Commands › Exchange Online

New-SensitiveInformationScan

Exchange Online ExchangeOnlineManagement New-*

For more information, see Security & Compliance PowerShell. Use the New-SensitiveInformationScan cmdlet to create new on-demand classification scans. Learn more about on-demand classifications at On-demand classification.

Quick start script

# New-SensitiveInformationScan — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-SensitiveInformationScan
$before | Format-List

# 3. Make the change (dry run first)
New-SensitiveInformationScan -Name <String> -WhatIf
New-SensitiveInformationScan -Name <String>

# 4. Verify and diff
$after = Get-SensitiveInformationScan
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-SensitiveInformationScan [-Name] <String>
 [-Comment <String>]
 [-Confirm]
 [-EndpointDlpLocation <MultiValuedProperty>]
 [-EndpointDlpLocationException <MultiValuedProperty>]
 [-ExceptIfOneDriveSharedBy <RecipientIdParameter[]>]
 [-ExceptIfOneDriveSharedByMemberOf <RecipientIdParameter[]>]
 [-ExchangeLocation <MultiValuedProperty>]
 [-ExchangeSender <SmtpAddress[]>]
 [-ExchangeSenderException <SmtpAddress[]>]
 [-ExchangeSenderMemberOf <RecipientIdParameter[]>]
 [-ExchangeSenderMemberOfException <RecipientIdParameter[]>]
 [-OneDriveLocation <MultiValuedProperty>]
 [-OneDriveLocationException <MultiValuedProperty>]
 [-OneDriveSharedBy <RecipientIdParameter[]>]
 [-OneDriveSharedByMemberOf <RecipientIdParameter[]>]
 [-PolicyRBACScopes <MultiValuedProperty>]
 [-SharePointLocation <MultiValuedProperty>]
 [-SharePointLocationException <MultiValuedProperty>]
 [-TeamsLocation <MultiValuedProperty>]
 [-TeamsLocationException <MultiValuedProperty>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (22)

Parameter	Type	Required	What it controls
-Name	String	yes	The Name parameter specifies the unique name of the scan. If the value contains spaces, enclose the value in quotation marks.
-Comment	String		The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks ("), for example: "This is an admin note".
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-EndpointDlpLocation	MultiValuedProperty		Note: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.
-EndpointDlpLocationException	MultiValuedProperty		Note: This parameter requires membership in the Compliance Administrator or Compliance Data Administrator roles in Microsoft Entra ID.
-ExceptIfOneDriveSharedBy	RecipientIdParameter[]		The ExceptIfOneDriveSharedBy parameter specifies the users to exclude from the scan (the sites of the OneDrive user accounts are included in the scan). You identify the users by UPN (`laura@contoso.onmicrosoft.com`).
-ExceptIfOneDriveSharedByMemberOf	RecipientIdParameter[]		The ExceptIfOneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to exclude from the scan (the OneDrive sites of group members are excluded from the scan). You identify...
-ExchangeLocation	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-ExchangeSender	SmtpAddress[]		This parameter is reserved for internal Microsoft use.
-ExchangeSenderException	SmtpAddress[]		This parameter is reserved for internal Microsoft use.
-ExchangeSenderMemberOf	RecipientIdParameter[]		This parameter is reserved for internal Microsoft use.
-ExchangeSenderMemberOfException	RecipientIdParameter[]		This parameter is reserved for internal Microsoft use.
-OneDriveLocation	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-OneDriveLocationException	MultiValuedProperty		This parameter specifies the OneDrive sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.
-OneDriveSharedBy	RecipientIdParameter[]		The OneDriveSharedBy parameter specifies the users to include in the scan (the sites of the OneDrive user accounts are included in the scan). You identify the users by UPN (`laura@contoso.onmicrosoft.com`).
-OneDriveSharedByMemberOf	RecipientIdParameter[]		The OneDriveSharedByMemberOf parameter specifies the distribution groups or mail-enabled security groups to include in the scan (the OneDrive sites of group members are included in the scan). You identify the groups...
-PolicyRBACScopes	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-SharePointLocation	MultiValuedProperty		The SharePointLocation parameter specifies the SharePoint sites to include in the scan. You identify the site by its URL value, or you can use the value All to include all sites.
-SharePointLocationException	MultiValuedProperty		The SharePointLocationException parameter specifies the SharePoint sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
-TeamsLocation	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-TeamsLocationException	MultiValuedProperty		This parameter is reserved for internal Microsoft use.
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.