Get started with content explorer
Content explorer allows you to natively view the items that were summarized on the overview page.
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.
Prerequisites
For licensing requirements, see Information Protection: Data Classification Analytics: Overview Content & Activity Explorer
Permissions
In order to get access to the content explorer tab, an account must be assigned membership in any one of these roles or role groups.
Microsoft Entra ID roles
- Global administrator
- Compliance administrator
- Security administrator
- Compliance data administrator
Important
Membership in these roles does not allow you to view the list of items in content explorer or to view the contents of the items in content explorer.
Required permissions to access items in content explorer
Access to content explorer is highly restricted because it lets you read the contents of scanned files.
Important
These permissions supersede permissions that are locally assigned to the items, which allows viewing of the content. There are two roles that grant access to content explorer and it is granted using the Microsoft Purview compliance portal:
Content Explorer List viewer: Membership in this role group allows you to see each item and its location in list view. The
data classification list viewerrole has been pre-assigned to this role group.Content Explorer Content viewer: Membership in this role group allows you to view the contents of each item in the list. The
data classification content viewerrole has been pre-assigned to this role group. Additionally, this role is also required to view name of items in list view, which may contain sensitive data.
Note
Content Explorer does not support administrative units. Members of role groups that have the data classification list viewer or data classification content viewer role will receive these respective role permissions at the organization level and will not be restricted by administrative unit assignments within content explorer. For more on administrative unit support in Purview, see Administrative units support in Microsoft Purview. The account you use to access content explorer must be in one or both of the role groups. These are independent role groups and aren't cumulative. For example, if you want to grant an account the ability to view the items and their locations only, grant Content Explorer List viewer rights. If you want that same account to also be able to view the contents of the items in the list, grant Content Explorer Content viewer rights as well.
You can also assign either or both of the roles to a custom role group to tailor access to content explorer.
Role management role holders in Microsoft Purview can assign the necessary Content Explorer List Viewer, and Content Explorer Content Viewer role group membership.
Microsoft Purview Roles and Role Groups
There are roles and role groups that you use to fine tune your access controls.
Here's a list of applicable roles. To learn more about them, see Permissions in the Microsoft Purview compliance portal.
- Information Protection Admin
- Information Protection Analyst
- Information Protection Investigator
- Information Protection Reader
Here's a list of applicable role groups. To learn more, see Permissions in the Microsoft Purview compliance portal.
- Information Protection
- Information Protection Admins
- Information Protection Analysts
- Information Protection Investigators
- Information Protection Readers
Content explorer
Content explorer shows a current snapshot of the items that have a sensitivity label, a retention label or have been classified as a sensitive information type in your organization.
Sensitive information types
A DLP policy can help protect sensitive information, which is defined as a sensitive information type. Microsoft 365 includes definitions for many common sensitive information types from across many different regions that are ready for you to use. For example, a credit card number, bank account numbers, and national ID numbers.
Sensitivity labels
A sensitivity label is simply a tag that indicates the value of the item to your organization. It can be applied manually, or automatically. Once applied, the label gets embedded in the document and will follow the document everywhere it goes. A sensitivity label enables various protective behaviors, such as mandatory watermarking or encryption.
Sensitivity labels must be enabled for files that are in SharePoint and OneDrive in order for the corresponding data to surface in the data classification page. For more information, see Enable sensitivity labels for files in SharePoint and OneDrive.
Retention labels
A retention label allows you to define how long a labeled item is kept and the steps to be taken prior to deleting it. They're applied manually or automatically via policies. They can play a role in helping your organization stay in compliance with legal and regulatory requirements.
How to use content explorer
- Open Microsoft Purview compliance portal > Data classification > Content explorer.
- If you know the name of the label, or the sensitive information type, you can type that into the filter box.
- Alternately, you can browse for the item by expanding the label type and selecting the label from the list.
- Select a location under All locations and drill down the folder structure to the item.
- Double-click to open the item natively in content explorer.
Export
The export control will create a .csv file that contains a listing of whatever the focus of the pane is.
Note
It can take up to seven days for counts to be updated in content explorer, fourteen days for files that are in SharePoint.
Filter
When you drill down into a location, such as an Exchange or Teams folder, or a SharePoint or OneDrive site, the Filter tool appears.
The scope of the search tool is what is displaying in the All locations pane and what you can search on varies depending on the selected location.
When Exchange or Teams is the selected location, you can search on the full email address of the mailbox, for example user@domainname.com.
When either SharePoint or OneDrive are selected location, the search tool will appear when you drill down to site names, folders and files.
You can search on:
| value | example |
|---|---|
| full site name | https://contoso.onmicrosoft.com/sites/sitename |
| file name | RES_Resume_1234.txt |
| text at the beginning of file name | RES |
| text after an underscore character ( _ ) in file name | Resume or 1234 |
| file extension | txt |
Provide match/not a match accuracy feedback in content explorer
You can view the number of matches a SIT or trainable classifier has in Content explorer. You can also provide feedback on whether an item is actually a match or not using the Match, Not a Match feedback mechanism and use that feedback to tune your classifiers. See, Increase classifier accuracy for more information.