Connect-IPPSSession: connect to Security & Compliance PowerShell (Purview)

Microsoft Purview cmdlets (retention, DLP, sensitivity labels, eDiscovery searches) run in Security & Compliance PowerShell. You connect to it with Connect-IPPSSession, which is part of the same ExchangeOnlineManagement module as Connect-ExchangeOnline:

Import-Module ExchangeOnlineManagement
Connect-IPPSSession -UserPrincipalName admin@contoso.onmicrosoft.com

For eDiscovery cmdlets (New-ComplianceSearch, Start-ComplianceSearch, New-ComplianceSearchAction) add -EnableSearchOnlySession; it requires module 3.9.0 or later:

Connect-IPPSSession -UserPrincipalName admin@contoso.onmicrosoft.com -EnableSearchOnlySession

What the module provides offline

Before connecting, the module contains Connect-IPPSSession but none of the Purview cmdlets; they are created by the connection. Checked with module 3.10.1:

Import-Module ExchangeOnlineManagement
$p = (Get-Command Connect-IPPSSession).Parameters
foreach ($n in 'UserPrincipalName','EnableSearchOnlySession','AppId','CertificateThumbprint','Organization','ConnectionUri','DelegatedOrganization') {
  '{0,-24} {1}' -f $n, $p[$n].ParameterType.Name
}
foreach ($c in 'Get-RetentionCompliancePolicy','Get-DlpCompliancePolicy','Get-Label','New-ComplianceSearch') {
  '{0,-30} available: {1}' -f $c, [bool](Get-Command $c -ErrorAction SilentlyContinue)
}

Connection options

For app-only connections the app needs the Microsoft Exchange Online Protection > Exchange.ManageAsApp application permission and a Microsoft Entra role supported by Security & Compliance PowerShell, such as Compliance Administrator. Microsoft states that app-only authentication for eDiscovery cmdlets is unsupported.

Permissions

After you connect, role-based access control decides which cmdlets and parameters exist in the session. Typical roles: Compliance Administrator for retention and DLP, eDiscovery Manager for compliance searches, and the Search And Purge role for New-ComplianceSearchAction -Purge. A cmdlet you have no role for is simply not imported, so it fails with "is not recognized".