Microsoft Purview (Security & Compliance PowerShell)
Retention, DLP, eDiscovery and sensitivity labels through Connect-IPPSSession.
Official documentation- Please close the current PowerShell session ... Connect-IPPSSession with the -EnableSearchOnlySession flagSince August 2025 New-ComplianceSearch and the other eDiscovery cmdlets need module 3.9.0+ and Connect-IPPSSession -EnableSearchOnlySession in a new session.
- The term 'Get-RetentionCompliancePolicy' is not recognized as the name of a cmdletPurview cmdlets such as Get-RetentionCompliancePolicy, Get-DlpCompliancePolicy and Get-Label exist only after Connect-IPPSSession, not Connect-ExchangeOnline.
- Retention policy stuck in PendingDeletion: Remove-RetentionCompliancePolicy -ForceDeletionA Purview retention policy stuck in PendingDeletion had a failed deletion. Connect-IPPSSession, then run Remove-RetentionCompliancePolicy with -ForceDeletion.
- Retention policy error: We couldn't find this location (FailedToOpenContainer)A location in the retention policy no longer exists (FailedToOpenContainer). Remove it with Set-RetentionCompliancePolicy, then use -RetryDistribution.
- Connect-IPPSSession: connect to Security & Compliance PowerShell (Purview)Connect-IPPSSession from ExchangeOnlineManagement opens Security & Compliance PowerShell for Purview cmdlets; add -EnableSearchOnlySession for eDiscovery.
- Create a Purview DLP policy with PowerShell: New-DlpCompliancePolicy and New-DlpComplianceRuleA DLP policy needs New-DlpCompliancePolicy for locations and mode, then New-DlpComplianceRule for sensitive info types and actions. Test in simulation first.
- Get-Label: list sensitivity labels and label policies in Security & Compliance PowerShellGet-Label lists Purview sensitivity labels and Get-LabelPolicy shows who receives them. Both need Connect-IPPSSession; -SkipValidations helps with many labels.
- New-ComplianceSearch and Start-ComplianceSearch: run a Purview content search in PowerShellCreate the search with New-ComplianceSearch, run it with Start-ComplianceSearch, read counts with Get-ComplianceSearch. Connect with -EnableSearchOnlySession.
- Purview retention in PowerShell: New-RetentionCompliancePolicy, New-RetentionComplianceRule, New-ComplianceTagA retention policy is a policy plus a rule: New-RetentionCompliancePolicy sets locations, New-RetentionComplianceRule the duration. Labels: New-ComplianceTag.
- Search-UnifiedAuditLog: search the Microsoft 365 audit log with PowerShellSearch-UnifiedAuditLog runs in Exchange Online PowerShell and returns 100 records by default; -SessionCommand ReturnLargeSet with a SessionId pages to 50,000.
- Connect-IPPSSession -ConnectionUri: connect to GCC High, DoD or 21VianetConnect-IPPSSession -ConnectionUri and -AzureADAuthorizationEndpointUri values for GCC High, DoD and 21Vianet. Commercial and GCC tenants should not use them.
- New-ComplianceSearchAction -Purge -PurgeType SoftDelete or HardDeleteNew-ComplianceSearchAction -Purge -PurgeType SoftDelete or HardDelete removes phishing mail found by a content search: 10 items per mailbox, roles and holds.
- Search-UnifiedAuditLog -SessionCommand ReturnLargeSet: get more than 100 audit recordsSearch-UnifiedAuditLog returns 100 records by default. -SessionCommand ReturnLargeSet with one SessionId pages up to 50,000; rules, a loop and the 5,000 limit.
- Set-RetentionCompliancePolicy -RetryDistribution: redeploy a retention policy with errorsSet-RetentionCompliancePolicy -RetryDistribution redeploys a retention policy to locations that failed. Read DistributionResults first; which errors it fixes.