{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "slug": "dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation", "url": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/" }, "title": "Test Cloud Apps file-name filters with whole words and punctuation", "summary": "How can a Cloud Apps file-policy name filter match a different set of files than its author expects?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:43+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 207, "potentially_affected": "Apply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.", "dse_recommendation": "DSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope.", "primary_source": { "name": "File policies in Microsoft Defender for Cloud Apps - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents that the Contains file-policy filter matches complete words separated by punctuation or spaces. Unquoted words separated by spaces or hyphens behave as alternatives, while Equals requires the complete string. A filename equality match does not also match a longer name with an added extension. Microsoft Learn.

\n

Applicability

\n

Apply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.

\n

DSE recommendation

\n

DSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope. Include punctuation, joined words and extra extensions. Select the operator against that table, and keep proposed file actions separate until the matching behavior has been reviewed by the data owner.

\n

Verification

\n

Use approved test files with harmless content to compare actual policy matches with the table. Include at least one near-match and record why it is included or excluded. Review the resulting population before enabling any consequential action. Retain the literal filter and test names so another analyst can repeat the check after a policy change.

\n

Official references

\n

Microsoft Learn: File policies in Microsoft Defender for Cloud Apps. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft documents that the Contains file-policy filter matches complete words separated by punctuation or spaces. Unquoted words separated by spaces or hyphens behave as alternatives, while Equals requires the complete string. A filename equality match does not also match a longer name with an added extension. Microsoft Learn.\nApplicability\nApply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.\nDSE recommendation\nDSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope. Include punctuation, joined words and extra extensions. Select the operator against that table, and keep proposed file actions separate until the matching behavior has been reviewed by the data owner.\nVerification\nUse approved test files with harmless content to compare actual policy matches with the table. Include at least one near-match and record why it is included or excluded. Review the resulting population before enabling any consequential action. Retain the literal filter and test names so another analyst can repeat the check after a policy change.\nOfficial references\nMicrosoft Learn: File policies in Microsoft Defender for Cloud Apps. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents that the Contains file-policy filter matches complete words separated by punctuation or spaces. Unquoted words separated by spaces or hyphens behave as alternatives, while Equals requires the complete string. A filename equality match does not also match a longer name with an added extension. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies).\n\n## Applicability\n\nApply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.\n\n## DSE recommendation\n\nDSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope. Include punctuation, joined words and extra extensions. Select the operator against that table, and keep proposed file actions separate until the matching behavior has been reviewed by the data owner.\n\n## Verification\n\nUse approved test files with harmless content to compare actual policy matches with the table. Include at least one near-match and record why it is included or excluded. Review the resulting population before enabling any consequential action. Retain the literal filter and test names so another analyst can repeat the check after a policy change.\n\n## Official references\n\n[Microsoft Learn: File policies in Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Test Cloud Apps file-name filters with whole words and punctuation", "item": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/", "headline": "Test Cloud Apps file-name filters with whole words and punctuation", "description": "How can a Cloud Apps file-policy name filter match a different set of files than its author expects?", "abstract": "How can a Cloud Apps file-policy name filter match a different set of files than its author expects?", "articleBody": "Source facts\nMicrosoft documents that the Contains file-policy filter matches complete words separated by punctuation or spaces. Unquoted words separated by spaces or hyphens behave as alternatives, while Equals requires the complete string. A filename equality match does not also match a longer name with an added extension. Microsoft Learn.\nApplicability\nApply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.\nDSE recommendation\nDSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope. Include punctuation, joined words and extra extensions. Select the operator against that table, and keep proposed file actions separate until the matching behavior has been reviewed by the data owner.\nVerification\nUse approved test files with harmless content to compare actual policy matches with the table. Include at least one near-match and record why it is included or excluded. Review the resulting population before enabling any consequential action. Retain the literal filter and test names so another analyst can repeat the check after a policy change.\nOfficial references\nMicrosoft Learn: File policies in Microsoft Defender for Cloud Apps. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:43+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test Cloud Apps file-name filters with whole words and punctuation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 207, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "File policies in Microsoft Defender for Cloud Apps - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies" } } ] } }