Topic 1 of 6
Trust, privacy, and Compliance Manager
Where an auditor gets Microsoft's reports, what Microsoft promises about your data, and how an organization measures its compliance progress. It's the entry point to the compliance domain.
Contents
Why compliance is hard
A modern organization keeps data in Microsoft 365, in other clouds, on on-premises servers, and, increasingly, in conversations with AI apps. At the same time, it has to meet changing regulations (GDPR, HIPAA, ISO, AI standards) and answer to auditors, customers, and regulators.
Scattered data
Email, files, chats, databases, and SaaS apps: it's hard to know where sensitive information lives.
Changing regulations
Each industry and country adds requirements, and translating them into technical controls takes time.
Trust in the provider
If data is in the cloud, you have to show that the provider also does its part.
This article covers Microsoft's three answers to that challenge: the Service Trust Portal (what Microsoft proves), its privacy principles (what Microsoft promises), and Microsoft Purview with Compliance Manager (what you manage). The other D4 articles cover the rest of Purview.
Service Trust Portal (STP)
Microsoft's public site for publishing audit reports and other compliance information about its cloud services. You can download reports from external auditors and whitepapers on how Microsoft protects your data.
Some resources require signing in with a Microsoft Entra organizational account.
Certifications, Regulations, and Standards
Implementation and design information by framework, for example ISO/IEC documents.
Reports, Whitepapers, and Artifacts
Business continuity and disaster recovery, penetration tests, privacy and data protection, FAQs.
Industry and Regional Resources
Financial services, healthcare, media, US government, and regional regulations.
Resources for your Organization
Documents restricted by tenant based on your subscription and permissions.
My Library keeps documents in one place and sends email notifications when Microsoft updates them.
What it's for in practice
Under the shared responsibility model, Microsoft is responsible for part of the controls. The STP is where the organization gets proof that Microsoft meets them, for example a SOC 2 report or an ISO 27001 certification, to hand to its own auditor.
Microsoft privacy principles
Microsoft's commitment, backed by contracts and described in the Trust Center, covers four areas:
You control your data
You can access, modify, or delete your data. Microsoft doesn't use it without your agreement, share it with ad-supported services, or mine it for marketing. It complies with ISO/IEC 27018, the first international code of practice for cloud privacy.
You know where your data is
You choose the location in Azure, Dynamics 365, and Microsoft 365, with residency options around the world.
Data secured at rest and in transit
Encryption up to AES-256 at rest, TLS and IPsec in transit, and Azure Key Vault to control keys and secrets.
Microsoft defends your data
Government requests should be directed to you. Microsoft gives no government direct access, notifies you where the law allows, and challenges in court the requests it can lawfully challenge.
The Microsoft Purview portal
Microsoft Purview is Microsoft's family of data security, data governance, and compliance solutions. It helps you know, protect, and govern data wherever it lives: Microsoft 365, other clouds, on-premises servers, and AI apps.
Its unified portal organizes the solutions by area:
Core
Audit, Data Map, Settings, and Workflows.
Risk & Compliance
Communication Compliance, Compliance Manager, eDiscovery, Information Barriers, and Records Management.
Data Governance
Data Catalog, Data Lifecycle Management, and Data Policy.
Data Security
Data Loss Prevention, Information Protection, and Insider Risk Management.
Compliance Manager
It automatically assesses and manages compliance across a multicloud environment, not just Microsoft 365. It helps identify risks, implement controls, keep up with regulations, and report to auditors.
- Prebuilt assessments by regulation and standard, plus custom assessments
- Workflows to complete risk assessments
- Step-by-step improvement actions; Microsoft manages some of them
- Compliance score to measure progress
Benefits: translates complex regulations into simple language, maps controls to improvement actions, and prioritizes by impact on the score.
Controls, assessments, and actions
Controls
A requirement of a regulation, standard, or policy. Compliance Manager assesses them by continuously scanning your Microsoft 365 environment.
Microsoft-managed
Microsoft implements them for its cloud services
Your controls
The organization implements and manages them
Shared
Responsibility of both the organization and Microsoft
Assessments
A grouping of controls from a specific regulation, for example ISO 27001. It includes in-scope services, the three control types, and a score. They're created from templates.
Regulations
More than 360 regulatory templates, including templates for AI regulations and standards.
Improvement actions
Recommended guidance assigned to users for implementation and testing, with documentation, notes, and status.
How you work with Compliance Manager
Pick a template: For example, ISO 27001 or GDPR, among the more than 360 available.
Create the assessment: The controls for that regulation are grouped for the services in scope.
Review the controls: Microsoft-managed ones already show their points; yours and the shared ones remain.
Implement improvement actions: They're assigned to people, who implement them, test them, and attach documentation.
Track the score: Actions that Compliance Manager checks automatically update their status within 24 hours.
Compliance score
It measures progress on improvement actions: your points plus Microsoft-managed points. The initial score is based on the Microsoft 365 data protection baseline assessment, which draws on NIST CSF, ISO, FedRAMP, and GDPR.
| Action type | Mandatory | Discretionary |
|---|---|---|
| Preventive | 27 | 9 |
| Detective | 3 | 1 |
| Corrective | 3 | 1 |
Mandatory vs. discretionary
Mandatory: can't be bypassed (a central password policy). Discretionary: relies on the user complying (locking the computer when leaving).
Preventive, detective, corrective
Preventive: encryption, separation of duties. Detective: access auditing. Corrective: privacy incident response.
Important
Compliance Manager recommendations don't guarantee compliance. The organization has to validate the effectiveness of its controls for its regulatory environment.
| Compliance score | Microsoft Secure Score | |
|---|---|---|
| Measures | Progress against regulations and standards | Security posture against threats |
| Where | Microsoft Purview (Compliance Manager) | Microsoft Defender portal |
| Improved with | Improvement actions | Security recommendations |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| An auditor asks for Microsoft 365's ISO 27001 report | Service Trust Portal | It publishes Microsoft's audit reports. |
| Get notified when Microsoft updates a compliance document | My Library (STP) | It saves documents and notifies on changes. |
| Measure the organization's progress against GDPR | Compliance Manager | An assessment from a GDPR template. |
| Assign an admin the task of enabling MFA to meet a control | Improvement action | It's assigned, implemented, tested, and documented. |
| Know which part of compliance Microsoft already covers | Microsoft-managed controls | They add points with no work on your side. |
| Assess compliance of AWS resources in addition to Microsoft 365 | Compliance Manager (multicloud) | It isn't limited to Microsoft 365. |
| Learn how Microsoft responds to government data requests | Privacy principles (defending your data) | It redirects the request to the customer. |
| Measure technical security posture against threats | Microsoft Secure Score (not Compliance Manager) | Security, not regulatory compliance. |
Common exam traps
❓ An auditor needs Microsoft 365's SOC 2 report. Where do they get it?
In the Service Trust Portal. Compliance Manager assesses your own compliance; it doesn't publish Microsoft's audit reports.
❓ Which action earns the most points in the compliance score?
A mandatory preventive one (27 points). Mandatory detective and corrective actions are worth 3.
❓ A 100% compliance score means the organization complies with the regulation. True?
False. The score measures progress on improvement actions; it isn't a guarantee of compliance.
❓ Does Microsoft use enterprise customer data for advertising?
No. It doesn't share it with ad-supported services or mine it for marketing or advertising.
❓ Does Compliance Manager only assess Microsoft 365?
No. It's multicloud: it also assesses other services and clouds.
❓ Do you need to sign in for all Service Trust Portal content?
No. Part of it is public; some documents require a Microsoft Entra organizational account.
❓ Are discretionary and shared the same concept?
No. Mandatory/discretionary classifies actions; Microsoft-managed/yours/shared classifies controls.
Did you get this topic?
Test what you just learned
In Compliance Manager, how is a control classified when both the organization and Microsoft are responsible for implementing it?
Ready to test "Trust, privacy, and Compliance Manager"?
Original questions, each with a full explanation.
Start a mock exam