Viewing Regex in Built-in Sensitive Info Types

SC-400 By islever Editorial Last updated

Short answer

D Create a copy of the IP Address sensitive info type and instruct User1 to edit the copy.

Question

You have a Microsoft 365 E5 tenant that contains a user named User1. User1 is assigned the Compliance Administrator role. User1 cannot view the regular expression in the IP Address sensitive info type. You need to ensure that User1 can view the regular expression. What should you do?
  1. Assign User1 the Global Reader role.
  2. Assign User1 to the Reviewer role group.
  3. Instruct User to use the Test function on the sensitive info type.
  4. Create a copy of the IP Address sensitive info type and instruct User1 to edit the copy. Correct Answer

Key Takeaways

Tests the limitation of editing Microsoft-predefined sensitive info types; the trap is assuming role assignment grants visibility to internal regex logic.

Built-in sensitive info types in Microsoft Purview DLP hide the underlying regular expressions for security. To view or modify these regex patterns, users must create a copy of the built-in type and edit that instance.

Common mistake: Learners often select assigning higher administrative roles like Global Reader, believing elevated permissions grant access to all configuration details, including hidden regex strings.

Expert Analysis

Why the Answer Is Correct

Microsoft defines built-in sensitive info types as immutable templates within the compliance center. While a Compliance Administrator can configure policies using these types, the system deliberately hides the complex regular expressions used for detection to prevent accidental misconfiguration. By creating a copy of the built-in type, you generate a custom instance that unlocks the 'Edit' interface, allowing User1 to view and modify the underlying regular expression.

Why the Other Options Are Wrong

Assigning the Global Reader role (Option A) provides read-only access to the entire tenant but does not bypass the UI restriction hiding the regex in built-in types. The Reviewer role group (Option B) is typically associated with content review workflows, not DLP policy configuration. Using the Test function (Option C) allows validation of matches against sample data but does not expose the source code or regex pattern itself.

Community Comment Notes

Community feedback strongly supports Option D, with users noting that testing in a lab confirmed the inability to view regex in the standard edit screen. As SDiwan noted, "You can only see the regex in edit screen" of a copied instance. Official documentation confirms that while built-ins cannot be edited directly, copying them enables customization and inspection.

Official Reference

https://learn.microsoft.com/en-us/purview/sit-customize-a-built-in-sensitive-information-type

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with Microsoft Purview built-in objects, always consider if they are locked/immutable. If you need to inspect or change internal properties of a built-in template, the standard procedure is usually to duplicate it first.

Frequently Asked Questions

Why can't I view the regex in a built-in sensitive info type?

Built-in types are predefined by Microsoft to ensure stability. The regex is hidden to prevent accidental changes that could break detection accuracy.

Does the Compliance Administrator role allow editing built-in types?

No. This role allows managing policies but cannot modify the core definition of Microsoft's pre-built sensitive info types directly.

More SC-400 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Ruslan23 👍 2 Answered D
    To ensure that User1 can view the regular expression in the IP Address sensitive info type, you should create a copy of the IP Address sensitive info type and instruct User1 to edit the copy (Option D). Here’s why: The built-in sensitive info types, such as the IP Address type, are predefined by Microsoft and cannot be edited1. However, you can create a copy of a built-in sensitive info type, and then modify the copy2. In the copied sensitive info type, User1 will be able to view and edit the regular expression2. Please note that the Compliance Administrator role does not grant the ability to view or edit the regular expressions of built-in sensitive info types1. The Global Reader role (Option A) and the Reviewer role group (Option B) also do not provide these permissions1. The Test function (Option C) is used to test the effectiveness of a sensitive info type, but it does not allow a user to view or edit the regular expression1. - Copilot -
  2. SDiwan 👍 2 Answered D
    Correct answer is D. Test in lab now. You can only see the regex in edit screen. since this is a in-built SIT, only option is to make a copy and then go to edit screen of that copied SIT.
  3. emartiy 👍 2 Answered D
    What Ruslan23 shared seems correct. Correct selection should be D based on the description.
  4. emartiy 👍 1
    https://learn.microsoft.com/en-us/purview/sit-customize-a-built-in-sensitive-information-type

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Add an Information Barrier Segment to SharePoint Site1

S-grade

Enforcing Sensitivity Labels for Microsoft 365 Groups

S-grade

Which Locations Can Be Configured for a Subject Rights Request?

S-grade

Activate ISO/IEC 27001:2013 Template in Compliance Manager

S-grade

← Back to SC-400 Study Guide