Purview MSIP Scanner - CPU Throttling Setting Not Working (ScannerMaxCPU)

Question

Purview MSIP Scanner - CPU Throttling Setting Not Working (ScannerMaxCPU)

Nick Burke 0

Hello,

We are experiencing consistently high CPU utilization from the Microsoft Purview Information Protection Scanner. The MSIP scanner and SQL DB are running on the same Windows Server 2022 Datacenter Edition

To reduce CPU usage, we configured the following advanced settings on our label policy:

Set-LabelPolicy -Identity "Default" -AdvancedSettings @{ScannerMaxCPU="50"}
Set-LabelPolicy -Identity "Default" -AdvancedSettings @{ScannerMinCPU="35"}

The settings appear to have been successfully applied to the label policy, and we have verified that they are present in the policy configuration. Please note we only have one label policy in the entire env, and it is the default one.

Additionally, the output from Get-ScannerConfiguration shows among other things:

OnlineConfiguration : On
ReportLevel: Info
Cloud: Commercial

The output from (Get-LabelPolicy -Identity "Default").settings shows among other settings:

[scannermaxcpu, 50]
[scannermincpu, 35]

Despite setting ScannerMaxCPU to 50 and ScannerMinCPU to 35, the scanner continues to spike CPU utilization well above the configured threshold. We have tried rebooting the server as well and there is nothing configured for ScannerConcurrencyLevel that I can see.

Could you please advise on the following:

Is this not the correct way to limit CPU on a MSIP scanner server?
How can we verify that the scanner has downloaded and is actively using the updated label policy?
Is there a scanner log or diagnostic that shows the effective values for ScannerMaxCPU, ScannerMinCPU, and ScannerConcurrencyLevel?
Are there any known issues or prerequisites that would prevent ScannerMaxCPU from being enforced?

At this point, our primary concern is understanding why the scanner continues to exceed the configured CPU limit despite the policy changes.

Thank you.

Kowalewski, Julius 0 Reputation points

2026-08-28T18:52:19.19+00:00

Hi Nick- You not alone, we are having the same issue, we implemented the Min/Max CPU settings two years ago hoping it would help with the scanners performance issues, like going offline in Purview, crashing MIPScanner service/process, bricking our entire VM but these settings are absolutely not effective. We were told these just work as 'best effort' We have been working with Microsoft Support/PG for the some time on these performance issues but nothing is really being done about it. We either hearing that the product is working as designed or to apply workarounds like excluding shares or subfolders from the scan (which ironically, MPIPScanner doesn't support excluding subfolders)

1 answer

Your answer

Kowalewski, Julius 0 Reputation points

2026-08-28T18:52:19.19+00:00

Hi Nick- You not alone, we are having the same issue, we implemented the Min/Max CPU settings two years ago hoping it would help with the scanners performance issues, like going offline in Purview, crashing MIPScanner service/process, bricking our entire VM but these settings are absolutely not effective. We were told these just work as 'best effort' We have been working with Microsoft Support/PG for the some time on these performance issues but nothing is really being done about it. We either hearing that the product is working as designed or to apply workarounds like excluding shares or subfolders from the scan (which ironically, MPIPScanner doesn't support excluding subfolders)

Answer 1

Ganesh Chelluri 190 Microsoft External Staff Moderator

Hi @Nick Burke ,

ScannerMaxCPU / ScannerMinCPU aren't instant hard caps they are a 30-minute rolling-average throttle. The scanner watches average CPU over the last 30 min and adjusts thread count for new files. Short spikes above 50 are expected by design.

Quick checks to unblock this:

Confirm ScannerConcurrencyLevel isn't set (if present, it overrides Max/Min): (Get-LabelPolicy -Identity "Default").settings | ? { $_ -like "Concurrency" }

Verify the scanner pulled the latest policy: Start-ScannerDiagnostics -Verbose (use -OnBehalf if not running as the scanner service account)

Confirm the local policy file exists: %localappdata%\Microsoft\MSIP\mip\MSIP.Scanner.exe\mip\mip.policies.sqlite3

If, measured over the 30-min average, CPU still stays high and you need a hard cap, set ScannerConcurrencyLevel to about 2 threads per core it acts as a thread ceiling.

Also worth flagging: MSIP Scanner and the SQL DB are on the same box, so SQL is likely driving part of the CPU too. Best long-term move is to split them, or hard-cap threads via ScannerConcurrencyLevel.

Refs

Advanced settings: https://learn.microsoft.com/powershell/exchange/client-advanced-settings

Optimize scanner performance: https://learn.microsoft.com/purview/deploy-scanner-configure-install#optimize-scanner-performance

Nick Burke 0 Reputation points

2026-07-21T16:55:18.5566667+00:00
Hi Ganesh,

Thank you for the help, but the problem is still happening. To me it seems that these advanced label settings are not actually affecting the behavior of the MSIP scanner, but I'm unsure why or what the alternative would be. I understand I can increase resources or move the SQL database to a different server, but I would like to figure out why these settings are not having any affect on the MSIP scanner. Here are my responses to your potential solutions:

Confirm ScannerConcurrencyLevel isn't set (if present, it overrides Max/Min): (Get-LabelPolicy -Identity "Default").settings | ? { $_ -like "Concurrency" }

No setting for concurrency was present

Verify the scanner pulled the latest policy: Start-ScannerDiagnostics -Verbose (use -OnBehalf if not running as the scanner service account)

Connectivity check for: https://login.windows.net/common completed successfully

Connectivity check for: https://dataservice.protection.outlook.com completed successfully

Connectivity check for: https://api.aadrm.com/ completed successfully

Database check completed successfully

Authentication check completed successfully

Content scan job check completed successfully

Configuration check completed successfully

Confirm the local policy file exists: %localappdata%\Microsoft\MSIP\mip\MSIP.Scanner.exe\mip\mip.policies.sqlite3

I confirmed the file exists

If, measured over the 30-min average, CPU still stays high and you need a hard cap, set ScannerConcurrencyLevel to about 2 threads per core it acts as a thread ceiling.

I set concurrency to 8 since there were 4 cores, nothing has changed. (refer to attached image)

Also, the CPU average is around 80%, so even when set to 50 there should have been a difference noticed with the MaxCPU setting. To me it seems these settings are not doing anything.

Please let me know what else can be done here, thank you!
Pilladi Padma Sai Manisha 11,705 Reputation points Microsoft External Staff Moderator

2026-07-21T19:54:28.86+00:00
Hi @Nick Burke

Thank you for performing those checks and for sharing the results. Based on the information you've provided:

ScannerConcurrencyLevel is configured and does not appear to change the scanner's CPU utilization.

Start-ScannerDiagnostics completed successfully, indicating the scanner can communicate with the service and the configuration validation passed.

The local policy cache exists, suggesting the policy has been downloaded successfully.

CPU utilization remains consistently around 80%, which exceeds the configured ScannerMaxCPU threshold even over an extended period rather than only during short spikes.

Given these results, it does appear that the scanner is not behaving as expected. At this stage, there isn't any additional documented troubleshooting available to verify whether the scanner is actually applying the effective values for ScannerMaxCPU, ScannerMinCPU, and ScannerConcurrencyLevel internally.

To investigate further, could you please provide the following information?

Microsoft Purview Information Protection Scanner version.

Microsoft Information Protection client version installed on the scanner server.

Whether the issue occurs with a single repository or across all configured repositories.

The scanner logs from %localappdata%\Microsoft\MSIP\Logs (or the equivalent scanner log location), captured while the high CPU utilization is occurring.

With that information, we can determine whether this is a configuration issue or whether the scanner is failing to honor the advanced policy settings, which may require further investigation.
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-07-23T19:24:06.1+00:00
Hi @Nick Burke ,

Just following up on the details Manisha requested so we can take this

further. Whenever you get a chance, could you share:

Microsoft Purview Information Protection Scanner version

Microsoft Information Protection (MIP) client version on the scanner server

Whether the high CPU happens with one repository or across all configured repositories

The scanner logs from %localappdata%\Microsoft\MSIP\Logs, captured while the CPU is spiking

With those in hand we can confirm whether the scanner is genuinely not honoring

the ScannerMaxCPU / ScannerMinCPU / ScannerConcurrencyLevel values, and line up

the right next step for you.

Appreciate your patience on this one happy to keep digging until it's sorted.