Microsoft Purview EDM: How Exact Data Match Works

Microsoft Purview EDM, now part of Microsoft Purview, helps organizations identify known sensitive information by matching content against a structured source of sensitive data. Microsoft currently supports EDM source tables with up to 100 million rows, 32 columns, and 10 searchable columns, making them suitable for large enterprise data protection scenarios.

Unlike pattern-based detection, which asks whether information appears sensitive, Exact Data Match (EDM) uses known values from an organization’s data source to improve detection of organization-specific information, such as customer IDs, employee IDs, account numbers, or policy numbers.

Start Building Microsoft Security Skills with Expert-Led Training

• Microsoft-aligned curriculum
• Expert-led training
• Hands-on learning

What Is Microsoft Purview EDM and Why Does It Matter?

Microsoft Purview EDM helps identify known sensitive values in an organization’s structured datasets. Microsoft describes EDM-based Sensitive Information Types as reference values in a sensitive information database, used for classification.

For example, an organization might maintain this customer data:

A pattern-based detector may identify a value because it resembles a customer ID.

EDM takes a different approach:

Pattern matching:
“Does this value look like a customer ID?”

EDM:
“Does this value match a known customer ID from our sensitive dataset?”

That makes EDM useful when an organization needs to detect specific, known business values rather than only generic patterns.

How Does Exact Data Match Work in Microsoft Purview?

Microsoft Purview EDM connects a structured source data table to an EDM schema that defines the fields used for matching and an EDM-based SIT. The EDM Upload Agent hashes and uploads the prepared source data, after which you test the configuration before using it in supported Purview scenarios.

Fig 1: Microsoft Purview EDM process for creating and deploying Exact Data Match sensitive information types.

Source: Overview of the EDM workflow

Source: EDM Classification

The process can be summarized as:

Source data → EDM schema → Hash & upload → EDM SIT → Test → Apply policies

The key steps are:

1. Prepare the source data

Export the sensitive information into a supported format. Microsoft supports CSV, TSV, and pipe-separated files and recommends TSV when values can contain commas.

2. Create the EDM schema

Define the fields that Microsoft Purview will use during matching. A primary field provides the main match signal, while secondary fields provide additional evidence.

3. Prepare and hash the data

The EDM Upload Agent validates and hashes the source data before uploading it.

4. Create the EDM Sensitive Information Type

Connect the schema and matching configuration to an EDM-based SIT.

5. Test the configuration

Test the SIT before using it with production policies.

6. Apply it to supported Purview scenarios

EDM-based SITs can work with supported Microsoft Purview capabilities, including Data Loss Prevention (DLP). DLP uses policies to govern how sensitive information should be handled.

What Is the EDM Upload Agent, and Does It Scan Endpoints?

The EDM Upload Agent validates, hashes, and uploads the sensitive source table for Microsoft Purview EDM. It does not continuously scan endpoints.

The EDM Upload Agent hashes and uploads the sensitive source table for Microsoft Purview EDM. It does not function as an endpoint detection or a continuous endpoint-scanning agent.

The workflow looks like this:

Sensitive data source → EDM Upload Agent → Hashed data → Microsoft Purview

Microsoft documents two approaches:

• Single-computer method: The same computer performs the hashing
  and upload.
• Two-computer method: One computer hashes the clear-text source
  data and another uploads the hash files.

Microsoft recommends the two-computer method because it separates the hashing and upload processes. Microsoft also documents the EDM_DataUploaders security group for users who manage EDM data uploads.

What Are the Key Benefits of Microsoft Purview EDM?

EDM enables Microsoft Purview to use organization-specific structured data rather than relying solely on generic patterns. Microsoft documents support for up to 100 million rows, 32 columns, and 10 searchable columns, as well as Purview integrations such as DLP and eDiscovery.

EDM brings organization-specific data into Microsoft Purview’s sensitive information detection strategy. Its main value comes from combining structured business data with Microsoft’s information-protection capabilities.

Organization-specific detection

EDM can use known business values rather than relying only on generic patterns.

Large source datasets

Microsoft currently documents support for:

• 100 million rows
• 32 columns per data source
• 10 searchable columns

Structured matching

Organizations can define which fields should participate in the matching process through the EDM schema.

Integration with Purview

Microsoft lists EDM-based Sensitive Information Types for supported Purview scenarios such as DLP and eDiscovery.

Protected upload process

The EDM workflow uses hashing and a salt value when preparing sensitive source data for upload.

When Should You Use Exact Data Match in Microsoft Purview?

Use EDM when you need Microsoft Purview to recognize known values from your organization’s structured dataset. If a generic pattern already accurately identifies the information, a standard Sensitive Information Type may be a simpler option.

EDM makes sense when your organization has a structured dataset containing known sensitive values that you want Microsoft Purview to identify in supported content.

Common scenarios include:

• Financial services: customer or account identifiers
• Healthcare: patient or member identifiers
• Insurance: policy or customer numbers
• Retail: customer or loyalty identifiers
• HR: employee identifiers

The key decision is whether your organization needs Microsoft Purview to match known values from its own structured dataset.

If a generic pattern can accurately identify the information, a standard Sensitive Information Type may be sufficient. If you need Microsoft Purview to recognize values from your own structured dataset, EDM becomes more relevant.

What Challenges Should You Consider Before Implementing EDM?

EDM implementation depends on source data quality, schema design, file formatting, permissions, and testing. Microsoft documents requirements for each stage of the EDM workflow.

EDM requires more than uploading a database. Source data quality, schema design, formatting, permissions, and testing all affect the implementation.

Source data quality

Incorrect or outdated source records can affect matching results, so assign an owner for the EDM source dataset and define when the team refreshes the uploaded data.

File formatting

Microsoft documents specific formatting requirements and parsing considerations for CSV, TSV, and pipe-separated source files. Microsoft recommends TSV when values can contain commas, such as addresses.

Schema design

The schema needs to reflect the fields that Microsoft Purview should use for matching.

Permissions

Assign EDM administrators only the permissions required to configure the solution and upload sensitive source data. Microsoft documents the EDM_DataUploaders security group for EDM data-upload management.

Data maintenance

When source records change, define who updates the EDM source data and when the organization refreshes the uploaded data.

How Can You Build Microsoft Purview Expertise?

EDM is only one component of a broader Microsoft Purview information-protection strategy. Teams working with Microsoft security and compliance need to understand how Sensitive Information Types, DLP, classification, data governance, and information protection work together.

SC-401: Information Security Administrator Associate training helps professionals build practical skills across Microsoft Purview and information security.

The training combines Microsoft-aligned concepts with hands-on learning so security professionals can work with real-world information-protection scenarios.

Is Microsoft Purview EDM Right for Your Organization?

EDM fits organizations that have a structured dataset containing known sensitive values and need to identify those values across supported content. If generic pattern matching already meets the requirement, EDM may add unnecessary implementation work.

EDM is worth considering when your organization has a structured dataset that contains known sensitive values and needs to identify them across supported content.

Before implementing it, ask:

• Do we have a structured source of sensitive values?
• Do we need organization-specific matching?
• Would generic pattern matching produce unwanted matches?
• Which fields should Microsoft Purview use?
• Which DLP or compliance scenarios need the EDM SIT?
• Who will maintain the sensitive data source?

If the answer to these questions points toward business-specific detection, Exact Data Match can become an important part of your Microsoft Purview strategy.

Microsoft Purview EDM: How Exact Data Match Works

Microsoft Purview EDM enables organizations to use their own structured sensitive data in Microsoft Purview’s detection strategy. The key takeaway is simple: use EDM when your organization needs to identify known business values rather than relying only on generic pattern detection.

Before implementing EDM, identify the sensitive dataset you want to protect, confirm which fields should participate in matching, and decide which Purview scenarios require the EDM-based Sensitive Information Type. Then, validate the source data, configure the EDM workflow, test the SIT, and apply it to the relevant policies.

Your next step is to map one real business scenario, such as customer IDs, employee IDs, account numbers, or policy numbers, to an EDM design. If the use case benefits from organization-specific matching, use that scenario as the starting point for your Microsoft Purview EDM implementation and training plan.