Microsoft Purview compliance portal and Compliance Manager

The payment processor's questionnaire had a second page, and it was harder. It asked how Harrow & Finch tracked its own controls against the card industry's requirements, who owned each one and when each had last been tested. Carmen Ortiz had the answers spread across a spreadsheet kept by the finance team, a folder of policies on SharePoint and Sunil Rao's memory. "This is the year we stop doing compliance in spreadsheets," she said at the next security hour, and she opened the Microsoft Purview portal on the meeting room screen.

Microsoft Purview and its portal

Microsoft Purview is Microsoft's family of solutions for data security, data governance and risk and compliance. MSAZ-102 met it from the governance side, where Purview maps and organizes data across Azure and other sources. This part of SC-900 concentrates on the compliance and data protection solutions: Compliance Manager in this lesson, data classification and sensitivity labels in lesson 9, data loss prevention in lesson 10, insider risk, eDiscovery and audit in lesson 11, and data lifecycle and records management in lesson 12.

The lesson title uses the name Microsoft Purview compliance portal, which is what the console was called when this course was planned. Microsoft has since retired the classic compliance portal; its retirement was announced for late 2024, and its capabilities moved to the Microsoft Purview portal, which brings the compliance, data security and data governance solutions together in one place. Older study material and exam questions may still use the old name. When you see it, think of the place where an organization manages Purview compliance solutions, which today is the Purview portal.

The Purview portal shows solution cards for each solution the organization is licensed for, settings for roles and permissions, and shared features such as data classification. Access is controlled through roles and role groups, so that, for example, Carmen can manage Compliance Manager assessments while an HR investigator sees only insider risk cases assigned to her.

Compliance Manager

Microsoft Purview Compliance Manager helps an organization manage its compliance requirements in one place. It turns long, legalistic regulations and standards into lists of specific controls and actions, shows which have been done, assigns the rest to owners, keeps evidence and produces a measure of progress. It is a management tool for the customer's side of compliance; it does not make an organization compliant by itself, and it does not give legal advice.

Compliance Manager is built from a few pieces that the exam expects you to know by name.

Controls are not all the customer's job. Compliance Manager distinguishes Microsoft-managed actions, which Microsoft performs as the cloud provider and documents with its own testing, from customer-managed actions, which the customer must carry out. Some controls are shared. This is the shared responsibility model from MSAZ-130 turned into a checklist: Microsoft's part is shown as done with its evidence; the customer's part waits for an owner.

Many customer actions can be checked automatically. When Compliance Manager is connected to the organization's Microsoft 365 configuration, it can detect whether certain settings are in place, such as multifactor authentication or data loss prevention policies, and update the action's status. Other actions, such as a written policy or a staff training session, are updated manually by the owner with evidence attached. Compliance Manager can also connect to other cloud environments and third-party services, so assessments can cover more than Microsoft 365.

Microsoft provides a default assessment that covers a baseline of data protection controls, and a set of templates included with some licences. Many more templates, covering a wide range of national and industry regulations, are available as premium templates. Organizations can also build custom assessments from their own requirements. Carmen chose the payment card template and, for privacy, a template for Canadian privacy requirements where one was available, and asked Ama to check the template list for the current names.

Compliance score

The compliance score is Compliance Manager's measure of progress. Each improvement action is worth points, and the score is the points earned from completed actions as a share of the total points available. Actions are weighted by how much risk they reduce. Microsoft's documentation explains the weighting in terms of two properties: whether an action is mandatory or discretionary, and whether it is preventive, detective or corrective. A mandatory preventive action, such as enforcing multifactor authentication, is worth far more than a discretionary corrective one, because preventing a problem is usually worth more than cleaning it up afterwards.

Microsoft-managed actions count towards the score, which is why a new tenant starts with a score above zero. Carmen warned the team not to celebrate the starting number: it mostly reflected Microsoft's work, not theirs.

# A simplified compliance score with illustrative points for each completed action.
actions = [
    # (action, owner, points, done)
    ("Microsoft facility physical controls", "Microsoft", 27, True),
    ("Enforce MFA for all staff", "customer", 27, True),
    ("Quarterly access review of payment database", "customer", 9, False),
    ("Weekly audit log review", "customer", 3, True),
    ("Staff policy on forwarding customer lists", "customer", 1, False),
    ("Incident response plan tested", "customer", 3, False),
]
earned = sum(p for _, _, p, d in actions if d)
total = sum(p for _, _, p, _ in actions)
print(f"Compliance score: {earned} of {total} points ({earned / total:.2f} as a fraction)")
todo = sorted((a for a in actions if not a[3]), key=lambda a: -a[2])
for name, owner, pts, _ in todo:
    print(f"   next: {name} ({pts} points, owner: {owner})")

Compliance score: 57 of 70 points (0.81 as a fraction)
   next: Quarterly access review of payment database (9 points, owner: customer)
   next: Incident response plan tested (3 points, owner: customer)
   next: Staff policy on forwarding customer lists (1 points, owner: customer)

The score is useful for showing progress and choosing what to do next, because the actions with the most points still available are often the most important. It is not a certificate. Two organizations with the same score can face very different risks, and an auditor will look at evidence, not at the number. Carmen also distinguished it from Defender for Cloud's secure score in lesson 3. Secure score measures security configuration of resources; compliance score measures progress on compliance actions in Compliance Manager. The two overlap, because many security settings are also compliance controls, but they answer different questions.

Running an assessment

Carmen set up the work as a cycle. The first assessment was created in November 2026, with every customer-managed action assigned to an owner: Sunil for technical controls, Dana Whitcombe for financial controls, Grace Oduya for store procedures and Carmen herself for policies and training. Each owner was asked to review their actions, mark those already done with evidence, and give a date for the rest. From January 2027, the plan is to review the assessment monthly at the security hour and quarterly with the leadership team, and to export the assessment report for the payment processor each year instead of rebuilding a spreadsheet.

Owners, evidence and testing

An improvement action is only as good as its owner. Compliance Manager lets each action be assigned to a named person, with a due date, and records its status: not implemented, implemented, alternative implementation, planned, out of scope and similar states, depending on the action. When an owner marks an action as implemented, they attach evidence, such as a policy document, a screenshot of a setting or a report from another tool, and the action can then be tested, either automatically where Compliance Manager can check the setting, or manually by someone other than the owner. The test result and date are kept with the action, which is what an auditor wants to see.

Carmen set a rule that no owner tests their own action. Sunil's technical actions are tested by Ama, Dana's financial controls by an internal auditor, and Carmen's own policy actions by Lena Fischer in HR. Separation of duties is a control in many standards, and Compliance Manager makes it easy to show: each action records who implemented it and who tested it.

Some actions will never fit. A control written for a large bank may be irrelevant to a retailer, and Compliance Manager allows an action to be marked as out of scope or met by an alternative implementation, with an explanation. Carmen asked for every such decision to be written so that an outsider could understand it, because a decision nobody can explain looks the same as a decision nobody made.

Keeping assessments current

Regulations change, and Microsoft updates its templates when they do. When a template changes, Compliance Manager flags the assessments built from it so the organization can accept the update and see which controls and actions are new. Products change too: an action that was manual last year may become automatically tested this year. Carmen planned a quarterly review of every assessment, with the security hour reviewing the actions with the most points outstanding, and an annual export of the full assessment report for the payment processor and the board's audit committee. "The score is the conversation starter," she said. "The evidence is the conversation."

Ama noted the exam angle: questions often describe a manager who wants to know how close the organization is to meeting a regulation, which actions remain and who owns them. The answer is Compliance Manager and its compliance score, not Defender for Cloud's secure score, even though both are numbers that rise as you fix things.

Ama asked whether Compliance Manager could replace the payment processor's questionnaire altogether. Not yet, Carmen said, because the processor asks its own questions in its own format. But the assessment holds the answers and the evidence in one place, so filling in the questionnaire becomes a matter of copying from a source everyone trusts.