Microsoft Purview enforcing one capturing group limit for custom sensitive information types

Microsoft Purview will enforce a limit of one capturing group per regular expression in custom Sensitive Information Types by early July 2026. Admins must update existing SITs with multiple capturing groups to comply, or creation and updates will be blocked, affecting DLP policy functionality. What and Why Microsoft Purview is enforcing the documented limit of one capturing group per regular expression in custom Sensitive Information Type (SIT) definitions. This change improves consistency, reliability, and predictability in pattern matching for data classification and Data Loss Prevention scenarios. This enforcement applies when custom SITs are created or updated and may block those operations if the limit is exceeded. Rollout Schedule General Availability (Worldwide, GCC, GCC High, and DoD): The rollout is expected to complete by early July 2026. Impact on Your Organization Who is affected  Admins who create or manage custom SITs in Microsoft Purview Platforms and services Microsoft Purview portal PowerShell cmdlets (New-DlpSensitiveInformationTypeRulePackage and Set-DlpSensitiveInformationTypeRulePackage) What will happen New custom SITs that include more than one capturing group in a regular expression will be blocked during creation. Updates to existing SITs will fail validation if the regular expression contains more than one capturing group. When editing or re-saving SITs that contain more than one capturing group, admins must update regular expression patterns to include only one capturing group before changes can be saved. This enforcement applies across both portal and PowerShell experiences. Existing SITs with multiple capturing groups will stop functioning. Action Required or Recommendations Action required. Review all custom SITs that use regular expressions to identify any with multiple capturing groups. After rollout, updates to these SITs will fail validation until corrected, which may delay policy updates. Update regular expression patterns to comply with the one capturing group limit. Test updated SITs to ensure they continue to match the intended content before applying them to production policies. Review service limits documentation to confirm compliance requirements. Learn more (and for the full list of SIT limits): Sensitive information type limits | Microsoft Purview | Microsoft Learn Compliance Considerations This change enforces existing limits for SITs and may affect how Data Loss Prevention […]

The post Microsoft Purview enforcing one capturing group limit for custom sensitive information types appeared first on M365 Admin.