Question

Contoso deploys the Microsoft Purview Information Protection scanner to discover and label sensitive files on several on-premises Windows file servers. The security team wants the scanner to run unattended, apply sensitivity labels automatically, and access all target file shares without interactive sign-in. When configuring the scanner service account, which requirement must be met for the scanner to function correctly?

Accepted Answer

The service account must have the Log on as a service right, read/write access to the target file shares, and be synchronized to Microsoft Entra ID for token acquisition.

Answer

The service account must be a member of the Global Administrator role in Microsoft Entra ID and have Log on interactively rights on the scanner server.

Answer

The service account must be a local guest account on each file server and use certificate-based authentication only.

Answer

The service account must be assigned the Compliance Data Administrator role and authenticate exclusively with a personal access token entered at each scan.