Classification is what turns a profiled document into an action. A profiler emits findings, tags mark and refine them, document classes raise them to the document level, and policies hand the result to a custodian who validates it and decides whether the document is kept, reclassified or deleted. This is how those layers fit together, and how the Elasticsearch indices behind them are shaped.
Detection finds it. People decide what happens to it.
Classification is a layered refinement. Each layer is a stored query that reads what the layer below wrote onto the document, then writes its own marker. The chain runs from machine detection up to a human compliance decision. It does not end at a Microsoft Purview label: it ends at a policy, where a custodian validates the classification and decides retention or deletion. MIP labelling is one optional enforcement action, nothing more.
The detection that produces entry types, the profiler running its algorithms, is covered in AI Profiler. This manual starts where the findings land.
The detection findings written by the profiler: FULL_NAME, STREET_ADDRESS, S_LOC, and the knowledge family S_K_*. Each carries pii, sensitivity and a colour. They surface as DS_EntryType_List.
Stored queries, mostly over DS_Value. They stamp DS_Tags, can emit S_K_* entry types, and can mutate findings via flags: remove_labels, remove_values, rename_data, set_status, sticky.
Stored queries over DS_EntryType_List or DS_Tags. They answer "what kind of document is this?" and stamp DS_DocumentClass. Same engine as tags, different input and output field.
Group classified documents for a compliance purpose. Own the custodian report (notification_settings: misclassified tab, delete control, cycle) and retention (scheduled_delete, days_to_delete, duration). Optional channels: MIP, Gmail, GDrive.
DS_Tags versus DS_DocumentClass). That is why they share the category model, the translation index, and the tagging task code.A real trace from one tenant. It shows a class that keys on tags, not entry types directly, and reaches the same classification by two independent routes: one driven by a detected entry type, one by literal German document phrases.
The class query is two OR'd blocks, each a single DS_Tags term. A document carrying either tag is classified, and the class ID is written to DS_DocumentClass. From there a privacy policy gathers the documents, a custodian reviews them, rejects false positives on the Misclassified tab, and the policy retention window drives deletion. The bridge is concrete: tag output (DS_Tags) is the class input.
DS_Tags = veU... (UN Religious)
OR
DS_Tags = FOU... (GER church)
Every classification index shares a multi-tenant and subscription-provenance envelope, then adds its own fields. All tenants live in one index, separated by company_id; all rows are subscription-seeded from a shared baseline.
active)Tags and classes are organised and localised by parallel side-indices.
| Tag grouping | tag_category |
| Class grouping | document_class_category |
| Localisation | tag_names (type tag|class) |
tag_names is a single i18n index for both: roughly 2560 rows type:tag and 430 rows type:class per tenant.
The query object has the same shape everywhere: one or more blocks, each holding an array of filters. Blocks are OR'd; filters within a block are AND'd. This single grammar is why one matching engine can power all three query layers.
{
"field": "DS_EntryType_List",
"type": "terms" | "wildcard",
"compare": "equal" | "not_equal",
"values": ["STREET_ADDRESS", ...]
}
DS_Value, DS_EntryType_List, DS_Tags, DS_KnownPersons.terms for an exact set, wildcard for patterns.equal or not_equal (the exclusion guard in the trace used not_equal).Detection feeds tags, tags feed classes, classes feed policies, and policies put the result in front of a custodian who validates it and decides keep, reclassify or delete. MIP labelling is an optional output, never the destination. Every layer is multi-tenant by company_id, subscription-seeded, and built on one stored-query grammar with shared category and translation layers.