Microsoft Purview with PowerShell 7: DLP Rollout, Audit Search and eDiscovery

I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is for Microsoft Purview. It uses PowerShell 7 and Connect-IPPSSession from ExchangeOnlineManagement v3.

Repo: purview-compliance-toolkit

The problem it solves

Compliance work is often slow and careful. You don't want to switch on DLP and block the whole company.

Audit log searches in the portal time out or cap results. eDiscovery setup has many clicks.

These scripts help you go step by step. They build on the Graph admin toolkit instead of copying it.

Highlight scripts

Set-DlpPolicyMode.ps1

Moves a DLP policy between simulation and enforcement. Start silent, then add notifications, then enforce.

./Set-DlpPolicyMode.ps1 -Name 'Contoso - U.S. Financial Data' -Mode TestWithNotifications -WhatIf

Search-AuditLogReport.ps1

Searches the unified audit log and pages through large results. It flattens them to CSV.

./Search-AuditLogReport.ps1 -Operations FileDownloaded -UserIds user1@contoso.com -StartDate (Get-Date).AddDays(-7)

New-EDiscoveryCaseSearch.ps1

Creates or reuses an eDiscovery case and adds a search scoped to mailboxes or sites.

Get-Help ./New-EDiscoveryCaseSearch.ps1 -Examples

Other scripts cover label and auto-label policy reports, DLP rule matches, retention labels, eDiscovery case reports and insider risk policies.

How the scripts are built

• PowerShell 7.4 or later.
• Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
• Reports export to CSV.
• Change scripts support -WhatIf and -Confirm.
• Certificate (app-only) or interactive sign-in.
• No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a dev or test tenant first. Read each script before you run it.

My usual workflow

I start with the reports. They are read-only and safe. I open the CSV in Excel and look for anything odd.

Then I pick one fix. I run the change script with -WhatIf and read the output. If it looks right, I run it again for real.

For jobs I repeat, I use a certificate and schedule the script. That way nobody has to remember to run it.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/purview-compliance-toolkit.git
cd purview-compliance-toolkit

Every toolkit ships the same Connect-M365Admin script. Dot-source it, then connect.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Purview -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
Connect-M365Admin -Service Purview

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have nine more free toolkits that use the same pattern: graph-powershell7-admin-toolkit, entra-id-powershell-toolkit, exchange-online-powershell-toolkit, sharepoint-online-powershell-toolkit, onedrive-powershell-toolkit, teams-powershell-toolkit, intune-powershell-toolkit, defender-xdr-powershell-toolkit, sentinel-kql-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.