How to Fix Microsoft Purview TOC Not Loading

Why the Microsoft Purview TOC Isn't Loading

You open the Microsoft Purview compliance portal at purview.microsoft.com, you log in successfully , and then nothing. The left-hand navigation panel is blank, spinning, or completely absent. You can't reach Data Loss Prevention, Sensitivity Labels, eDiscovery, Insider Risk Management, or any other section because the entire table of contents (TOC) sidebar has vanished. I've seen this exact issue on dozens of enterprise tenants, and I know how disorienting it is when your compliance work grinds to a halt.

The Microsoft Purview TOC not loading is one of those errors that Microsoft's portal gives you zero useful feedback on. No error code. No warning banner. Just an empty sidebar where your navigation should be. Sometimes you get the dreaded infinite spinner. Sometimes the page loads but the left nav shows only a thin grey strip. Either way, you're locked out of the tool you need.

Here's what's actually going on under the hood. The Purview portal is a single-page React application hosted across multiple Azure endpoints. The TOC component fetches its configuration from a background API call , typically to compliance.microsoft.com endpoints, and renders the navigation dynamically based on your assigned roles and active licenses. When that API call fails silently, or when the browser can't parse the returned JSON (often because of a cached malformed response), the TOC simply never renders.

The most common root causes I see in the field, in rough order of frequency:

• Stale browser cache or corrupted session tokens, the single most common culprit by a wide margin
• Missing or misconfigured RBAC role assignments in the Purview compliance portal, the TOC is dynamically scoped to your roles, so if your role assignment is broken, the TOC won't know what to render
• Insufficient or expired Microsoft 365 licensing, Purview features are tied to E3, E5, or specific add-on SKUs; a lapsed license silently kills navigation sections
• Conditional Access policies or Azure AD token failures, particularly on domain-joined devices where hybrid identity can cause token mismatch errors
• Network-level blocks on required Microsoft endpoints, corporate proxies, Zscaler, Netskope, or firewall rules that intercept TLS traffic to *.compliance.microsoft.com or *.purview.microsoft.com
• Browser extension interference, ad blockers, security extensions, or corporate endpoint agents injecting JavaScript into the portal
• Tenant-level service incidents, though less common, genuine Microsoft-side outages do happen and are worth ruling out first

The frustrating part is that none of these causes produce a helpful on-screen message. You have to work through them methodically. That's exactly what this guide does. Browse all Microsoft fix guides →

The Quick Fix, Try This First

Before you spend an hour digging through role assignments and Group Policy, try this. It resolves the Purview TOC not loading issue for roughly 60% of users who hit it.

Open a new InPrivate or Incognito window, press Ctrl+Shift+N in Edge or Chrome, then navigate directly to https://purview.microsoft.com and sign in fresh. If the TOC loads in the private window but not in your normal browser, the problem is definitively a corrupted session, cached token, or a browser extension. That's good news, it's entirely fixable on your end.

If the private window also fails, you're likely looking at a role assignment issue, a licensing gap, or a network-level block. Keep reading, the steps below cover all of it.

Assuming the private window worked, here's how you permanently fix your normal browser session:

1. Close all tabs running any Microsoft 365 or Purview URLs
2. Open Edge Settings → Privacy, search, and services → Clear browsing data
3. Set time range to All time, check Cookies and other site data, Cached images and files, and Site permissions
4. Click Clear now
5. In the address bar, go to edge://settings/content/cookies and verify that microsoft.com is not in the "Block" list
6. Reopen Purview and sign in

For Chrome, the equivalent path is Settings → Privacy and security → Clear browsing data → Advanced. Same checkboxes, same time range.

If you're on a corporate machine where IT has locked down cookie or cache clearing, you'll need to have your helpdesk do this, or jump straight to Step 3 in the detailed walkthrough below.

Advanced Troubleshooting

Analyzing Browser Console Errors

When the basic fixes don't work, the browser's developer console almost always tells you exactly what's failing. Open Purview, press F12 to open DevTools, click the Console tab, and reload the page. Look for red errors, particularly anything mentioning 401, 403, CORS, Failed to fetch, or specific API endpoint failures like https://compliance.microsoft.com/api/v1/navigation.

A 401 Unauthorized against the navigation API is a definitive sign of a token issue. A 403 Forbidden usually means role assignment is the problem. A CORS error or network failure points to proxy/firewall interference.

Checking Event Viewer for Azure AD Sign-In Failures

On domain-joined or hybrid Azure AD-joined machines, sign-in token failures are logged locally. Open Event Viewer (Win+R, type eventvwr.msc), navigate to Applications and Services Logs → Microsoft → Windows → AAD → Operational. Look for Event ID 1098 (token acquisition failure) or Event ID 1104 (silent sign-in failure). These events include the exact error code and AADSTS error number, for example, AADSTS50076 means MFA is required, and AADSTS700003 means your device isn't registered properly in Azure AD.

Conditional Access Policy Conflicts

If your organization uses Conditional Access (CA) policies, a policy targeting the Microsoft 365 Compliance application might be blocking token issuance or requiring a device compliance check that your machine fails. In the Azure AD admin center at entra.microsoft.com, go to Security → Conditional Access → Sign-in logs and filter by your user account and the last 24 hours. Look for any "Failure" entries targeting the Office 365 or Microsoft Purview cloud app. Each failure entry shows exactly which CA policy triggered and why.

Common CA-related Purview TOC failures include: device compliance requirement not met, trusted location requirement when working from home, and legacy authentication block applied too broadly.

Clearing the MSAL Token Cache via Registry

In persistent enterprise environments where browser cache clearing doesn't resolve stale tokens, you can clear the MSAL token cache stored in the Windows Credential Manager. Open Credential Manager from Control Panel, click Windows Credentials, and remove any entries starting with MicrosoftOffice16_Data or containing microsoftonline.com. Then run:

reg delete "HKCU\Software\Microsoft\Office\16.0\Common\Identity" /f
reg delete "HKCU\Software\Microsoft\Office\16.0\Common\Internet" /f

Restart your machine after this. These registry keys store cached authentication state for the Office/M365 suite, and stale entries here can conflict with fresh Purview portal token requests.

Tenant-Level Portal Reset via PowerShell

If the TOC is broken for multiple users in your tenant, not just one, the issue may be at the tenant configuration level. Run the following to check for any compliance portal configuration errors:

Connect-IPPSSession
Get-ComplianceTag | Select-Object -First 5
Get-DlpCompliancePolicy | Select-Object -First 5

If either of these commands returns errors about tenant provisioning or service endpoints, open a Microsoft support ticket immediately, this is a tenant-side configuration issue that requires Microsoft's backend team to resolve.

Prevention & Best Practices

Once you've fixed the Microsoft Purview TOC loading issue, you want to make sure you're not dealing with it again in a month. Here's what I recommend for keeping the Purview portal running reliably in enterprise environments.

Document your role group assignments. One of the most common reasons the TOC breaks after a routine admin change is that a role group membership was inadvertently removed during a user account modification. Keep a living spreadsheet of which accounts belong to which Purview role groups, and review it monthly. Even better, use Microsoft Entra ID Privileged Identity Management (PIM) to make Purview role assignments just-in-time and audited, this creates a natural log of every change.

Monitor your M365 license assignments proactively. Set up an alert in the Microsoft 365 admin center under Health → Message center for any licensing changes. When a renewal lapses or an admin removes an E5 license, you want to know within hours, not when a compliance officer can't open their Purview dashboard in the middle of an audit.

Maintain an endpoint allowlist for Purview. Work with your network team to create a standing bypass rule in your proxy for all *.purview.microsoft.com and *.compliance.microsoft.com endpoints. Microsoft publishes their IP and URL lists at aka.ms/o365endpoints, subscribe to the RSS feed for change notifications and sync those changes into your firewall ruleset within 30 days of any update.

Test Purview access monthly as part of your compliance operations runbook. Many teams only discover the portal is broken when they need it urgently. Add a 5-minute monthly check to your IT ops calendar, sign into Purview, verify the TOC loads, and verify you can navigate to your three most-used sections. Catching a degraded state early costs far less than scrambling to restore access during an active eDiscovery request or regulatory audit.

Keep browsers updated on compliance-team machines. Edge and Chrome ship fixes for authentication and rendering issues regularly. Most corporate environments use managed update policies, make sure Purview-heavy users (compliance officers, legal, information security) are in a "fast ring" or at least not blocking updates for more than 30 days.

Frequently Asked Questions