Create Microsoft Purview Sensitivity Labels (MIP) detector

Scan Microsoft Purview Sensitivity Labels with Custom Regex Detectors

Overview

Nightfall exposes Microsoft Information Protection (MIP) label metadata during file scanning, allowing you to detect files based on their Microsoft Purview sensitivity labels using Custom Regex Detectors.

This enables organizations to build policies around their existing Microsoft Purview classification strategy without relying solely on content inspection.

Common use cases include:

• Detecting files labeled Confidential, Internal, or Restricted

• Alerting when labeled files are shared externally

• Blocking uploads of sensitive classified content

• Triggering remediation workflows for protected documents

• Monitoring the movement of labeled files across SaaS applications

How It Works

When a file contains a Microsoft Purview sensitivity label, Nightfall extracts the label metadata and makes it available during scanning in the following format:

mip.label.name=<Label Name>

For example:

mip.label.name=Confidential

mip.label.name=Internal

You can create Custom Regex Detectors that match the labels used within your organization.

Create a Custom Regex Detector

To scan for Microsoft Purview sensitivity labels, create a Custom Regex Detector and use it in a Nightfall policy or workflow.

1. Create a Custom Regex Detector.

2. Add a regex that matches the sensitivity labels relevant to your organization.

3. Use the detector in Nightfall policies and workflows.

4. Test against files containing the corresponding sensitivity labels.

For example, to detect files labeled Confidential or Internal, use the following pattern:

(?m)^mip\.label\.name=(Confidential|Internal)$

This detector will match files that contain either sensitivity label.

Understanding the Regex

Component	Description
(?m)	Enables multiline mode so anchors apply to individual metadata lines
^	Matches the beginning of the metadata line
mip\.label\.name=	Matches the MIP label metadata field
(Confidential|Internal)	Matches either label value
$	Matches the end of the metadata line

Custom Label Names

Microsoft Purview allows organizations to create custom sensitivity labels. Because label names vary between organizations, Nightfall does not provide predefined detectors for specific labels.

Instead, create Custom Regex Detectors that match the labels used within your environment.

For example:

(?m)^mip\.label\.name=(Restricted)$

(?m)^mip\.label\.name=(Customer Data)$

(?m)^mip\.label\.name=(Highly Confidential)$

Best Practices

Match Exact Label Names

Use anchors (^ and $) to ensure the detector matches only the intended label value.

Recommended:

(?m)^mip\.label\.name=(Confidential)$

Not recommended:

Confidential

The recommended pattern reduces unintended matches and improves detector accuracy.

Align Policies with Existing Classification

Use the same sensitivity labels already defined in Microsoft Purview to:

• Reduce policy complexity

• Leverage existing data classification investments

• Improve policy consistency across security tools

Test Before Deployment

Before enabling enforcement actions, validate that your detector correctly identifies files containing the expected sensitivity labels.

Limitations

• Detection is based on MIP label metadata present within the scanned file.

• Label names are organization-specific and may vary across environments.

• Custom Regex Detectors must be configured to match the label names used by your organization.