See explanation below.
Explanation
You need to configure auto-labeling in 'simulation' mode. In the policy, you can select the 'Credit Card' sensitive info type.
* In the Microsoft 365 compliance center, navigate to sensitivity labels:
Solutions > Information protection
* Select the Auto-labeling (preview) tab.
* Select + Create policy.
* For the page Choose info you want this label applied to: Select one of the templates, such as Financial or Privacy. You can refine your search by using the Show options for dropdown. Or, select Custom policy if the templates don't meet your requirements. Select Next.
* For the page Name your auto-labeling policy: Provide a unique name, and optionally a description to help identify the automatically applied label, locations, and conditions that identify the content to label.
* For the page Choose locations where you want to apply the label: Select OneDrive. Then select Next.
* For the Define policy settings Find content that contains to define rules that identify content to label across all your selected locations. The rules use conditions that include sensitive information types and sharing options. For sensitive information types, you can select both built-in and custom sensitive information types.
* Then select Next.
* For the Set up rules to define what content is labeled + Create rule and then select Next.
* On the Create rule page, name and define your rule, using sensitive information types and then select Save.
* Click Next.
* For the Choose a label to auto-apply , select a label from the Choose a sensitivity label pane, and then select
* For the Decide if you want to run policy simulation now or later page: Select Run policy in simulation mode if you're ready to run the auto-labeling policy now, in simulation mode. Otherwise, select Leave policy turned off. Select Next.
* For the Summary page: Review the configuration of your auto-labeling policy and make any changes that needed, and complete the wizard.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-wo

Explanation

References:
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-advanced-audit-policy

1 - From the Microsoft Azure portal, create an Azure Active Directory (Azure AD) group.
2 - From Windows Defender Security Center, create a role.
3 - From Windows Defender Security Center, configure the permissions for MachineGroup1.

Explanation
References:
https://docs.microsoft.com/en-us/office365/securitycompliance/integrate-office-365-ti-with-wdatp

Explanation
References:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-user-risk-policy