Content Explorer for Data Discovery

Content Explorer is a read-only tool within the Microsoft Purview compliance portal that provides a top-level view of items that have been classified by Microsoft 365's automatic data classification engine. It exists to answer a fundamental compliance question: 'Where is my sensitive data?' Without Content Explorer, administrators would have to manually search through SharePoint Online, OneDrive for Business, and Exchange Online, which is impractical at enterprise scale. Content Explorer aggregates classification results into a single pane of glass, showing which files contain sensitive information types (e.g., credit card numbers, passport numbers), which sensitivity labels have been applied (e.g., Confidential, Highly Confidential), and which retention labels are assigned.

Content Explorer does not perform real-time scanning. Instead, it relies on the results of scheduled and continuous data classification jobs that run in the background. These jobs are part of the Microsoft Purview Data Classification service, which uses: - Sensitive information types (SITs) – predefined or custom patterns (e.g., regex for credit card numbers, function checks for Luhn algorithm). - Trainable classifiers – machine learning models that identify content based on context (e.g., 'contract' or 'invoice'). - Sensitivity labels – labels published via Microsoft Purview Information Protection that are applied manually or automatically. - Retention labels – labels from Microsoft Purview Records Management.

The classification results are stored in a centralized index within the Microsoft 365 compliance backend. When you open Content Explorer, it queries this index to display:

To use Content Explorer, you must first enable data classification scanning. This is done via: 1. In the Purview compliance portal, go to Data Classification > Overview. 2. Click 'Start scanning' to initiate the first scan. Scanning can take up to 24 hours to complete for large tenants. 3. Ensure the appropriate roles are assigned: 'Content Explorer List Viewer' allows viewing the list of items; 'Content Explorer Content Viewer' allows viewing the actual content of files.

To verify that scanning is working:

Connect-ExchangeOnline
Get-ClassificationRuleCollection | Format-Table Name, State, Priority

Note: The above command gets classification rule collections, not scan status. For scan status, use the compliance portal UI.

Content Explorer works with: - Activity Explorer: While Content Explorer shows a static snapshot of classified items, Activity Explorer shows real-time user activities (e.g., file accessed, label changed). Together they provide both inventory and audit. - Microsoft Defender for Cloud Apps: File policies in Defender for Cloud Apps can be used to detect and protect sensitive data in cloud apps, and results can be viewed in Content Explorer if the files are stored in Microsoft 365. - Microsoft Purview Data Loss Prevention (DLP): DLP policies can be configured to block or warn when sensitive data is shared externally. Content Explorer helps identify which files are at risk before a policy is created. - Microsoft Information Protection (MIP): Sensitivity labels are the cornerstone of MIP. Content Explorer shows which labels have been applied and where.

A healthcare organization must comply with HIPAA and needs to ensure that patient health information (PHI) is not stored in unsecured locations like personal OneDrive folders or shared externally. The compliance team uses Content Explorer to filter by the 'U.S. Social Security Number' SIT and set 'External Sharing = Yes'. They discover 500 files containing SSNs that are shared with external users. The team then uses the export feature to create a list of these files and works with data owners to revoke external sharing or apply a 'Highly Confidential' sensitivity label that encrypts the files. The challenge is that Content Explorer only shows a snapshot; if a file is modified after the last scan, it may not be captured until the next incremental scan. To mitigate this, the team runs a manual full scan weekly. Performance is generally good for tenants up to 100,000 files; beyond that, filtering is essential to avoid timeouts.

A financial services firm has deployed sensitivity labels to classify documents as 'Public', 'Internal', 'Confidential', and 'Highly Confidential'. They want to verify that all documents containing credit card information are labeled 'Confidential' or higher. Using Content Explorer, they filter by the 'Credit Card Number' SIT and then look at the 'Sensitivity Label' column. They find 200 files that have no label or are labeled 'Internal'. This indicates a gap in auto-labeling policies. The team then creates an auto-labeling policy that applies the 'Confidential' label whenever a credit card number is detected. After the policy is published, they re-scan and use Content Explorer to confirm that the label has been applied. A common pitfall: auto-labeling policies only apply to new or modified files; existing files require a manual re-scan or a PowerShell script to trigger classification.

An employee is suspected of sending sensitive customer data via email. The security team uses Content Explorer to look at Exchange Online mailboxes. They filter by the 'Passport Number' SIT and the user's mailbox. Content Explorer shows all emails containing passport numbers in that mailbox, including sent items. They can see the email subject, date, and whether the email was sent externally. This helps the team identify which emails contained sensitive data and to whom they were sent. However, Content Explorer does not show the actual email content unless the user has the Content Viewer role. If the role is not assigned, they must use eDiscovery to retrieve the full email. This scenario highlights the need for proper role assignment before an incident occurs.