Information Protection Scanner

Cloud-native auto-labeling covers Exchange, SharePoint Online, and OneDrive. Content stored on on-premises file shares, NAS devices, and local SharePoint Server requires the Microsoft Purview Information Protection Scanner, a Windows service that connects to your on-premises repositories and applies labels using the same SIT-based rules configured in the Purview portal.

Architecture

The scanner consists of two components:

Component	Role
Scanner node	Windows Server running the Microsoft Purview Information Protection client; connects to file shares via SMB or SharePoint Server via HTTPS
SQL Server database	Stores scanner configuration and operational state; with Custom Reporting (preview) also per-file label, protection state, and SIT matches

The scanner node authenticates to the Purview service using an Entra service principal (app registration). It reads files, evaluates SIT conditions, and either reports matches (discovery mode) or writes labels to the files (enforcement mode).

On-premises network:
  File share (\\server\share) ──SMB──▶ Scanner node (Windows Server)
  SharePoint Server ──HTTPS──▶ Scanner node

Scanner node ──HTTPS──▶ Purview compliance portal (label policies)
Scanner node ──SQL──▶ SQL Server (cluster database; scan results with Custom Reporting)

Sizing and Installation

Learn publishes one node specification in the scanner prerequisites: 4 cores, 8 GB RAM, about 10 GB free disk for temporary files (the scanner writes four per core), and a supported 64-bit Windows Server (not Core or Nano). SQL Server 2016 or later, Enterprise or Standard; Express is for test environments only, and Developer is not licensed for production. Size the configuration database with Learn's formula, 100 KB + file count × (1000 + 4 × average file-name length): a million files with 250-character names need about 2 GB. Up to ten scanner nodes share a 4-core, 8 GB SQL host; more need 8 cores and 16 GB. The scanner reads every file across the network, so put a node near each large repository rather than scanning a remote office over the WAN; nodes join one cluster with the same Install-Scanner cluster name.

Install the current client and scanner, configure the scanner cluster and content scan job, and publish the required label policy to the scanner identity. Follow the installation workflow for service credentials and authentication. The current module is PurviewInformationProtection; older AIP cmdlet examples are version-specific.

# After installing the supported client; use an elevated Windows PowerShell session.
Import-Module PurviewInformationProtection

# Prompts for the service account as DOMAIN\scanneraccount
Install-Scanner -SqlServerInstance "SQL01\SCANNER" -Cluster "OnPremScan"

# Run once, signed in as the service account, after the app registration
# in the cloud configuration steps
Set-Authentication -AppId "<app id>" -AppSecret "<secret>" -TenantId "<tenant id>" -DelegatedUser "scanner@tenant.us"

Add-ScannerRepository -Path "\\fileserver01\shares\engineering"

Complete service authentication and cloud configuration before running scans. Keep secrets out of shared scripts and evidence exports. Repository access belongs to the Windows service account; the Entra identity needs the applicable information-protection entitlement and label policy. These are distinct prerequisites.

Discovery Mode vs. Enforcement Mode

The scanner operates in two modes, controlled by the content scan job settings in the Purview portal or via PowerShell.

Discovery Mode (Recommend)

Scans files and generates a report of what was found (which files match which SITs, how many files would be labeled) without writing any labels to files. Use this mode first.

Set-ScannerContentScan -Schedule Manual -Enforce Off
Start-Scan

When to use: Initial assessment of on-premises data before committing to enforcement. Run discovery for at least one full scan cycle before enabling enforcement.

Output: Summary_<n>.txt (duration, files scanned, files with matches) and a per-file .csv in %localappdata%\Microsoft\MSIP\Scanner\Reports under the service account's profile; the folder keeps 60 cycles, older ones zipped. The content scan job's Info types to be discovered decides what the .csv contains: Policy only (the default) lists only files that met a label's auto-labeling conditions; set All for the inventory scan so every sensitive information type match is reported. The report level comes from Set-ScannerConfiguration -ReportLevel.

Enforcement Mode (Auto-label)

Writes the label into the file in place: for Office files the msip_labels document property, for PDF the label metadata, and encryption where the label applies it (by default the scanner encrypts only Office and PDF files; other types need the PFileSupportedExtensions label-policy setting, see below). The scanner also preserves the file's modified date and owner when Preserve file details is on. Office apps read the label on open. Microsoft 365 DLP sees it only once the file is in SharePoint, OneDrive, or Exchange; a labeled file that stays on the share is covered by the scanner's own DLP mode (Enable DLP rules on the content scan job) and by Endpoint DLP on the devices that open it.

Set-ScannerContentScan -Schedule Manual -Enforce On
Start-Scan

Test on a Subset First

Before enabling enforcement on a full repository, scope the scan to a test folder with representative file types. Verify that Office files are labeled correctly and that non-Office files (PDFs, images) are handled as expected. Some applications may reject files whose metadata has been modified by the scanner.

What the scanner can write depends on the file type and on whether the label encrypts (supported file types). Office files (97-2003 and Open XML) and PDF are labeled, and by default they are the only types the scanner encrypts. Text, XML, and image files (.txt, .csv, .xml, .jpg, .png, .tif) cannot carry a label without encryption; with an encrypting label, and the extension added through Set-LabelPolicy -AdvancedSettings @{PFileSupportedExtensions=...} on the scanner account's policy, they are natively encrypted and renamed (.ptxt, .pxml, .pjpg), which makes them read-only in the Purview viewer. Every other type the client can inspect (Visio, .rtf, CAD) is classified but, if encryption is on and the extension is listed, encapsulated as a generic .pfile, which authenticates the opener and does not enforce usage rights. Files the scanner cannot inspect receive the content scan job's default label. Executables, .msi, .lnk, and the other system types are excluded outright; the scanner also skips .msg, .rtf, and .rar by default.

Extracting Scan Results

Two outputs, chosen by the question.

For a single scan's snapshot, read the reports. Each cycle writes a Summary_<n>.txt and a per-file .csv under %localappdata%\Microsoft\MSIP\Scanner\Reports in the scanner service-account profile (sixty cycles kept, older ones compressed); the portal shows the last scan only. See running the scanner.

For anything across scans, query SQL. The per-file label state, what changed since the previous scan, and the per-SIT match counts exist only in the cluster database, through Custom Reporting (preview, scanner 3.2.92.0 and later). Turn it on once per cluster:

Set-ScannerConfiguration -FeatureSettings @{CustomReporting=$true}
Get-ScannerConfiguration   # Features : {CustomReporting: True (Source: PowerShell)}

If the setting name is rejected, use CustomReportingEnabled (the 3.2.146 preview release notes rename it; the feature page still shows CustomReporting). From the next scan cycle:

Table	What it answers
dbo.ScannerFiles	One row per file: LabelName, PrevLabelName, ProtectionState, PrevProtectionState, ClassificationCount, FileStatus
dbo.MatchedClassificationAction	One row per matched sensitive information type per file per scan: MatchedInformationTypeName, MatchedInformationTypeCount, ConfidenceScore
dbo.ScannedFilesArchive	Prior states of each file, for change tracking across sessions

The query the remediation steps below rely on returns one current row per unlabeled file and CUI detector, and lists the files the scanner could not read separately:

-- Files still unlabeled whose latest processed scan matched a CUI SIT
SELECT m.FilePath,
       m.MatchedInformationTypeName,
       m.MatchedInformationTypeCount,
       m.ConfidenceScore
FROM dbo.ScannerFiles AS f
JOIN dbo.MatchedClassificationAction AS m
  ON m.FileHashPath = f.HashPath
 AND m.ScanSessionId = f.LatestScanSessionId
WHERE f.LabelName IS NULL
  AND (f.FileStatus IS NULL OR f.FileStatus <> 'Failed')
  AND m.MatchedInformationTypeName IN (
        'CUI - Distribution Statement',
        'CUI - Export Control',
        'CUI - DoD Contract Number',
        'CUI Designation Indicator')
  AND m.ConfidenceScore >= 75
ORDER BY m.MatchedInformationTypeCount DESC;

-- Files the last cycle could not process: unknown, not clean
SELECT FullPath, FileStatus, LatestScanSessionId
FROM dbo.ScannerFiles
WHERE FileStatus = 'Failed';

Join on the path hash and on the file's latest scan session, never on the hash alone: the match table keeps every session's rows, and a file the scanner skipped as unchanged has no rows in the newest session at all. Filter on the SIT display names from the Classifiers chapter, or on MatchedInformationTypeId after reading each custom SIT's GUID from Get-DlpSensitiveInformationType. Keep FileStatus Failed out of the result and report those files separately: a failed file is unknown, not clean. Point Power BI or the query at a read-only replica, never at the primary the scanner writes to. Columns beyond the documented ones can change between versions. See scanner feature control.

Both outputs include file paths and detected content, so store them in the controlled evidence location.

Environment-Specific Considerations

GCC High (CMMC)

On-Premises CUI Discovery for CMMC

Scanner discovery supports the data inventory and scoping process. SIT matches are candidates for review, not a definitive CUI determination.

Disconnected Scanner

Learn documents a scanner without internet access as a supported alternative configuration, with one hard limit: it can classify and label from an imported policy, but it cannot apply encryption, because that needs the Azure Rights Management service. The procedure: enable offline labeling for the client per the disconnected-computer steps; run Set-ScannerConfiguration -OnlineConfiguration Off; create the cluster and content scan job in the Purview portal and use Export on the content scan job; carry the file across and run Import-ScannerConfiguration -FileName <file>; repeat the export and import after every job change. With no portal at all, build the job with Set-ScannerContentScan -Enforce On and Add-ScannerRepository instead. Reports land in the same %localappdata%\Microsoft\MSIP\Scanner\Reports folder. Set-Authentication still needs an Entra token once, so plan the one connected session. Classified networks are outside this book.

CMMC Control Mapping

NIST Control	Supporting Scanner Evidence
AC.L2-3.1.3: CUI flow	Discovery informs approved storage and sharing boundaries; labels support separately configured enforcement
AU.L2-3.3.1: Audit records	The Custom Reporting tables and scan reports are evidence of the classification activity, not system audit records; retain them with the other evidence
CA.L2-3.12.4: System security plan	Validated repository inventory supports the documented boundary and data locations

Commercial

On-Premises Discovery for Commercial Organizations

For commercial organizations with on-premises file servers (common in manufacturing, healthcare, and legal), the scanner provides the asset inventory function Content Explorer offers for cloud content.

Initial Assessment Workflow

1. Run discovery mode across all file shares
2. Query the Custom Reporting tables (or export the scan report) to identify:
   • File shares with the highest density of financial / PII SIT matches
   • File shares with no labeled content (highest risk)
   • File types that cannot be labeled (CAD, legacy formats); flag for manual review
3. Prioritize enforcement on the highest-density locations first
4. Schedule quarterly re-scans to catch newly deposited sensitive content

HIPAA / Healthcare

For healthcare organizations, set the content scan job's Info types to be discovered to All, or to the health-related built-in sensitive information types the HIPAA DLP template uses, and run discovery. The report is one input to the risk analysis the Security Rule requires at 45 CFR 164.308(a)(1)(ii)(A), the part that locates ePHI on file shares; it is not the risk analysis.

GLBA / Financial Services

Run annual discovery scans and export scan results (SQL or report) as evidence for GLBA Safeguards Rule information inventory requirements.

Scheduling and Maintenance

The content scan job supports Manual and Always scheduling. In Always mode, the scanner completes a cycle and then starts another, inspecting new or changed files; this is not a real-time file-change trigger. Use an approved external schedule if a specific daily or weekly window is required.

Monitor in three places: the Windows event log Microsoft Purview Information Protection Scanner that Install-Scanner creates on the node, Get-ScanStatus in PowerShell, and the Content scan jobs page, whose LAST SCAN RESULTS and LAST SCAN (END TIME) columns fill when a cycle completes; the detailed client log is %localappdata%\Microsoft\MSIP\Logs\MSIPScanner.iplog. After the first full pass every cycle is incremental, and since scanner 2.8.85.0 a settings change (including Enforce Off to On) no longer forces a full pass: select the job and Rescan all files, and answer No when the portal offers to skip the rescan, or the existing files keep their old state. See rescanning files.