Microsoft Defender for Cloud
Cloud and workloadsCustomize Data Sensitivity Settings - Microsoft Defender for Cloud | Microsoft Learn
In brief
The article now uses revised headings, wording, links, and step-by-step instructions. Prerequisites and details about supported Purview information types, labels, and sensitivity thresholds were clarified.
What Defender admins need to know
Review the updated prerequisites and configuration steps when setting up data sensitivity settings; no action is required by this change.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Customize data sensitivity settingsData Sensitivity Settings - Microsoft Defender for Cloud | Microsoft Learn
This article describes how toYou can customize data sensitivity settings in Microsoft Defender for Cloud. Before you begin, make sure you review the prerequisites and requirements and enable sensitive data discovery in your Defender for Cloud plan.
Data sensitivity settings are used to identify and focus on managing the critical sensitive data in your organization.
In this article, Defender cloud security posture management (Defender CSPM) refers to the Defender CSPM plan in Microsoft Defender for Cloud.
You can selectSelect sensitive information types and sensitivity labels from the Microsoft Purview portal in Defender for Cloud.
- By default, Defender for Cloud uses built-in sensitive information types from Microsoft Purview.
- Some information types and labels are enabled by default.
- Sensitive data discovery supports a subset of the built-in sensitive information types from Microsoft Purview. See the reference list of supported sensitive information types
, including defaults.. You can modifyModify the default settings on the Data sensitivity page.
If you import labels,
you canset sensitivity thresholds that determine the minimum threshold sensitivity level for a label to be marked as sensitive in Defender for Cloud.
Customizing data sensitivity settings helps you focus on your critical sensitive resources and improve the accuracy of the sensitivity insights.
Before you startPrerequisites
Before you customize data sensitivity settings, ensure the following requirements are met:
Make sure that youReview prerequisites and requirements for configuring data sensitivity settings.- In Defender for Cloud, enable sensitive data discovery capabilities in the Defender CSPM
and/or Defender for Storage plans.
Changes in sensitivity settings take effect the next time that resources are discovered.
Import custom sensitivity info types/labels
CustomDefender for Cloud automatically imports custom sensitivity infoinformation types and sensitivity labels are automatically imported into Defender for Cloud.labels. If you have the Enterprise Mobility and Security E5/A5/G5 license, you don't need to manually provide consent in the Microsoft Defender XDR portal. For licensing details,more information, see Microsoft Purview sensitivity labeling licensing.
Defender for Cloud only imports sensitivity labels with automatic labeling rules. Defender for Cloud ignores the "location" section in the automatic labeling rule and applies the label to all resource types and locations.
Customize sensitive data categories/types
To customize data sensitivity settings in Defender for Cloud, review the prerequisites for customizing data sensitivity settings. Then do the following.follow these steps:
Sign in to the Azure portal.
NavigateGo to Microsoft Defender for Cloud > Environment settings.Select Data sensitivity.
Select the info type category that you want to customize:
- The Finance, PII, and Credentials categories contain the default info type data that
areattackers typicallysought out by attackers.seek. - The Custom category contains custom info types from your Microsoft Purview portal configuration.
- The Other category contains all of the rest of the built-in available info types.
- The Finance, PII, and Credentials categories contain the default info type data that
Select the info types that you want to
be markedmark as sensitive.Select Apply and Save.
Set the threshold for sensitive data labels
If you're using use Microsoft Purview sensitivity labels, make sure that:
- You set the label scope to files and other data assets, and configure the auto-labeling rule for Office apps.
- Your labels are published with a label policy that is in effect. You can set a threshold to determine the minimum sensitivity level for a label to be marked as sensitive in Defender for Cloud.
Sign in to the Azure portal.
NavigateGo to Microsoft Defender for Cloud > Environment settings.Select Data sensitivity. The current minimum sensitivity threshold is shown.
Select Change to see the list of sensitivity labels and select the lowest sensitivity label that you want marked as sensitive.
Select Apply and Save.
Note
- When you turn on the threshold, you select a label with the lowest setting that should be considered sensitive in your organization.
- Any resources with this minimum label or higher are presumed to contain sensitive data.
- For example, if you select Confidential as minimum, then Highly Confidential is also considered sensitive. General, Public, and Non-Business aren't.
You can't select a
sub labelsublabel in the threshold. However, you can see the sublabel as the affected label on resources in attack path/Cloud SecurityExplorer,Explorer if the parent label ispartincluded in the threshold, meaning it is one of thethreshold (partselected sensitive labels.\ No newline at end of
the sensitive labels selected).- file
The same settings apply to any supported
resource (objectresource, including object storage anddatabases).databases. \ No newline at end of file\ No newline at end of file
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Customize data sensitivity settings - Microsoft Defender for Cloud | Microsoft Learn+title: Customize Data Sensitivity Settings - Microsoft Defender for Cloud | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-sensitivity-settings breadcrumb_path: /azure/breadcrumb/defender-for-cloud/toc.json feedback_help_link_url: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud@@ -34,63 +34,62 @@ item_type: Content source_path: defender-for-cloud/data-sensitivity-settings.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/8e3fdb08-a059-4277-98f6-c0e21e940707+- https://authoring-docs-microsoft.poolparty.biz/devrel/57eae111-0f3b-497e-be07-450fd1409dea spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/88291526-9c74-4f87-878c-de0a82134421+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/ac8bf8ab-8134-4c9a-9f2e-58b31575b492 platformId: 0f6bbe46-b6ac-634f-07a5-1ae2ef4e63aa --- -# Customize data sensitivity settings - Microsoft Defender for Cloud | Microsoft Learn+# Customize Data Sensitivity Settings - Microsoft Defender for Cloud | Microsoft Learn -This article describes how to customize data sensitivity settings in Microsoft Defender for Cloud. Before you begin, make sure you review the [prerequisites and requirements](concept-data-security-posture-prepare#configure-data-sensitivity-settings) and enable sensitive data discovery in your Defender for Cloud plan.
+You can customize data sensitivity settings in Microsoft Defender for Cloud. Data sensitivity settings are used to identify and focus on managing the critical sensitive data in your organization. Defender cloud security posture management (Defender CSPM) refers to the Defender CSPM plan in Microsoft Defender for Cloud.
-Data sensitivity settings are used to identify and focus on managing the critical sensitive data in your organization.
+- Select sensitive information types and sensitivity labels from the Microsoft Purview portal in Defender for Cloud.
-In this article, Defender cloud security posture management (Defender CSPM) refers to the Defender CSPM plan in Microsoft Defender for Cloud.
-
-- You can select sensitive information types and sensitivity labels from the Microsoft Purview portal in Defender for Cloud.
- By default, Defender for Cloud uses [built-in sensitive information types](/en-us/microsoft-365/compliance/sensitive-information-type-learn-about) from Microsoft Purview.
- Some information types and labels are enabled by default.
- - Sensitive data discovery supports a subset of the built-in sensitive information types from Microsoft Purview. See the [reference list of supported sensitive information types](sensitive-info-types), including defaults.
- - You can modify the default settings on the **Data sensitivity** page.
-- If you import labels, you can set sensitivity thresholds that determine the minimum threshold sensitivity level for a label to be marked as sensitive in Defender for Cloud.
+ - Sensitive data discovery supports a subset of the built-in sensitive information types from Microsoft Purview. See the [reference list of supported sensitive information types](sensitive-info-types).
+ - Modify the default settings on the **Data sensitivity** page.
+- If you import labels, set sensitivity thresholds that determine the minimum threshold sensitivity level for a label to be marked as sensitive in Defender for Cloud.
Customizing data sensitivity settings helps you focus on your critical sensitive resources and improve the accuracy of the sensitivity insights.
-## Before you start
+## Prerequisites
Before you customize data sensitivity settings, ensure the following requirements are met:
-- Make sure that you [prerequisites and requirements for configuring data sensitivity settings](concept-data-security-posture-prepare#configure-data-sensitivity-settings).
-- In Defender for Cloud, enable sensitive data discovery capabilities in the [Defender CSPM](data-security-posture-enable) and/or [Defender for Storage](defender-for-storage-data-sensitivity) plans.
+- Review [prerequisites and requirements for configuring data sensitivity settings](concept-data-security-posture-prepare#configure-data-sensitivity-settings).
+- In Defender for Cloud, enable sensitive data discovery capabilities in the [Defender CSPM](data-security-posture-enable) or [Defender for Storage](defender-for-storage-data-sensitivity) plans.
Changes in sensitivity settings take effect the next time that resources are discovered.
## Import custom sensitivity info types/labels
-Custom sensitivity info types and sensitivity labels are automatically imported into Defender for Cloud. If you have the Enterprise Mobility and Security E5/A5/G5 license, you don't need to manually provide consent in the Microsoft Defender XDR portal. For licensing details, see [Microsoft Purview sensitivity labeling licensing](/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description#microsoft-purview-information-protection-sensitivity-labeling).
+Defender for Cloud automatically imports custom sensitivity information types and sensitivity labels. If you have the Enterprise Mobility and Security E5/A5/G5 license, you don't need to manually provide consent in the Microsoft Defender XDR portal. For more information, see [Microsoft Purview sensitivity labeling licensing](/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description#microsoft-purview-information-protection-sensitivity-labeling).
-Defender for Cloud only imports sensitivity labels with automatic labeling rules. Defender for Cloud ignores the "location" section in the automatic labeling rule and applies the label to all resource types and locations.
+Defender for Cloud only imports sensitivity labels with automatic labeling rules. Defender for Cloud ignores the *location* section in the automatic labeling rule and applies the label to all resource types and locations.
## Customize sensitive data categories/types
-To customize data sensitivity settings in Defender for Cloud, review the [prerequisites for customizing data sensitivity settings](concept-data-security-posture-prepare#configure-data-sensitivity-settings). Then do the following.
+To customize data sensitivity settings in Defender for Cloud, follow these steps:
1. Sign in to the [Azure portal](https://portal.azure.com).
-2. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
+2. Go to **Microsoft Defender for Cloud** > **Environment settings**.
3. Select **Data sensitivity**.
4. Select the info type category that you want to customize:
- - The **Finance**, **PII**, and **Credentials** categories contain the default info type data that are typically sought out by attackers.
+ - The **Finance**, **PII**, and **Credentials** categories contain the default info type data that attackers typically seek.
- The **Custom** category contains custom info types from your Microsoft Purview portal configuration.
- The **Other** category contains all of the rest of the built-in available info types.
-5. Select the info types that you want to be marked as sensitive.
+5. Select the info types that you want to mark as sensitive.
6. Select **Apply** and **Save**.
## Set the threshold for sensitive data labels
-If you're using Microsoft Purview sensitivity labels, make sure that:
+If you use Microsoft Purview sensitivity labels, make sure that:
- You set the label scope to **files and other data assets**, and configure the [auto-labeling rule for Office apps](/en-us/purview/apply-sensitivity-label-automatically#how-to-configure-auto-labeling-for-office-apps).
- Your labels are [published with a label policy](/en-us/microsoft-365/compliance/create-sensitivity-labels#publish-sensitivity-labels-by-creating-a-label-policy) that is in effect.
@@ -98,17 +97,15 @@ If you're using Microsoft Purview sensitivity labels, make sure that: You can set a threshold to determine the minimum sensitivity level for a label to be marked as sensitive in Defender for Cloud.
1. Sign in to the [Azure portal](https://portal.azure.com).
-2. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
+2. Go to **Microsoft Defender for Cloud** > **Environment settings**.
3. Select **Data sensitivity**. The current minimum sensitivity threshold is shown.
4. Select **Change** to see the list of sensitivity labels and select the lowest sensitivity label that you want marked as sensitive.
5. Select **Apply** and **Save**.
-Note
+When you turn on the threshold, you select a label with the lowest setting that should be considered sensitive in your organization. Any resources with this minimum label or higher are presumed to contain sensitive data. For example, if you select **Confidential** as minimum, then **Highly Confidential** is also considered sensitive. **General**, **Public**, and **Non-Business** aren't.
+
+You can't select a sublabel in the threshold. However, you can see the sublabel as the affected label on resources in attack path/Cloud Security Explorer if the parent label is included in the threshold, meaning it is one of the selected sensitive labels.
-- When you turn on the threshold, you select a label with the lowest setting that should be considered sensitive in your organization.
-- Any resources with this minimum label or higher are presumed to contain sensitive data.
-- For example, if you select **Confidential** as minimum, then **Highly Confidential** is also considered sensitive. **General**, **Public**, and **Non-Business** aren't.
-- You can't select a sub label in the threshold. However, you can see the sublabel as the affected label on resources in attack path/Cloud Security Explorer, if the parent label is part of the threshold (part of the sensitive labels selected).
-- The same settings apply to any supported resource (object storage and databases).\ No newline at end of file+The same settings apply to any supported resource, including object storage and databases.\ No newline at end of file