7.1 Plan and Implement the Microsoft Purview Information Protection Client
Key Takeaways
- The Microsoft Purview Information Protection client is a Windows package—File Labeler, Viewer, PurviewInformationProtection PowerShell, and the on-premises scanner—that replaced the Azure Information Protection unified labeling client and ships without an Office add-in.
- Built-in sensitivity labels in subscription Office cover Word, Excel, PowerPoint, and Outlook; plan the Purview client when you need File Explorer labeling, scripted PowerShell labeling, the encrypted-file viewer, or the on-premises scanner.
- ARM64 supports the viewer and File Labeler only; the scanner and PowerShell module are not supported on ARM64, and a scanner server requires the full client rather than a PowerShell-only install.
- Each generally available Windows client version is supported for one year after release; client 3.2.92.0 (11 June 2026) is supported through 11 June 2027.
- Cached policy XML on disconnected computers works only for labels that do not apply encryption, because applying encryption requires an active internet connection.
Why this client exists on SC-401
Microsoft Purview Information Protection is the current name for the labeling and protection stack that used to be branded Microsoft Information Protection and, before that, Azure Information Protection (AIP). The Microsoft Purview Information Protection client is the Windows package that extends sensitivity labels beyond the labels already built into Microsoft 365 apps and services.
On the exam, plan and implement the Microsoft Purview Information Protection client is not a request to put a COM add-in back into Word. Microsoft retired the AIP Office add-in. Subscription Office—Microsoft 365 Apps for enterprise and other supported subscription builds—applies and displays sensitivity labels with built-in labeling. The client exists for the surfaces Office does not cover: File Explorer, Windows PowerShell, the on-premises scanner, and a viewer for encrypted files.
Microsoft documents the client as the replacement for the AIP unified labeling client. Use the Purview name in portal clicks and in answers. Classic AIP strings still appear in a few setup-log file names, old cmdlet aliases, and 2.x-to-3.x upgrade articles. A 3.x install removes the AIP add-in from the package.
The Windows package: four components
Download the Windows client from the Microsoft Download Center (package id 53018). The generally available Windows installer bundles four components:
| Component | Role |
|---|---|
| Information protection file labeler | Apply or change sensitivity labels and encryption from File Explorer using Apply sensitivity label with Microsoft Purview. |
| Information protection viewer | Open encrypted files, including many non-Office formats the associated application cannot decrypt by itself. |
| PurviewInformationProtection PowerShell module | Inspect, set, autolabel, and remove labels on files; install and configure the scanner. |
| Information protection scanner | Discover, classify, and protect files on on-premises data stores such as network shares and SharePoint Server libraries. |
There is no Office add-in in this client. If the scenario is analysts applying Confidential inside Word on a Microsoft 365 Apps PC, the answer is built-in Office labeling plus a published label policy—not this installer. If the scenario is labeling thousands of PDFs on a file server, right-clicking a folder of exports, crawling \\finance\shares, or opening a protected .ptxt file, you need the client.
When you need the client versus built-in Office labeling
Plan a client deployment when at least one of the following is true:
- Users must label files that never open in Word, Excel, PowerPoint, or Outlook: PDFs, images,
.txt,.csv, vendor exports, or files that will use generic.pfileencryption. - Administrators must script labeling with
Set-FileLabel,Get-FileStatus, andRemove-FileLabel. - You will deploy the on-premises scanner. The scanner is installed from this same client. A PowerShell-only install is not sufficient on a scanner server.
- Users need the viewer for encrypted text and image files.
- You still have AIP 2.x machines that must move to 3.x so File Explorer, PowerShell, and the scanner keep working after the Office add-in retirement.
Do not treat the client as a substitute for creating and publishing sensitivity labels. Labels and label policies are authored in the Microsoft Purview portal. The client only consumes published labels. A workstation with the client installed and no label policy published to that user is a labeling UI with nothing to show.
Cloud auto-labeling for SharePoint Online and OneDrive, Defender for Cloud Apps file policies, and Purview Data Map labeling are separate control planes. They do not replace the Windows client for File Explorer or for on-premises SMB libraries.
Operating systems, ARM64, and VDI
The client documentation currently lists these operating systems for the Windows client:
- Windows 11, including Windows 11 Enterprise multi-session
- Windows 10 (x64) (handwriting is not supported in Windows 10 RS4 and later)
- Windows Server 2019
- Windows Server 2016
ARM64 is supported for the viewer and file labeler only. The scanner and PowerShell are not supported on ARM64. That is a planning trap: a Windows on ARM laptop pool can get File Labeler, but you cannot place the scanner service or the PurviewInformationProtection module on those devices.
The scanner's own prerequisite page is the source for production scanner nodes: 64-bit Windows Server 2025, 2022, 2019, or 2016. Server Core and Nano Server are not supported. For a non-production evaluation, Microsoft allows any operating system the client supports.
If you use virtual desktops, check the VDI publisher. Citrix environments, for example, may need Citrix API hooks disabled for Office and for the information protection client. Do not assume a golden image that works on physical Windows 11 will behave the same on a multi-session host.
Install, upgrade, and the one-year GA lifecycle
There are two Windows installers: PurviewInfoProtection.exe and PurviewInfoProtection.msi. Preview builds are for testing, not for production end users.
- Default interactive install: run the
.exe. - Silent full client:
PurviewInfoProtection.exe /quiet. - Silent module only:
PurviewInfoProtection.exe PowerShellOnly=true /quiet.
PowerShellOnly=true is appropriate on an administrator jump box. It is the wrong install on a scanner server. Microsoft states you must install the full client for the scanner.
Restart File Explorer when the installer finishes. The setup log is still named with a historic Microsoft_Azure_Information_Protection_*_MSIP.Setup.Main.msi.log pattern under %temp%. Search the log for Product: Microsoft Purview Information Protection--Installation completed successfully. You can redirect the log with /log. Telemetry is on by default; set AllowTelemetry=0 at install or EnableTelemetry=0 in the registry afterward if policy requires it.
The PowerShell module name is PurviewInformationProtection (formerly AzureInformationProtection). It requires Windows PowerShell 4.0. The module lands under Program Files (x86)\PurviewInformationProtection. Version 3.0 created aliases for most classic cmdlet names, with important exceptions around Set-FileLabel and Set-FileLabel -Autolabel. Scanner service names also changed in 3.x; upgrades from client 2.x must follow Microsoft's scanner migration steps (including Update-ScannerDatabase) or the deployment can fail.
Each generally available Windows client version is supported for one year after its release date. Fixes are applied to the latest GA only, not backported to every older GA. As of the 11 June 2026 release, 3.2.92.0 is supported through 11 June 2027. 3.2.57.0 (26 March 2026) is supported through 26 March 2027. 3.1.310.0 (30 June 2025) is supported through 30 June 2026. Do not invent a five-year desktop-OS-style lifecycle.
After a typical delay of about four weeks, the latest GA also appears in the Microsoft Update Catalog under product Microsoft Purview Information Protection Client, classification Updates, so you can deploy with WSUS or Configuration Manager. The first Microsoft Update upgrade from an AIP client to 3.x requires a registry acknowledgement that the Office add-in is removed.
A macOS client (preview) exists as two separate apps—File Labeler and File Viewer—and only on Apple silicon (M1 and later). It is not the Windows scanner package. Do not plan production scanner nodes on Mac.
Identity, disconnected machines, and Endpoint DLP
The client downloads labels and policies from Microsoft Purview over the internet. For computers that cannot stay online, Microsoft documents a manual export: sign in a connected computer as a chosen Entra ID account, export client logs (File Labeler Export Logs or Export-DebugLogs), copy the .xml files from the MSIP folder, and paste them into %localappdata%\Microsoft\MSIP on the disconnected machine. Turn off audit upload for that download account with the EnableAudit advanced setting if you do not want that account's name appearing in Purview.
Two limits matter on the exam. Applying encryption requires an active internet connection, so the disconnected workaround is supported only for labels that do not apply encryption. Reset Settings in File Labeler deletes the cached policy files and leaves the client inoperable until you restore them or the device can download policy again.
License the features you actually use from the Microsoft Purview service description. Microsoft does not publish a single SKU on the client page. The scanner service account itself must be licensed for information protection capabilities.
Endpoint DLP's Advanced label-based protection for all files on devices changes how some non-Office/PDF files behave on a managed endpoint (encryption at egress so the local extension does not change). That is an Endpoint DLP setting, not a reason to skip the client, and it does not label files on network paths or USB drives.
Planning sequence to memorize
- Create and publish sensitivity labels to the people—and the scanner account—who will apply them.
- Decide which Windows endpoints need File Labeler and Viewer versus which servers need the full client plus scanner.
- Exclude ARM64 from scanner and PowerShell targeting.
- Use PowerShell-only installs only on scripting boxes.
- Budget the 3.x upgrade from AIP, including the Office add-in removal acknowledgement for silent/Microsoft Update installs.
- Stay on a supported GA (one-year lifecycle) and treat preview packages as lab-only.
Analysts must apply sensitivity labels to Word documents in Microsoft 365 Apps for enterprise. A file-server team must also classify PDFs that live on an on-premises SMB share. What should you plan?
You are targeting Microsoft Purview Information Protection client components to Windows devices. Which statement matches current Microsoft Learn guidance?
You upgrade laptops from the Azure Information Protection unified labeling client to Microsoft Purview Information Protection client 3.x. What should you expect?