Microsoft Purview configuration in a classic Windows application, one tab per solution.
Sensitivity labels, DLP, retention, records, eDiscovery, audit, insider risk, communication compliance and information barriers, read-only.
A Sarda Cloud Community project by Francesco Valerio Buccoli. Licensed under the MIT License.
The Microsoft Purview portal shows each policy on its own page, a few clicks deep, and some settings (DLP advanced rules, label actions, endpoint DLP settings, file plan metadata) only through PowerShell. Reviewing a tenant's configuration, or comparing it with last month's, means a lot of clicking or a lot of scripting.
Purview Explorer reads the configuration with the read-only Get-* cmdlets of Security &
Compliance PowerShell and shows it in a familiar Windows application: menu bar, toolbar, a tab per solution,
list views, property sheets and a status bar. It never changes anything in the tenant; the session layer
refuses to run any cmdlet that doesn't start with Get-.
- Everything in one place. 12 solutions, 43 kinds of configuration object, with the relations between them.
- Offline snapshots. Save the whole configuration to a diff-friendly JSON file and open it later, anywhere.
- A setup that checks everything. It checks the requirements, installs the PowerShell module if it's missing, and confirms that Purview Explorer can load it. Or skip the setup: it's one 400 KB executable.
- Native on x64 and Arm64. Separate builds for Intel/AMD PCs and for Windows 11 on Arm.
- A tab per solution: Information Protection, Data Classification, Data Loss Prevention, Data Lifecycle Management, Records Management, eDiscovery, Audit, Insider Risk Management, Communication Compliance, Information Barriers, Alert Policies and Permissions, plus a Summary tab.
- Each tab lists its collections (for example DLP policies, DLP rules, Global and endpoint settings), the items of the selected collection and the properties of the selected item.
- Properties dialog (double-click or Alt+Enter) with all properties, related items (a policy's rules, a label's sublabels, a case's holds) and the raw JSON.
- Value viewer (double-click a property): embedded JSON (label actions, advanced DLP rules) and XML (rule packages, EDM schemas) are pretty-printed.
- Sensitivity labels are shown as a hierarchy (sublabels indented under their parent).
- Filter box that searches every property of every item, not just the visible columns.
- Collections load on demand when you open a tab; Load All (Ctrl+L) retrieves everything. Collections your account can't read are marked not available instead of failing the whole view.
- Snapshots: save everything to an indented JSON file and open it later, offline, on any machine, without signing in. Snapshots are stable and diff-friendly, so you can compare configurations over time.
- Export to CSV (Excel-friendly; formula injection is neutralized).
- Demo data (File > Open Demo Data): a fictional Contoso tenant for trying the application.
- Sign-in with Web Account Manager, a browser window, or certificate-based app-only authentication; Commercial/GCC, GCC High, DoD and 21Vianet environments.
- Many organizations, one account: partners (CSP or GDAP) and guests connect to another organization by entering its domain; the organizations you used are remembered. Guest accounts that Microsoft's service can't give a standard session get a search-only session automatically. See Other organizations.
| Summary | Properties dialog | Connect |
|---|---|---|
 |
 |
 |
From the latest release, pick the build for the PC you'll run it on: x64 for Intel and AMD processors (almost all PCs and servers), arm64 for Windows 11 on Arm (for example Snapdragon-based PCs). Not sure? Settings > System > About > System type says "x64-based processor" or "ARM-based processor".
| Download | What it is |
|---|---|
PurviewExplorer-<version>-win-x64-setup.exePurviewExplorer-<version>-win-arm64-setup.exe |
Recommended. A setup wizard that checks the requirements and can install what's missing |
PurviewExplorer-<version>-win-x64.zipPurviewExplorer-<version>-win-arm64.zip |
PurviewExplorer.exe: unzip it anywhere and run it; install the PowerShell module yourself (see Requirements) |
Each setup refuses to run on the other architecture. Neither the setups nor the executables are code-signed, so
Windows SmartScreen may warn the first time; choose More info > Run anyway, or build them yourself.
SHA256SUMS.txt in each release lists their SHA-256 hashes.
| Welcome | System requirements | Checking the installation |
|---|---|---|
 |
 |
 |
- Asks whether to install for you only (the default, no administrator rights needed, into
%LOCALAPPDATA%\Programs\Sarda Cloud\Purview Explorer) or for all users (into Program Files). - Checks the requirements and shows what it found: Windows, .NET Framework, Windows PowerShell 5.1 and the ExchangeOnlineManagement module 3.2.0 or later (see Requirements). It won't continue without the first three, which are part of current Windows versions.
- If the module is missing or too old, offers to install it from the PowerShell Gallery (selected by default): for the current user, or for all users when installing for all users.
- Installs Purview Explorer with a Start menu shortcut (and, if you choose, a desktop shortcut) and an entry in Installed apps for uninstalling.
- Checks the installation: it runs
PurviewExplorer.exe /CheckPrerequisites, which loads the module in the application exactly as signing in would, and shows the result.
Uninstalling removes the application and its shortcuts. It leaves your settings and the PowerShell module, which other tools may use.
Setup supports the usual Inno Setup command-line switches for unattended installs, for example (with the x64 setup):
PurviewExplorer-<version>-win-x64-setup.exe /VERYSILENT /CURRENTUSER install for the current user
PurviewExplorer-<version>-win-x64-setup.exe /VERYSILENT /ALLUSERS install for all users (elevated)
PurviewExplorer-<version>-win-x64-setup.exe /VERYSILENT /MERGETASKS="!installmodule" don't install the module
PurviewExplorer-<version>-win-x64-setup.exe /VERYSILENT /LOG="C:\Temp\PurviewExplorer.log" write a log, including the checks
A silent install stops if Windows, .NET Framework or Windows PowerShell 5.1 is missing. The log records every check and the result of the installation check.
| x64 | arm64 | |
|---|---|---|
| Windows | Windows 10 version 1607 or later, Windows 11, Windows Server 2016 or later | Windows 11 on Arm |
| .NET Framework | 4.8 or later (built into Windows 10 version 1903 and later) | 4.8.1 or later (built into Windows 11 version 22H2 and later) |
| Windows PowerShell | 5.1 (built in) | 5.1 (built in) |
-
The ExchangeOnlineManagement PowerShell module, version 3.2.0 or later. The setup can install it for you; otherwise:
Install-Module ExchangeOnlineManagement -Scope CurrentUser
The module is found whether it was installed for Windows PowerShell or PowerShell 7. Help > Check Prerequisites verifies that it loads, without signing in. Its report replaces your own folders (which contain your user name) with placeholders such as
<Documents>, so you can paste it into an issue. -
An account with permission to read the Purview configuration of the organization you connect to, for example a member of the Compliance Administrator or Organization Management role group (or, for a partner, a GDAP relationship with a role that includes it). Some collections need specific roles (eDiscovery, Insider Risk Management, Communication Compliance); without them those collections show as not available.
- File > Connect to Tenant, choose the environment and the sign-in method, and sign in. To connect to an organization other than your account's own, enter it under Other organization.
- Pick a tab. Its collections load in the background; select a collection to see its items.
- Select an item to see its properties, or double-click it for the full property sheet.
- File > Save Snapshot to keep a copy you can open later with File > Open Snapshot.
| Key | Action |
|---|---|
| F5 | Refresh the selected collection |
| Shift+F5 | Refresh every collection of the tab |
| Ctrl+L | Load all collections |
| Ctrl+F5 | Refresh all collections |
| Ctrl+F | Filter the list |
| Alt+Enter, Enter | Properties of the selected item |
| Ctrl+C | Copy the selected rows (tab-separated) |
| Ctrl+E | Export the list to CSV |
| Ctrl+O / Ctrl+S | Open / save a snapshot |
Command line:
PurviewExplorer.exe [snapshot.json] open a snapshot
PurviewExplorer.exe /Demo open the demo data
PurviewExplorer.exe /CheckPrerequisites[:report.txt] check that the module loads, without signing in; with a file name,
write the report there instead of showing it (exit code 0 = ready)
PurviewExplorer.exe /SelfTest:log.txt drive the UI with the demo data and write PASS/FAIL lines (exit code 0 = all passed)
- Interactive (default): the module signs in with Web Account Manager (WAM), or with a browser window if you choose Sign in with a browser window instead of Web Account Manager. If WAM reports a problem, Purview Explorer tries the browser window once. If WAM couldn't open its window at all, the module keeps trying WAM until Purview Explorer is closed: open it again and choose the browser window.
- Certificate (app-only): application ID, certificate thumbprint (CurrentUser\My or LocalMachine\My) and the
organization's
*.onmicrosoft.comdomain. See App-only authentication for unattended scripts for setting up the app registration and assigning it a Purview role. A multi-tenant app registration, consented in each organization, reaches several organizations with the same certificate: change the organization.
An account can have access to the Purview configuration of organizations other than its own:
- a partner account (
alex@contoso.com) managing customer organizations through the Cloud Solution Provider program or granular delegated admin privileges (GDAP); - a guest account invited into another organization and given a Purview role there.
Choose Interactive sign-in, enter the account and, under Other organization, the other organization's
*.onmicrosoft.com domain (for example adatum.onmicrosoft.com). Purview Explorer signs in at that organization
and maps the session to it, which is what Microsoft documents for
connecting to customer organizations:
Connect-IPPSSession -UserPrincipalName alex@contoso.com -DelegatedOrganization adatum.onmicrosoft.com `
-AzureADAuthorizationEndpointUri https://login.microsoftonline.com/adatum.onmicrosoft.comIn GCC High and DoD the sign-in address is login.microsoftonline.us, in 21Vianet login.chinacloudapi.cn.
Leave Other organization empty for the account's own organization.
Before signing in, Purview Explorer looks the domain up in Microsoft Entra ID (the public sign-in metadata, no account needed), so a misspelled domain fails at once with a clear message. After signing in, it compares the session's tenant with the one the domain belongs to; if they differ, it disconnects before reading anything. The same checks apply to the certificate organization.
For some guest accounts, Microsoft's service fails while setting up a standard session and the module reports
only Object reference not set to an instance of an object. Purview Explorer then automatically connects again
with a search-only session (Connect-IPPSSession -EnableSearchOnlySession, ExchangeOnlineManagement 3.9.0 or
later), which avoids the problem:
Connect-IPPSSession -UserPrincipalName alex@contoso.com -DelegatedOrganization adatum.onmicrosoft.com `
-AzureADAuthorizationEndpointUri https://login.microsoftonline.com/adatum.onmicrosoft.com -EnableSearchOnlySessionThe status bar shows (search-only session), the Summary tab's Session field says Search-only, and snapshots
record "sessionType": "SearchOnly". A search-only session reads most of the configuration, but the service may
not offer some cmdlets in it (with a guest account, for example Get-PolicyTipConfig, Get-ComplianceSearch,
Get-CaseHoldPolicy, Get-UnifiedAuditLogRetentionPolicy and the Communication Compliance cmdlets); those
collections show as unavailable, and the message mentions the search-only session. Purview Explorer remembers, for
14 days, the organizations where only a search-only session worked and starts with one the next time; if that
fails, it tries a standard session.
| Message | What to do |
|---|---|
| No organization has the domain ... | Check the spelling; enter the organization's primary *.onmicrosoft.com domain. |
| ...doesn't recognize ... | The service doesn't know that name: use the *.onmicrosoft.com domain, not another domain or the tenant ID. |
| ...didn't accept your account for ... | The account isn't a guest with a Purview role there, and there is no GDAP relationship that includes one. |
| ...no Microsoft Purview role in ... | Ask for a role group such as Compliance Administrator or Global Reader; activate eligible PIM roles first. |
| ...failed while setting up your permissions in ... | Even the search-only session failed: try again later, or ask for an account in that organization. A message that names ExchangeOnlineManagement 3.9.0 means the module is too old for the search-only session: Update-Module ExchangeOnlineManagement. |
| The session belongs to tenant ... | The account signed in to a different organization than the one entered. Check both and connect again. |
| Web Account Manager ... couldn't open | Close Purview Explorer, open it again and choose the browser window in Connect to Tenant. |
| A collection shows isn't available in this session | Your roles don't include the cmdlet, the feature isn't available in the tenant, or (search-only session) the service doesn't offer it there. |
| Information Barrier feature was not enabled for the tenant | Expected for Application status when the organization doesn't use Information Barriers. |
The title bar, the status bar, the Summary tab and saved snapshots name the organization you connected to; the account shows who signed in. Each other organization, and each certificate organization, you connect to successfully is added to a list of the ten most recent ones, offered in both organization boxes. Connecting again first disconnects the current session, so only one organization is connected at a time; to compare organizations, save a snapshot of each.
Settings (last environment, account, other organization, app ID, thumbprint, recent organizations, organizations
that needed a search-only session, window position) are saved in
%APPDATA%\SardaCloud\PurviewExplorer\settings.json. No passwords, tokens or keys are stored.
| Solution | Collection | Command |
|---|---|---|
| Information Protection | Sensitivity labels | Get-Label -IncludeDetailedLabelActions |
| Information Protection | Label policies | Get-LabelPolicy |
| Information Protection | Auto-labeling policies | Get-AutoSensitivityLabelPolicy |
| Information Protection | Auto-labeling rules | Get-AutoSensitivityLabelRule |
| Data Classification | Sensitive information types | Get-DlpSensitiveInformationType |
| Data Classification | SIT rule packages | Get-DlpSensitiveInformationTypeRulePackage |
| Data Classification | Keyword dictionaries | Get-DlpKeywordDictionary |
| Data Classification | Exact data match schemas | Get-DlpEdmSchema |
| Data Loss Prevention | DLP policies | Get-DlpCompliancePolicy |
| Data Loss Prevention | DLP rules | Get-DlpComplianceRule |
| Data Loss Prevention | Custom policy tips | Get-PolicyTipConfig |
| Data Loss Prevention | Global and endpoint settings | Get-PolicyConfig |
| Data Lifecycle Management | Retention policies | Get-RetentionCompliancePolicy -RetentionRuleTypes |
| Data Lifecycle Management | Retention rules | Get-RetentionComplianceRule |
| Data Lifecycle Management | App retention policies | Get-AppRetentionCompliancePolicy |
| Data Lifecycle Management | App retention rules | Get-AppRetentionComplianceRule |
| Data Lifecycle Management | Adaptive scopes | Get-AdaptiveScope |
| Records Management | Retention labels | Get-ComplianceTag |
| Records Management | Event types | Get-ComplianceRetentionEventType |
| Records Management | Events | Get-ComplianceRetentionEvent |
| Records Management | File plan: departments | Get-FilePlanPropertyDepartment |
| Records Management | File plan: categories | Get-FilePlanPropertyCategory |
| Records Management | File plan: subcategories | Get-FilePlanPropertySubCategory |
| Records Management | File plan: authorities | Get-FilePlanPropertyAuthority |
| Records Management | File plan: citations | Get-FilePlanPropertyCitation |
| Records Management | File plan: reference IDs | Get-FilePlanPropertyReferenceId |
| eDiscovery | Cases (Standard) | Get-ComplianceCase |
| eDiscovery | Cases (Premium) | Get-ComplianceCase -CaseType AdvancedEdiscovery |
| eDiscovery | Case holds | Get-CaseHoldPolicy -Case <each case> |
| eDiscovery | Content searches | Get-ComplianceSearch |
| eDiscovery | Compliance security filters | Get-ComplianceSecurityFilter |
| eDiscovery | eDiscovery administrators | Get-eDiscoveryCaseAdmin |
| Audit | Audit retention policies | Get-UnifiedAuditLogRetentionPolicy |
| Audit | Audit configuration | Get-AdminAuditLogConfig |
| Insider Risk Management | Insider risk policies | Get-InsiderRiskPolicy (not publicly documented) |
| Insider Risk Management | Insider risk cases | Get-ComplianceCase -CaseType InsiderRisk |
| Communication Compliance | Policies | Get-SupervisoryReviewPolicyV2 |
| Communication Compliance | Rules | Get-SupervisoryReviewRule |
| Information Barriers | Policies | Get-InformationBarrierPolicy |
| Information Barriers | Segments | Get-OrganizationSegment |
| Information Barriers | Application status | Get-InformationBarrierPoliciesApplicationStatus |
| Alert Policies | Alert policies | Get-ProtectionAlert |
| Permissions | Role groups | Get-RoleGroup |
The list is defined in Catalog/PurviewCatalog.cs; adding a
collection is one entry (cmdlet, parameters, preferred columns and optional relations).
The application hosts a Windows PowerShell 5.1 runspace in-process (on its own STA thread so the module's
sign-in UI works), imports ExchangeOnlineManagement and runs Connect-IPPSSession limited to the cmdlets above.
Results are converted to plain JSON-like values, which the UI, snapshots and CSV export all share. When the
application is started from PowerShell 7, PowerShell 7 module folders are removed from the process's
PSModulePath, so Windows PowerShell doesn't try to load PowerShell 7's copy of PackageManagement.
{
"format": "PurviewExplorer.Snapshot",
"formatVersion": 1,
"createdUtc": "2026-10-12T18:00:00Z",
"source": { "kind": "Live", "organization": "contoso.onmicrosoft.com", "account": "...", "tenantId": "...", "sessionType": "Standard" },
"collections": {
"DataLossPrevention.Policies": {
"command": "Get-DlpCompliancePolicy",
"state": "Loaded",
"retrievedUtc": "2026-10-12T17:58:41Z",
"items": [ { "Name": "U.S. Financial Data", "Mode": "Enable", "...": "..." } ]
}
}
}source.sessionType (since 0.5.0) is Standard or SearchOnly; it is null or absent for the demo data and older
snapshots.
A snapshot contains your tenant's configuration (names, addresses, conditions). Store and share it accordingly.
You need Windows and the .NET SDK (8 or later; it builds the .NET Framework project without Visual Studio).
Building the setups also needs Inno Setup 6 (winget install JRSoftware.InnoSetup).
.\build.ps1 # Release build + all tests
.\build.ps1 -Package # also artifacts\PurviewExplorer-<version>-win-x64.zip and -win-arm64.zip
.\build.ps1 -Setup # also artifacts\PurviewExplorer-<version>-win-x64-setup.exe and -win-arm64-setup.exe
.\build.ps1 -Setup -Arch x64 # only one architecture
.\installer\test-setup.ps1 -Setup .\artifacts\PurviewExplorer-<version>-win-x64-setup.exe # install, check, uninstallThe released executables are built per architecture: x64 targets .NET Framework 4.8 and ARM64 targets .NET
Framework 4.8.1, the first version that runs natively on Arm64. build.ps1 checks that each executable is built
for the processor it claims. The tests use the AnyCPU build.
The version comes from the VERSION file. The tests include an integration test that loads
ExchangeOnlineManagement in the hosted runspace (when the module is installed), one that exercises the
Connect-IPPSSession error path without network access, and one that runs /SelfTest, which drives every tab,
collection, properties dialog, filter and snapshot round trip. CI installs the module so all of them run.
CI also tests the setups: the x64 setup on the build machine, where the module is installed, and each setup on a clean runner of its own architecture (Windows Server on x64, Windows 11 on Arm64) from which the module, PowerShellGet 2 and the NuGet provider have been removed, like a freshly installed Windows. There the setup must install the module from the PowerShell Gallery and confirm that Purview Explorer loads it.
| Script | Purpose |
|---|---|
installer\PurviewExplorer.iss |
The Inno Setup script: requirement checks, module installation, verification |
installer\test-setup.ps1 |
Installs silently, checks files, shortcut, uninstall entry, checks and verification, then uninstalls |
installer\make-runner-clean.ps1 |
Strips a CI runner down to what a freshly installed Windows has |
assets\make-assets.ps1 |
Draws the icon, README logos and setup wizard images from the Sarda Cloud logo |
tools\make-demo.ps1 |
Regenerates the fictional demo snapshot (pwsh) |
See CONTRIBUTING.md for how to add a collection and the rules of the house.
Please report vulnerabilities privately; see SECURITY.md.
Purview Explorer is released under the MIT License.
The Sarda Cloud name and logo are trademarks of Sarda Cloud Srl and are not licensed under the MIT License. Microsoft, Microsoft Purview, Windows and PowerShell are trademarks of the Microsoft group of companies. Purview Explorer is an independent community tool and is not affiliated with or endorsed by Microsoft. The demo data describes a fictional company; any resemblance to a real organization is coincidental.
Purview Explorer was called Purview Configuration Viewer in its first release (0.1.0). The setup is built with Inno Setup; see THIRD-PARTY-NOTICES.md.
A Sarda Cloud Community project. Copyright (C) 2026 Francesco Valerio Buccoli.