# Test Cloud Apps file-name filters with whole words and punctuation

> How can a Cloud Apps file-policy name filter match a different set of files than its author expects?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:43+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How can a Cloud Apps file-policy name filter match a different set of files than its author expects?

## Potentially affected

Apply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.

## DSE recommendation

DSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope.

## Article

## Source facts

Microsoft documents that the Contains file-policy filter matches complete words separated by punctuation or spaces. Unquoted words separated by spaces or hyphens behave as alternatives, while Equals requires the complete string. A filename equality match does not also match a longer name with an added extension. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies).

## Applicability

Apply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.

## DSE recommendation

DSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope. Include punctuation, joined words and extra extensions. Select the operator against that table, and keep proposed file actions separate until the matching behavior has been reviewed by the data owner.

## Verification

Use approved test files with harmless content to compare actual policy matches with the table. Include at least one near-match and record why it is included or excluded. Review the resulting population before enabling any consequential action. Retain the literal filter and test names so another analyst can repeat the check after a policy change.

## Official references

[Microsoft Learn: File policies in Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies). Source reviewed September 17, 2026.

## Primary reference

- Name: File policies in Microsoft Defender for Cloud Apps - Microsoft Defender for Cloud Apps | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test Cloud Apps file-name filters with whole words and punctuation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-077-test-cloud-apps-file-name-filters-with-whole-words-and-punctuation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.