every table that holds personal data, by owner. How do you produce it with Purview?

The short answer

Say this first

Purview finds sensitive data by scanning at level 3 and matching sampled values against system and custom classification rules. Custom rules only run from a custom scan rule set. A classification says what the data is; a sensitivity label, applied by auto-labeling, says how sensitive it is.

Keep that in mind. Every question below is one piece of it.

Question 1: Compliance asks: where in our data estate do we store credit card numbers and national IDs? How does Purview find them?

Purview finds them by scanning. Let's walk through it in order.

• First, register each source in the Data Map: Azure SQL, ADLS, Snowflake and so on.
• Then run a scan at level 3. That level samples the actual data, not just the schema.
• During the scan, Purview checks the sampled values against classification rules. Credit card numbers and most national IDs are built-in system classifications, matched with regular expressions. When a column or a file matches, it gets the classification.
• Finally, answer compliance from the catalog: search the data assets and filter by the Credit Card Number classification.

Here is the kind of result you get back: every column and file that matched, with the source it lives in.

Asset	Column	Classification
Azure SQL: sales.customers	card_number	Credit Card Number
ADLS: hr/employees.csv	ssn	U.S. Social Security Number
Snowflake: crm.contacts	email	Email Address

One more thing: the scan rule set decides which classifications run, so pick one that covers the countries you actually operate in.

Honest caveat

Classification works on a sample. Treat it as strong evidence, not a promise that every row was checked.

Question 2: A column full of employee IDs is never classified. What are system classifications, and why might a column not get one?

System classifications are the 200+ built-in rules from Microsoft. They detect data in three ways:

Detection	Examples
Regular expression	credit card, passport, tax IDs, email
Bloom filter	World Cities, Country
Machine learning	Person's Name, Address

Now the employee ID column. The first reason it gets no tag is simple: an employee ID is your company's own format, so no system rule knows it. You need a custom classification, which is the next question.

If it is not that, here is the list I check, in order:

• The scan did not run at level 3, so no data was sampled.
• The classification is not in the scan rule set.
• The column has fewer than 8 distinct values.
• Fewer than 60 percent of the sampled values match. For system classifications that threshold is fixed.

Also remember that tables never get automatic classifications. Only their columns and files do. And encrypted data gives only metadata, so it can't be classified until it is decrypted.

Question 3: Your company uses its own customer number format, CUST- followed by eight digits. How do you create a custom classification and classification rule?

It is two objects: the classification is the tag, and the classification rule does the detecting.

Let's create both. First the classification, in the Data Map under annotation management, with a namespaced name like CONTOSO.SALES.CUSTOMER_NUMBER. Then the rule: pick a regular expression rule, with a data pattern that matches the letters CUST, a dash, and exactly eight digits, anchored at the start and the end. You can add a column pattern too, and then both must match.

classification-rule.txt

# 1. Classification  (Annotation management)
Name:            CONTOSO.SALES.CUSTOMER_NUMBER
Description:     Customer number, CUST- + 8 digits

# 2. Classification rule
Type:            Regular expression
Data pattern:    ^CUST-[0-9]{8}$
Column pattern:  cust_no|customer_number
Min match:       60%
State:           Enabled

Set the minimum match threshold. 60 percent is the suggested value, and with a single data pattern you can choose anything from 1 to 100 percent. Then test the rule with a sample file before you rely on it.

• The regex is case-insensitive, so cust-12345678 matches too.
• Custom classifications only work on structured data: SQL tables, CSV, JSON and Parquet, not Word or PDF files.

Question 4: You created the custom rule, but the next scan still doesn't apply it. What did you forget?

Almost always, the scan rule set. Custom classification rules are not part of the system scan rule sets. You create a custom scan rule set, tick your custom rule in it, and point the scan at that rule set.

Here is the full checklist, in the order I go through it:

• A custom scan rule set, with your rule ticked.
• The scan actually uses that rule set.
• The scan runs at level 3, or auto detect on a source that supports it, because classification only happens when data is sampled.
• The rule state is Enabled.
• The scan is in the same Data Map domain as the custom scan rule set. A custom rule set can only be used in the domain where it was created.
• The source takes custom rules at all. Databricks Unity Catalog, for example, only gets system classifications.
• Rescan. Changing a classification or a scan rule set triggers a full scan, so plan it for off-peak hours.

Stale tags

A rescan usually doesn't remove tags it detected before, so clean up old ones by hand.

Question 5: A manager asks: aren't classifications the same thing as sensitivity labels? What is the difference, and how do they connect?

They are different. A classification says what the data is. A sensitivity label says how sensitive it is.

	Classification	Sensitivity label
ANSWERS	What is it?	How sensitive is it?
EXAMPLE	Credit Card Number	Highly Confidential
COMES FROM	Scan rules (Data Map)	Information Protection
PER ASSET	several	one

Classifications come from scan rules in the Data Map, and one asset can have several. Labels come from Information Protection, the same labels your company uses for email and documents, and an item has only one.

They connect through auto-labeling. You create an auto-labeling policy for non-Microsoft 365 locations, for example: if a column is classified as Credit Card Number, apply Highly Confidential. The label lands on the next scan.

The catch

Labeling in the Data Map is still in preview, and it is metadata only. It doesn't encrypt the file or block access to the SQL column.

And SQL Server's own sensitivity classification is a separate system that doesn't sync with Purview, so don't mix the two up in an interview.

Question 6: The scan tags a notes column as containing phone numbers, but it's mostly free text. How does sampling and the match threshold work, and how do you handle false positives?

The scanner doesn't read every row. It reads a sample from each table or file and checks the sampled values against each rule in the scan rule set.

The minimum match threshold is the share of distinct sampled values that must match before the tag is applied:

Rule	Threshold	Note
System	fixed 60%	8+ distinct values
Custom	1-100%, suggested 60%	fixed 60% with 2+ patterns

In a free text notes column, enough values contain something that looks like a phone number, so the pattern clears the bar. You can see the evidence: the curator view shows the sample count and distinct count behind each classification.

Here is how we fix it, step by step:

• Remove the classification by hand. Manually removed tags are not re-applied.
• Use a custom scan rule set without the rules you don't need, like other countries' formats. Fewer rules means fewer false positives and a faster scan.
• For your own rules, add a column pattern and raise the threshold.

Scenario 7: An auditor wants a report of every table that holds personal data, by owner. How do you produce it with Purview?

Let's build it in four steps.

• Coverage. Scan every source at level 3, with a scan rule set that includes the personal data classifications (names, emails, national IDs) plus your custom ones, like the customer number.
• Owners. A classification tells you what the data is, not who owns it. Set owner contacts on the assets, or better, put the tables into data products in Unified Catalog, where every product has owners.
• The list. Classifications sit on columns, not tables, so search the data assets filtered by those classifications and roll the columns up to their parent table. For a repeatable report, run the same search through the API into Power BI.
• Built-in reports. Health management has a classic classifications report, and the classification and labeling health control shows how much of the estate is covered.

The result looks like this:

Table	PII found	Owner
hr.employees	SSN, email	HR
crm.contacts	name, phone	Sales ops
sales.customers	email, card	Finance

Tell the auditor what it proves

Purview shows where personal data was found and who is accountable. Who can actually read it still comes from the source systems, because Purview doesn't grant database access.

Key points to remember

• Scan at level 3: sampled values vs classification rules
• 200+ system rules; 60% threshold, 8+ distinct values
• Custom rules need a custom scan rule set
• Classification = what it is; label = how sensitive
• Data Map labels: preview, metadata only

Next in this series

Part 4: Unified Catalog, Domains and Data Products

Part of the Real Time Microsoft Purview Interview Questions and Answers series on TechBrothersIT. Product names, features and their status (GA or preview) are current as of October 2026. Microsoft changes Purview every month, so check the Microsoft Learn page for anything you quote in an interview.