Set-SensitiveInformationScan

Syntax

Default (Default)

Set-SensitiveInformationScan
    [-Identity] <PolicyIdParameter>
    [-AddEndpointDlpLocation <MultiValuedProperty>]
    [-AddEndpointDlpLocationException <MultiValuedProperty>]
    [-AddExchangeLocation <MultiValuedProperty>]
    [-AddOneDriveLocation <MultiValuedProperty>]
    [-AddOneDriveLocationException <MultiValuedProperty>]
    [-AddSharePointLocation <MultiValuedProperty>]
    [-AddSharePointLocationException <MultiValuedProperty>]
    [-AddTeamsLocation <MultiValuedProperty>]
    [-AddTeamsLocationException <MultiValuedProperty>]
    [-CancelScan <Boolean>]
    [-Comment <String>]
    [-Confirm]
    [-ExceptIfOneDriveSharedBy <RecipientIdParameter[]>]
    [-ExceptIfOneDriveSharedByMemberOf <RecipientIdParameter[]>]
    [-ExchangeSender <SmtpAddress[]>]
    [-ExchangeSenderException <SmtpAddress[]>]
    [-ExchangeSenderMemberOf <RecipientIdParameter[]>]
    [-ExchangeSenderMemberOfException <RecipientIdParameter[]>]
    [-Mode <PolicyMode>]
    [-OneDriveSharedBy <RecipientIdParameter[]>]
    [-OneDriveSharedByMemberOf <RecipientIdParameter[]>]
    [-PolicyRBACScopes <MultiValuedProperty>]
    [-RemoveEndpointDlpLocation <MultiValuedProperty>]
    [-RemoveEndpointDlpLocationException <MultiValuedProperty>]
    [-RemoveExchangeLocation <MultiValuedProperty>]
    [-RemoveOneDriveLocation <MultiValuedProperty>]
    [-RemoveOneDriveLocationException <MultiValuedProperty>]
    [-RemoveSharePointLocation <MultiValuedProperty>]
    [-RemoveSharePointLocationException <MultiValuedProperty>]
    [-RemoveTeamsLocation <MultiValuedProperty>]
    [-RemoveTeamsLocationException <MultiValuedProperty>]
    [-StartImpactAssessment <Boolean>]
    [-StopImpactAssessmentAndStartClassification <Boolean>]
    [-WhatIf]
    [<CommonParameters>]

Description

Examples

Example 1

Set-SensitiveInformationScan "SharePoint scan" -AddOneDriveLocation All -Workload OneDriveForBusiness

Parameters

-AddEndpointDlpLocation

Applicable: Security & Compliance

Note: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.

The AddEndpointDLPLocation parameter specifies the user accounts to add to the list of included accounts for Endpoint DLP if you used the value All for the EndpointDLPLocation parameter. You identify the account by name or email address.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

A scan can't have Endpoint devices and SharePoint/OneDrive locations together in the same command.

For more information about Endpoint DLP, see Learn about Endpoint data loss prevention.

Parameter properties

Parameter sets

-AddEndpointDlpLocationException

Applicable: Security & Compliance

Note: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.

The AddEndpointDlpLocationException parameter specifies the user accounts to add to the list of excluded accounts for Endpoint DLP if you used the value All for the EndpointDLPLocation parameter. You identify the account by name or email address.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

A scan can't have Endpoint devices and SharePoint/OneDrive locations together in the same command.

For more information about Endpoint DLP, see Learn about Endpoint data loss prevention.

Parameter properties

Parameter sets

-AddExchangeLocation

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-AddOneDriveLocation

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-AddOneDriveLocationException

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-AddSharePointLocation

Applicable: Security & Compliance

The AddSharePointLocation parameter specifies the SharePoint sites to add to the list of included sites if you used the value All for the SharePointLocation parameter. You identify the site by its URL value.

You can't add SharePoint sites to the scan until they have been indexed.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

Parameter properties

Parameter sets

-AddSharePointLocationException

Applicable: Security & Compliance

The AddSharePointLocationException parameter specifies the SharePoint sites to add to the list of excluded sites if you used the value All for the SharePointLocation parameter. You identify the site by its URL value.

You can't add SharePoint sites to the scan until they have been indexed.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

Parameter properties

Parameter sets

-AddTeamsLocation

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-AddTeamsLocationException

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-CancelScan

Applicable: Security & Compliance

The CancelScan parameter specifies whether to cancel an active scan in the classification stage. Valid values are:

• $true: Cancel the active scan.
• $false: Don't cancel the active scan. This value is the default.

Parameter properties

Parameter sets

-Comment

Applicable: Security & Compliance

The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks ("), for example: "This is an admin note".

Parameter properties

Parameter sets

-Confirm

Applicable: Security & Compliance

The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.

• Destructive cmdlets (for example, Remove-* cmdlets) have a built-in pause that forces you to acknowledge the command before proceeding. For these cmdlets, you can skip the confirmation prompt by using this exact syntax: -Confirm:$false.
• Most other cmdlets (for example, New-* and Set-* cmdlets) don't have a built-in pause. For these cmdlets, specifying the Confirm switch without a value introduces a pause that forces you acknowledge the command before proceeding.

Parameter properties

Parameter sets

-ExceptIfOneDriveSharedBy

Applicable: Security & Compliance

The ExceptIfOneDriveSharedBy parameter specifies the users to exclude from the scan (the sites of the OneDrive user accounts are included in the scan). You identify the users by UPN (laura@contoso.onmicrosoft.com).

To use this parameter, one of the following statements must be true:

• The scan already includes OneDrive sites (in the output of Get-DlpCOmpliancePolicy, the OneDriveLocation property value is All, which is the default value).
• Use -AddOneDriveLocation All in the same command with this parameter.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

You can't use this parameter with the OneDriveSharedBy or OneDriveSharedByMemberOf parameters.

Parameter properties

Parameter sets

-ExceptIfOneDriveSharedByMemberOf

Applicable: Security & Compliance

The ExceptIfOneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to exclude from the scan (the OneDrive sites of group members are excluded from the scan). You identify the groups by email address.

To use this parameter, one of the following statements must be true:

• The scan already includes OneDrive sites (in the output of Get-DlpCOmpliancePolicy, the OneDriveLocation property value is All, which is the default value).
• Use -AddOneDriveLocation All in the same command with this parameter.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

You can't use this parameter with the OneDriveSharedBy or OneDriveSharedByMemberOf parameters.

You can't use this parameter to specify Microsoft 365 Groups.

Parameter properties

Parameter sets

-ExchangeSender

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-ExchangeSenderException

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-ExchangeSenderMemberOf

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-ExchangeSenderMemberOfException

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-Identity

Applicable: Security & Compliance

The Identity parameter specifies the sensitive information scan that you want to modify. You can use any value that uniquely identifies the scan. For example:

• Name
• Distinguished name (DN)
• GUID

Parameter properties

Parameter sets

-Mode

Applicable: Security & Compliance

The Mode parameter specifies the scan mode. Valid values are:

• Enable: Use this value to start the scan.
• Disable
• TestWithNotifications
• TestWithoutNotifications
• PendingDeletion

Parameter properties

Parameter sets

-OneDriveSharedBy

Applicable: Security & Compliance

The OneDriveSharedBy parameter specifies the users to include in the DLP scan (the sites of the OneDrive user accounts are included in the scan). You identify the users by UPN (laura@contoso.onmicrosoft.com).

To use this parameter, one of the following statements must be true:

• The scan already includes OneDrive sites (in the output of Get-SensitiveInformationScan, the OneDriveLocation property value is All, which is the default value).
• Use -AddOneDriveLocation All in the same command with this parameter.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

You can't use this parameter with the ExceptIfOneDriveSharedBy or ExceptIfOneDriveSharedByMemberOf parameters.

Parameter properties

Parameter sets

-OneDriveSharedByMemberOf

Applicable: Security & Compliance

The OneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to include in the DLP scan (the OneDrive sites of group members are included in the scan). You identify the groups by email address.

To use this parameter, one of the following statements must be true:

• The scan already includes OneDrive sites (in the output of Get-SensitiveInformationScan, the OneDriveLocation property value is All, which is the default value).
• Use -AddOneDriveLocation All in the same command with this parameter.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

You can't use this parameter with the ExceptIfOneDriveSharedBy or ExceptIfOneDriveSharedByMemberOf parameters.

You can't use this parameter to specify Microsoft 365 Groups.

Parameter properties

Parameter sets

-PolicyRBACScopes

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-RemoveEndpointDlpLocation

Applicable: Security & Compliance

Note: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.

The RemoveEndpointDlpLocation parameter specifies the user accounts to remove from the list of included accounts for Endpoint DLP if you used the value All for the EndpointDLPLocation parameter. You specify the account by name or email address.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

For more information about Endpoint DLP, see Learn about Endpoint data loss prevention.

Parameter properties

Parameter sets

-RemoveEndpointDlpLocationException

Applicable: Security & Compliance

Note: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.

The RemoveEndpointDlpLocation parameter specifies the user accounts to remove from the list of excluded accounts for Endpoint DLP if you used the value All for the EndpointDLPLocation parameter. You specify the account by name or email address.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

For more information about Endpoint DLP, see Learn about Endpoint data loss prevention.

Parameter properties

Parameter sets

-RemoveExchangeLocation

Applicable: Security & Compliance

The RemoveExchangeLocation parameter removes email messages from the scan if they're already included. The valid value for this parameter is All.

If the scan already includes email messages (in the output of the Get-DlpCompliancePolicy cmdlet, the ExchangeLocation property value is All), you can use -RemoveExchangeLocation All to prevent the scan from applying to email messages.

Parameter properties

Parameter sets

-RemoveOneDriveLocation

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-RemoveOneDriveLocationException

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-RemoveSharePointLocation

Applicable: Security & Compliance

The RemoveSharePointLocation parameter specifies the SharePoint sites to remove from the list of included sites if you used the value All for the SharePointLocation parameter. You specify the site by its URL value.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

Parameter properties

Parameter sets

-RemoveSharePointLocationException

Applicable: Security & Compliance

The RemoveSharePointLocationException parameter specifies the SharePoint sites to remove from the list of excluded sites if you used the value All for the SharePointLocation parameter. You specify the site by its URL value.

To enter multiple values, use the following syntax: <value1>,<value2>,...<valueX>. If the values contain spaces or otherwise require quotation marks, use the following syntax: "<value1>","<value2>",..."<valueX>".

Parameter properties

Parameter sets

-RemoveTeamsLocation

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-RemoveTeamsLocationException

Applicable: Security & Compliance

This parameter is reserved for internal Microsoft use.

Parameter properties

Parameter sets

-StartImpactAssessment

Applicable: Security & Compliance

The StartImpactAssessment parameter specifies whether to start cost estimation for on-demand classification scans. Valid values are:

• $true: Start cost estimation for on-demand classification scans.
• $false: Don't start cost estimation for on-demand classification scans.

Parameter properties

Parameter sets

-StopImpactAssessmentAndStartClassification

Applicable: Security & Compliance

The StopImpactAssessmentAndStartClassification specifies whether to stop cost estimation and start classification for devices where estimation completed successfully. Valid values are:

• $true: Start classification for devices where estimation completed successfully.
• $false: Don't start classification for devices where estimation completed successfully.

Parameter properties

Parameter sets

-WhatIf

Applicable: Security & Compliance

The WhatIf switch doesn't work in Security & Compliance PowerShell.

Parameter properties

Parameter sets

CommonParameters