Design security operations, identity, and compliance capabilities · Topic 7 of 7
Regulatory Compliance with Purview, Azure Policy and Defender for Cloud
SC-100 compliance: turning requirements into controls with Purview Compliance Manager, Azure Policy initiatives and Defender for Cloud.
- 5 min
- Translate regulations into control objectives, then technical controls, owners and evidence. Shared responsibility applies.
- Purview Compliance Manager: assessments, compliance score, improvement actions. Purview covers data governance and protection.
- Azure Policy effects: Audit, Deny, Modify, DeployIfNotExists, AuditIfNotExists. Initiatives group definitions. Assign at management group scope.
What it is
Regulations such as GDPR, HIPAA, PCI DSS, ISO 27001, NIST SP 800-53, SOC 2 and FedRAMP describe what an organization must achieve, not how. An architect translates each requirement into technical and organizational controls, implements them with services such as Microsoft Purview, Azure Policy and Microsoft Defender for Cloud, and collects evidence that they work.
How it works
Translating requirements into controls
- Identify the regulations and contractual obligations that apply, and the scope: which data, systems, regions and business units.
- Break each requirement into control objectives, such as "encrypt personal data at rest", "retain audit logs for a set period" or "restrict data to the EU".
- Map objectives to controls: technical (encryption, access control, logging, network isolation), administrative (policies, training) and physical.
- Decide the owner of each control. Under the shared responsibility model, the cloud provider covers some controls and you cover the rest. Microsoft publishes audit reports and compliance documentation in the Service Trust Portal.
- Implement with policy as code and automation, monitor continuously and keep evidence.
| Typical requirement | Technical controls |
|---|---|
| Protect personal or card data | Classification and sensitivity labels, encryption, DLP, tokenization, network segmentation |
| Control access | Least privilege, MFA, PIM, access reviews |
| Keep audit trails | Central logging, immutable retention, Purview Audit |
| Retain or delete records on a schedule | Retention labels and policies, records management |
| Keep data in a region | Azure Policy allowed locations, data residency settings, sovereign cloud options |
| Respond to incidents and breaches | Incident response plan, detection, notification workflows |
Microsoft Purview for compliance
| Capability | Use |
|---|---|
| Compliance Manager | Assess your compliance posture against regulations using assessment templates. It gives a compliance score, lists improvement actions split into controls managed by Microsoft and by you, and stores evidence |
| Sensitivity labels and DLP | Classify and protect data, and block or warn on risky sharing |
| Data lifecycle management and records management | Retention labels and policies, disposition reviews and records declarations |
| Audit | Searchable record of user and admin activity |
| eDiscovery | Find and hold content for legal matters |
| Communication Compliance and Insider Risk Management | Detect policy violations and risky behavior |
| Data Map and Unified Catalog | Discover and govern data across the estate |
Azure Policy
Azure Policy evaluates and enforces rules on Azure resources.
| Element | Notes |
|---|---|
| Definition | A rule and its effect |
| Initiative | A group of definitions for a goal. Built in regulatory compliance initiatives exist for standards such as NIST SP 800-53, ISO 27001, PCI DSS, HIPAA and FedRAMP |
| Assignment | Applies a definition or initiative at a scope: management group, subscription or resource group |
| Effects | Audit (report), Deny (block), Modify (change properties such as tags), DeployIfNotExists (deploy a missing configuration), AuditIfNotExists, Disabled |
| Exemptions | A documented, time bound exception for a scope or resource |
| Remediation tasks | Fix existing resources for Modify and DeployIfNotExists |
Common security policies: allowed locations (data residency), require encryption with customer managed keys, deny public network access on storage and databases, require diagnostic settings, enforce private endpoints, restrict allowed VM SKUs or images. Assign at management group scope so every new subscription inherits them, use Audit first to measure impact, then move to Deny.
Microsoft Defender for Cloud regulatory compliance
Defender for Cloud assesses your resources against standards and shows the results in the regulatory compliance dashboard.
- The Microsoft Cloud Security Benchmark is assigned by default in the free Foundational CSPM. Regulatory compliance assessments against other standards, such as NIST SP 800-53, PCI DSS, ISO 27001, CIS and SOC 2, and custom standards, are a Defender CSPM capability.
- It works for Azure, AWS and GCP subscriptions and accounts.
- Each standard breaks down into controls, each with the automated assessments that support it, and shows which are passing or failing.
- Download compliance reports for audits.
- It builds on Azure Policy for Azure resources, and some controls need manual evidence from your own process.
Use them together: Policy enforces and measures configuration, Defender for Cloud shows posture against standards and across clouds, and Purview covers data compliance (classification, retention, audit, eDiscovery) with Compliance Manager tying them to a regulation and its evidence.
Evaluate and validate alignment
| Question | Tool |
|---|---|
| How compliant are Azure and multicloud resources with a standard? | Defender for Cloud regulatory compliance dashboard |
| Which resources violate a rule? | Azure Policy compliance view |
| How compliant is the Microsoft 365 data estate? | Purview Compliance Manager score and improvement actions |
| Can I prove it to an auditor? | Reports, evidence, audit logs and assessments |
A worked scenario
A payments company must meet PCI DSS and keep EU customer data in the EU. The architect assigns a PCI DSS initiative and an allowed locations policy at the production management group, first in Audit, then Deny. Defender for Cloud shows compliance against PCI DSS for Azure and AWS accounts. Purview labels and DLP protect card data in Microsoft 365, Audit Premium retains evidence, and Compliance Manager tracks the remaining improvement actions.
What to remember for the exam
- Translate regulations into control objectives, then technical controls, owners and evidence. Shared responsibility applies.
- Purview Compliance Manager: assessments, compliance score, improvement actions. Purview covers data governance and protection.
- Azure Policy effects: Audit, Deny, Modify, DeployIfNotExists, AuditIfNotExists. Initiatives group definitions. Assign at management group scope.
- Defender for Cloud shows regulatory compliance for Azure, AWS and GCP. MCSB is the default standard. Other standards need Defender CSPM.
- Use Audit before Deny to avoid breaking production.
"Show a compliance score and recommended actions for a Microsoft 365 regulation" is Purview Compliance Manager. "Compliance of Azure and AWS resources with PCI DSS" is Defender for Cloud.
How the exam asks about this
- "Block creation of resources outside approved regions." Azure Policy allowed locations with Deny.
- "Measure Azure and AWS compliance with ISO 27001." Defender for Cloud regulatory compliance dashboard.
- "Track improvement actions for GDPR in Microsoft 365." Purview Compliance Manager.
- "Automatically deploy diagnostic settings to existing resources." DeployIfNotExists with a remediation task.
Common mistakes
Deny first. Start with Audit to learn the impact.
One tool for everything. Policy, Defender for Cloud and Purview cover different layers.
Ignoring the customer share. Microsoft compliance does not make you compliant.
No evidence. Auditors need proof, not just configuration.
Check yourself
Which Azure Policy effect deploys a missing configuration to existing resources through a remediation task?
DeployIfNotExists.
Which Purview feature gives a compliance score based on assessment templates?
Compliance Manager.
Which Defender for Cloud feature shows posture against standards such as PCI DSS?
The regulatory compliance dashboard.
Topic 7 of 7 in Design security operations, identity, and compliance capabilities
Test yourself on Design security operations, identity, and compliance capabilities
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.