> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/detection_platform/custom_detectors/create-microsoft-purview-sensitivity-labels-mip-detector.md).

# Create Microsoft Purview Sensitivity Labels (MIP) detector

### Overview

Nightfall exposes Microsoft Information Protection (MIP) label metadata during file scanning, allowing you to detect files based on their Microsoft Purview sensitivity labels using Custom Regex Detectors.

This enables organizations to build policies around their existing Microsoft Purview classification strategy without relying solely on content inspection.

Common use cases include:

* Detecting files labeled Confidential, Internal, or Restricted
* Alerting when labeled files are shared externally
* Blocking uploads of sensitive classified content
* Triggering remediation workflows for protected documents
* Monitoring the movement of labeled files across SaaS applications

### How It Works

When a file contains a Microsoft Purview sensitivity label, Nightfall extracts the label metadata and makes it available during scanning in the following format:

```
mip.label.name=<Label Name>
```

For example:

```
mip.label.name=Confidential
```

```
mip.label.name=Internal
```

You can create Custom Regex Detectors that match the labels used within your organization.

### Create a Custom Regex Detector

To scan for Microsoft Purview sensitivity labels, create a Custom Regex Detector and use it in a Nightfall policy or workflow.

1. Create a Custom Regex Detector.
2. Add a regex that matches the sensitivity labels relevant to your organization.
3. Use the detector in Nightfall policies and workflows.
4. Test against files containing the corresponding sensitivity labels.

For example, to detect files labeled **Confidential** or **Internal**, use the following pattern:

```
(?m)^mip\.label\.name=(Confidential|Internal)$
```

This detector will match files that contain either sensitivity label.

#### Understanding the Regex

| Component                  | Description                                                          |
| -------------------------- | -------------------------------------------------------------------- |
| `(?m)`                     | Enables multiline mode so anchors apply to individual metadata lines |
| `^`                        | Matches the beginning of the metadata line                           |
| `mip\.label\.name=`        | Matches the MIP label metadata field                                 |
| `(Confidential\|Internal)` | Matches either label value                                           |
| `$`                        | Matches the end of the metadata line                                 |

### Custom Label Names

Microsoft Purview allows organizations to create custom sensitivity labels. Because label names vary between organizations, Nightfall does not provide predefined detectors for specific labels.

Instead, create Custom Regex Detectors that match the labels used within your environment.

For example:

```
(?m)^mip\.label\.name=(Restricted)$
```

```
(?m)^mip\.label\.name=(Customer Data)$
```

```
(?m)^mip\.label\.name=(Highly Confidential)$

```

### Best Practices

#### Match Exact Label Names

Use anchors (`^` and `$`) to ensure the detector matches only the intended label value.

Recommended:

```
(?m)^mip\.label\.name=(Confidential)$
```

Not recommended:

```
Confidential
```

The recommended pattern reduces unintended matches and improves detector accuracy.

#### Align Policies with Existing Classification

Use the same sensitivity labels already defined in Microsoft Purview to:

* Reduce policy complexity
* Leverage existing data classification investments
* Improve policy consistency across security tools

#### Test Before Deployment

Before enabling enforcement actions, validate that your detector correctly identifies files containing the expected sensitivity labels.

### Limitations

* Detection is based on MIP label metadata present within the scanned file.
* Label names are organization-specific and may vary across environments.
* Custom Regex Detectors must be configured to match the label names used by your organization.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.nightfall.ai/detection_platform/custom_detectors/create-microsoft-purview-sensitivity-labels-mip-detector.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.