Capabilities of Microsoft Compliance Solutions · Topic 2 of 5
Purview Portal and Compliance Manager
SC-900 Purview and Compliance Manager: the Purview portal, assessments, improvement actions, Microsoft managed and customer managed tasks, and compliance score.
- 5 min
- Includes a diagram
- The Microsoft Purview portal is where you use the compliance and data solutions.
- Compliance Manager uses templates, assessments, controls and improvement actions.
- Actions can be Microsoft managed, customer managed or shared.
What it is
Microsoft Purview is a suite of solutions for data security, data governance, risk and compliance. Together they help an organisation find its data, protect it, keep it as long as the law requires, and show that it meets the rules.
Compliance Manager is the Purview tool for that last job. It turns a regulation into a list of tasks, tracks your progress, and gives you a score.
How it works
The Microsoft Purview portal
The Microsoft Purview portal is the single place where compliance and data teams use the Purview solutions. It brings together tools such as Compliance Manager, information protection, data loss prevention, insider risk, eDiscovery, audit and data governance. Access depends on the roles assigned to each person, so that, for example, an eDiscovery manager does not see everything.
Compliance Manager
Compliance Manager helps you understand and improve your compliance position. It has these building blocks.
| Building block | What it is |
|---|---|
| Template | A ready made set of controls for a regulation or standard, such as ISO 27001, GDPR or HIPAA |
| Assessment | A template applied to your organisation, which groups the controls you must meet |
| Control | One requirement in a regulation |
| Improvement action | A concrete task that helps satisfy a control, with guidance on how to do it |
| Compliance score | A number that shows your progress toward completing the actions |
Prebuilt templates mean you do not have to start each regulation from scratch. A single improvement action can count toward more than one assessment, so work done once helps with several regulations.
Improvement actions and who does them
Each improvement action says who is responsible.
- Microsoft managed actions are done by Microsoft for its cloud services, and they count in your score automatically.
- Customer managed actions are done by you, such as turning on multifactor authentication, and you must implement and test them.
- Shared actions need both Microsoft and the customer.
The compliance score
The compliance score measures your overall progress toward completing the improvement actions that satisfy the requirements of regulations. Actions have different points according to their impact. As you finish more of them, the score goes up. It shows where you stand and helps you decide what to do next.
The score is a guide to progress and does not prove that you comply with a law. Compliance is also a matter of how you work, and of the decisions of auditors and regulators.
Do not mix up the scores
| Compliance score | Secure score | |
|---|---|---|
| Where | Purview Compliance Manager | Microsoft Defender XDR and Defender for Cloud |
| Measures | Progress toward regulatory requirements | Progress toward better security posture |
| Improved by | Completing improvement actions | Completing security recommendations |
A worked scenario
A company that handles payments must follow a card industry standard. The compliance officer opens Compliance Manager, adds the template for that standard and creates an assessment. The tool lists the controls and the improvement actions needed. Some are Microsoft managed and already count. Others, such as enforcing multifactor authentication and encrypting stored data, are customer managed, so the officer assigns them to the IT team. As the team finishes them, the compliance score rises, and a report shows the progress for the auditor.
Purview solution areas
| Area | Examples |
|---|---|
| Data security | Information protection with sensitivity labels, data loss prevention, insider risk management |
| Data governance | Data Map and catalogue that discover and describe data |
| Risk and compliance | Compliance Manager, eDiscovery, Audit, data lifecycle management and records management |
From regulation to action
- Choose the regulation, for example GDPR, and add its template.
- Compliance Manager creates an assessment that lists the controls.
- Each control links to improvement actions, with step by step guidance.
- You assign the customer managed actions to the people who can do them.
- You test and attach evidence, such as a screenshot or a document.
- The compliance score rises as actions are completed, and you export a report for the auditor.
Reading an improvement action
An action shows its points, so you can see which ones move the score the most, its type, such as preventive or detective, and who must do it. Some come from Microsoft and are already counted, some are yours, and some are shared, where Microsoft provides the capability and you must configure it.
Roles
Purview uses role groups, so people see only what their job needs. A compliance administrator can manage Compliance Manager, while an eDiscovery manager works only on cases. This is least privilege applied to compliance tools.
What to remember for the exam
- The Microsoft Purview portal is where you use the compliance and data solutions.
- Compliance Manager uses templates, assessments, controls and improvement actions.
- Actions can be Microsoft managed, customer managed or shared.
- The compliance score shows progress toward regulatory requirements.
- Secure score is a different measure of security posture.
"Progress toward completing actions that satisfy regulatory requirements" is the compliance score. "Improve security posture" is secure score.
How the exam asks about this
- "Which tool gives prebuilt assessments for regulations?" Compliance Manager.
- "An improvement action marked customer managed." The customer's team carries it out.
- "What does the compliance score represent?" Progress toward completing actions that meet regulatory requirements.
- "Which score is part of Defender XDR?" Secure score.
Common mistakes
Treating the compliance score as proof of compliance. It measures progress and does not guarantee a legal result.
Mixing up compliance score and secure score. They are in different products and measure different things.
Assuming Microsoft does all the actions. Customer managed actions are yours.
Starting every regulation from scratch. Templates and shared actions reduce the work.
Check yourself
What is an improvement action?
A recommended task that helps satisfy a control, which you or Microsoft carries out.
What does a prebuilt assessment template provide?
A ready made set of controls for a regulation or standard.
Who carries out a customer managed action?
The customer's own team.
Topic 2 of 5 in Capabilities of Microsoft Compliance Solutions
Test yourself on Capabilities of Microsoft Compliance Solutions
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.