Test Cloud Apps file-name filters with whole words and punctuation

Source facts

Microsoft documents that the Contains file-policy filter matches complete words separated by punctuation or spaces. Unquoted words separated by spaces or hyphens behave as alternatives, while Equals requires the complete string. A filename equality match does not also match a longer name with an added extension. Microsoft Learn.

Applicability

Apply this check when a Microsoft Defender for Cloud Apps file policy uses a name filter. Define the intended set of matching filenames before selecting a filter operator or enabling a governance action.

DSE recommendation

DSE recommends writing a small, explicit match table with filenames that should qualify and names that should remain outside scope. Include punctuation, joined words and extra extensions. Select the operator against that table, and keep proposed file actions separate until the matching behavior has been reviewed by the data owner.

Verification

Use approved test files with harmless content to compare actual policy matches with the table. Include at least one near-match and record why it is included or excluded. Review the resulting population before enabling any consequential action. Retain the literal filter and test names so another analyst can repeat the check after a policy change.

Official references

Microsoft Learn: File policies in Microsoft Defender for Cloud Apps. Source reviewed September 17, 2026.