Microsoft Purview Information Protection scanner: install, scan jobs and fixing errors

The Microsoft Purview Information Protection scanner (formerly the Azure Information Protection unified labeling scanner) discovers, labels and protects files on on-premises file shares and SharePoint Server. It has more moving parts than most Purview features: a Windows service, a SQL Server database, an Active Directory service account, a Microsoft Entra app and a cluster defined in the portal. In this post I'll walk through a clean install and match each error Microsoft documents to the part that's broken.

Symptoms#

The scanner service is installed but nothing gets scanned or labeled, and one of these messages appears in the scanner log (%localappdata%\Microsoft\MSIP\Logs of the service account), in the output of Start-ScannerDiagnostics, or on the scanner's Nodes page in the admin portal:

Microsoft.InformationProtection.Exceptions.AccessDeniedException: The service didn't accept the auth token.
NoAuthTokenException: Client application failed to provide authentication token for HTTP request
Policy is missing
Policy does not include any automatic labeling condition
DB schema is not up to date. Run Update-ScannerDatabase command to update the DB schema
System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.
Unable to connect to the remote server ---> System.Net.Sockets.SocketException: Only one usage of each socket address (protocol/network address/port) is normally permitted
No content scan job found
No repositories are configured
No cluster found

Other signs: the Scan now button is missing for a content scan job (it only appears when a node for that job is online), or a scan sits on one file for a long time and then stops.

Why it happens#

• Authentication. The service runs unattended, so it needs a token created with Set-Authentication for the service account. A missing token, an Entra app without the right permissions or admin consent, or an expired client secret all end in the token errors.
• Policy. The scanner uses the label policy of the account you name in -DelegatedUser, so at least one sensitivity label must be published to it, and the downloaded policy file must be readable. If the labels have no auto-labeling conditions and the job has no default label, the scanner has nothing to apply.
• Database. The service account needs db_owner on the configuration database, and the schema must match the installed scanner version.
• Configuration mismatch. The cluster name you pass to Install-Scanner must match a cluster in the portal, and its content scan job needs at least one repository.
• Network. The "underlying connection was closed" family means TLS 1.2 isn't enabled. The socket error means the scanner exceeded the number of allowed network connections.

How to fix it#

1. Check the prerequisites#

• 64-bit Windows Server 2016, 2019, 2022 or 2025 (Server Core and Nano Server aren't supported), 4 cores, 8 GB RAM and about 10 GB free disk space for temporary files.
• The full Microsoft Purview Information Protection client, not just its PowerShell module.
• SQL Server 2016 or later (Express for test environments only) with case-insensitive collation. The installing account needs the Sysadmin role so setup can create the database (AIPScannerUL_<cluster name>) and grant the service account db_owner; if that's not allowed, a DBA can create it manually.
• A service account that is an Active Directory account synchronized to Microsoft Entra ID, with Log on locally during installation and configuration. Setup grants Log on as a service itself.
• Repository permissions: Read is enough for discovery; labeling needs Read, Write and Modify on file shares, or Full Control on SharePoint Server.
• Outbound HTTPS to the documented URLs, including *.aadrm.com, *.azurerms.com, *.informationprotection.azure.com and *.protection.outlook.com.

2. Create the cluster and a content scan job#

In the Microsoft Purview portal, open Settings › Information Protection › Information protection scanner. On Clusters, add a cluster (for example Europe). On Content scan jobs, add a job with Schedule set to Manual, Info types to be discovered set to Policy only and Enforce sensitivity labeling policy set to Off. Open the saved job and add repositories on its Repositories tab as UNC paths (\\Server\Folder) or SharePoint Server URLs. OneDrive locations, WebDAV paths and wildcards aren't supported.

3. Install the service with the matching cluster name#

# Elevated PowerShell on the scanner server
Install-Scanner -SqlServerInstance SQLSERVER1\SCANNER -Cluster Europe
# When prompted, enter the service account as DOMAIN\username (not a UPN)

Microsoft warns that a UPN at that prompt can cause identity and service-startup problems later. If the Nodes page reports No cluster found, compare the -Cluster value with the portal for typos.

4. Register the Entra app and get a token#

Register an app (for example InformationProtectionScanner) and create a client secret. Under API permissions, add the application permissions Content.DelegatedReader and Content.DelegatedWriter from Azure Rights Management Service and UnifiedPolicy.Tenant.Read from Microsoft Information Protection Sync Service, then select Grant admin consent. Create the token for the service account:

$pscreds = Get-Credential CONTOSO\scanner
Set-Authentication -AppId "<application id>" -AppSecret "<client secret>" -TenantId "<tenant id>" `
    -DelegatedUser scanner@contoso.com -OnBehalfOf $pscreds

Success ends with Acquired application access token on behalf of CONTOSO\scanner. The token is valid as long as the client secret, so rerun the command with a new secret before the old one expires. Certificate-based authentication is in public preview; if it fails with Keyset does not exist, the service account can't read the certificate's private key, or the certificate was created with a CNG provider.

5. Clear policy, database and network errors#

• Policy is missing: publish at least one sensitivity label to the -DelegatedUser account, then check that %localappdata%\Microsoft\MSIP\mip\MSIP.Scanner.exe\mip\mip.policies.sqlite3 exists for the service account. Start-ScannerDiagnostics -ResetConfig refreshes the policy even if the last refresh was recent.
• No automatic labeling condition: add auto-labeling conditions to your labels, or set Info types to be discovered to All and define a default label in the job.
• DB error or schema mismatch: check connectivity and db_owner for the service account, then run Update-ScannerDatabase.
• Connection closed: enable TLS 1.2 on the scanner server.
• Socket error or a stuck scan: increase the dynamic port range on the server that hosts the files, and for large SharePoint libraries review the list view threshold (5,000 by default). Run Export-DebugLogs before you restart the service.
• No content scan job found / No repositories are configured: finish the job in the portal and add at least one repository.
• Turn on Enable DLP rules only if a DLP policy exists; without one, the scanner generates errors.

6. Move from discovery to enforcement#

Run the first cycle in discovery mode and review the reports in %localappdata%\Microsoft\MSIP\Scanner\Reports. When the results look right, edit the job: set Schedule to Always and Enforce sensitivity labeling policy to On, then select Scan now. If labels reprotect files or remove protection, make the service account a Rights Management super user (see the super user feature). By default the scanner protects only Office files and PDFs; the PFileSupportedExtensions advanced label policy setting changes that.

Verify the fix#

Start-ScannerDiagnostics -OnBehalfOf (Get-Credential CONTOSO\scanner) -Verbose
$s = Get-ScanStatus
$s.NodesInfo
$s.NodesInfo[0].Summary   # ScannedFiles, FailedFiles, Classified, Labeled

Healthy looks like this: the diagnostics checks (database, URLs, token and policy, configuration, rules) report no failures. Each node shows Scanning or completes its cycle, repositories move from Pending to Finished, FailedFiles stays at or near zero, and the detailed report lists the files you expected to be classified or labeled. In the portal, the node is online and Scan now is available.

Prevent it next time#

• Track the client secret's expiry date, or test certificate-based authentication.
• Run Update-ScannerDatabase as part of every scanner upgrade.
• Start every new repository in discovery mode. Changing auto-labeling conditions makes the scanner rescan all files, so plan those changes.
• Keep regular expressions efficient: the scanner times out on a file after 15 minutes. See custom sensitive information types.
• Related reading: rolling out sensitivity labels and sensitivity label and encryption errors.

References#

• Get started with the information protection scanner (Microsoft Learn)
• Configure and install the information protection scanner (Microsoft Learn)
• Resolve issues with information protection scanner deployment (Microsoft Learn)