Microsoft Purview: Reverting single capturing group enforcement for custom SIT regex

What and why Following customer feedback, Microsoft Purview is reverting the enforcement of the single capturing group limit for custom Sensitive Information Type (SIT) regular expressions that was previously communicated in MC1413309. This change restores the prior behavior, allowing administrators to create and edit custom SITs that contain multiple capturing groups through both the Microsoft Purview user experience and PowerShell cmdlets. While enforcement is being reverted, we recommend that organizations review custom regular expressions and update them to use a single top-level capturing group where possible. This helps prepare for potential future changes. Any future enforcement changes would be communicated in advance to allow sufficient planning time. For clarity, this guidance applies to regular expressions that contain multiple top-level capturing groups separated by alternation, such as (pattern1)|(pattern2). It does not apply to nested capturing groups within a single expression. Rollout schedule Beginning late July 2026 and expected to complete in late July 2026 Impact on your organization Who is affected Administrators who create or manage custom Sensitive Information Types (SITs) in Microsoft Purview. Organizations that use custom SITs with regular expressions containing multiple top-level capturing groups. Platforms and services Microsoft Purview Data Loss Prevention (DLP) Microsoft Purview compliance portal PowerShell cmdlets for SIT management What will happen Administrators can create and edit custom SITs that contain multiple capturing groups. Creation and editing of these SITs will no longer be blocked. Existing custom SITs that use multiple capturing groups will continue to function as before and do not require remediation as a result of this change. Existing DLP policies and enforcement behavior are not affected. No tenant configuration changes are required. The change is on by default as part of the service update. Action required and recommendations No immediate action is required. We recommend that administrators: Review custom SITs that use multiple top-level capturing groups in regular expressions. Update regular expressions to use a single top-level capturing group where feasible. Test any updated SITs before deploying them to production policies. Communicate this guidance to compliance and information protection administrators who manage custom SIT definitions. Compliance considerations Question Answer Does the change modify, interrupt, or disable Information Protection labels or Sensitive Information Types? Yes. The update changes how administrators can create and edit custom Sensitive Information Types by removing enforcement of the single capturing group restriction and restoring previous behavior.