Forum Discussion

Copper Contributor

Jul 24, 2025

Solved

Accessing Content explorer data via SPN

Hi all, I am trying to get all the data from Content explorer for SITs matched files using https://learn.microsoft.com/en-us/powershell/module/exchange/export-contentexplorerdata?view=exchange-ps. I ...

Content explorer

powershell

Sensitive Info Type

VasilMichev
Jul 30, 2025
IIRC application permissions are not supported for the cmdlet, but you assign role groups to a service principal via PowerShell:

Add-RoleGroupMember -Identity "ContentExplorerContentViewer" -Member xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Make sure to provision the SP first via New-ServicePrincipal. But again, afaik even if you grant the permissions, it is not currently supported.

VasilMichev

MVP

Jul 30, 2025

IIRC application permissions are not supported for the cmdlet, but you assign role groups to a service principal via PowerShell:

Add-RoleGroupMember -Identity "ContentExplorerContentViewer" -Member xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Make sure to provision the SP first via New-ServicePrincipal. But again, afaik even if you grant the permissions, it is not currently supported.

mrityunjay6492

Copper Contributor

Sep 12, 2025

Although I was not able to add "Content Explorer List Viewer" role group to the SPN But I was able to add "Information Protection Investigators" which included similar role as of "Content Explorer List Viewer". With the latest version 3.8 of ExchangeOnlineManagement this functinalty seems to be working.

Added SPN to Microsoft Purview via this CMD
New-ServicePrincipal -AppId $<VariableName1>.AppId -ObjectId $<VariableName1>.Id -DisplayName "<Descriptive Name>"