How can I validate onboarding, discovery, classification, and sensitivity labeling for a Windows File Server using Microsoft Purview Information Protection Scanner?

Purview Learner 0 Reputation points
2026-08-07T13:03:57.6066667+00:00

Hello,

I am looking for guidance on validating a Windows File Server after onboarding it to Microsoft Purview using the Microsoft Purview Information Protection Scanner.

The scanner has been installed and configured, and scans have been executed successfully.

I would like to confirm the correct validation process for the following:

  1. Verify that the Windows File Server has been onboarded successfully.
  2. Confirm that discovery scans completed successfully.
  3. Verify that sensitive information types and classifications are being detected correctly.
  4. Validate that sensitivity labels are being applied as expected.
  5. Review the appropriate reports, logs, and dashboards in Microsoft Purview to confirm successful classification and labeling.
  6. Identify any recommended troubleshooting steps if classifications or labels do not appear as expected.

Could you please provide the recommended validation checklist and best practices for confirming that onboarding, discovery, classification, and labeling are working correctly for a Windows File Server?

Thank you.

Microsoft Security | Microsoft Purview
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator
    2026-08-11T12:47:53.87+00:00

    Hello @Purview Learner ,

      You can validate the Windows File Server onboarding and scan results by checking the scanner configuration, scan status, local scanner reports, and the label/classification policy settings. A recommended validation flow is below.

    1. Validate scanner onboarding and repository configuration

     - Confirm that the Microsoft Purview Information Protection scanner is installed on a supported Windows Server and that the file share is added as a repository, typically through a UNC path.

    • Confirm that the scanner service is running and that the scanner account has at least read access for discovery-only scans. If labels or protection must be applied, the account also needs the required write/modify permissions on the target files.
    • Confirm that the scanner account has a published sensitivity label policy available to it and that the labels intended for scanner use are published to the scanner account.

     

    1. Confirm scan execution and scanner health

     Run the following on the scanner server:

     ```powershell

    Get-ScanStatus
Get-ScanStatus -Verbose

    Was this answer helpful?

  2. AI answer

    2026-08-07T13:04:25.4266667+00:00

    A practical validation checklist for a Windows File Server with the Microsoft Purview Information Protection scanner is:

    1. Validate onboarding and scanner readiness
      • Confirm the scanner is installed on Windows Server and is targeting supported repositories such as UNC paths for network shares.
      • Confirm the scanner service account meets the required permissions for the repository:
        • Read, Write, and Modify for classification/protection
        • Read only if running discovery mode only
      • Confirm the service account is synchronized to Microsoft Entra ID and is used to authenticate the scanner.
      • If authentication issues are suspected, use Set-Authentication with a token for the same service account that runs the scanner service.
    2. Confirm discovery scans completed successfully
      • Run Get-ScanStatus to verify cluster status, start time, and participating nodes.
      • Review NodesInfo from Get-ScanStatus to confirm each node status and whether it is actively scanning.
      • Drill into node summary details to review values such as:
        • ScannedFiles
        • FailedFiles
        • ScannedBytes
        • Classified
        • Labeled
      • Use Get-ScanStatus -Verbose for additional details about the current scan.
      • If a scan must be stopped during testing, use Stop scan in the Microsoft Purview portal or run Stop-Scan.
    3. Verify sensitive information detection and classification
      • During initial validation, the scanner configuration commonly uses Info types to be discovered = Policy only. In that mode, only files that meet the conditions configured for automatic classification are included in detailed reports.
      • If expected classifications are missing, verify that label configuration includes automatic classification rather than only recommended classification.
      • If needed, enable Treat recommended labeling as automatic when using scanner version 2.7.x.x and above.
      • If results are still incorrect, reconfigure the label conditions and repeat the discovery procedure until the expected matches appear.
    4. Validate sensitivity labeling is being applied
      • To move from discovery-only validation to actual enforcement, update the content scan job by using Set-ScannerContentScan so the scheduling is set to always and the sensitivity policy is enforced.
      • If labels are not being applied, verify that the policy includes automatic labeling conditions. A missing automatic labeling configuration can cause the scanner to detect content without applying labels as expected.
      • For scenarios where the error is Policy is missing labeling conditions, validate both:
        • Content scan job settings: set Info types to be discovered to All and define a default label to be applied when scanning
        • Labeling policy settings: define a default sensitivity label and configure automatic or recommended labeling
    5. Review reports, logs, and status outputs
      • Use the scanner reports generated during discovery and scan execution to validate which files matched policy conditions.
      • Increase logging detail with the ReportLevel parameter of Set-ScannerConfiguration when deeper validation is needed.
      • The report folder location or name cannot be changed directly. If reports must be stored elsewhere, use a directory junction.
      • Use Get-ScanStatus output as the primary operational validation for scan progress and per-node results.
    6. Troubleshooting checklist when classifications or labels do not appear
      • Verify the scanner authenticated successfully with the correct service account token.
      • Check whether the sensitivity policy file exists at: %localappdata%\Microsoft\MSIP\mip\MSIP.Scanner.exe\mip\mip.policies.sqlite3
      • If the error is Policy is missing, verify the policy file is present.
      • If the error is Policy is missing labeling conditions, configure automatic labeling conditions and related default label settings.
      • If no labels are applied after a successful scan, verify the label uses automatic classification, or enable Treat recommended labeling as automatic if supported by the scanner version.
      • If scan results are incomplete or unexpected, review per-node status and counters with Get-ScanStatus, then adjust label conditions and rerun the scan.

    Best-practice validation flow

    1. Confirm repository access and service account permissions.
    2. Confirm authentication for the scanner service account.
    3. Run a discovery scan.
    4. Use Get-ScanStatus and node summaries to confirm files were scanned and whether files were classified or labeled.
    5. Review scanner reports for files matching automatic labeling conditions.
    6. If matches are missing, adjust label conditions or automatic labeling settings and rerun discovery.
    7. After discovery results are correct, enforce classification and protection with Set-ScannerContentScan.
    8. Re-run validation and confirm Classified and Labeled counters increase as expected.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.