Microsoft Purview Compliance Manager - Simply Explained

0:00 There's a question that makes most companies go quiet, and it's the one about whether they are actually compliant. Compliance manager lives inside Microsoft purview, and it takes that messy question and turns it into a single number. You can watch move. You might think a tool like this is only for compliance officers with law degrees, but it's built for the people who do the actual work. And there's one thing about that score that almost everyone gets wrong. Welcome to the M365 FM podcast, where we explore the people, ideas and technologies shaping the future of work. What Compliance Manager is compliance is one of those words that makes people's eyes glaze over. And the reason is simple it never lives in one place. In most companies, it hides in a dozen spreadsheets, a few email threads nobody can locate, and a couple of audits that happen once a year and then get quietly forgotten.

0:40 So when a leader asks whether the company is actually compliant, the honest answer is usually a shrug. Microsoft Purview Compliance Manager exists to fix that exact problem. It's a tool inside Microsoft Purview, which is Microsoft's home for security data and compliance work, and it helps an organization assess and manage compliance across its cloud services. The tool follows the whole journey rather than one slice of it. It helps you take inventory of your data protection risks, implement the controls that reduce them, stay current with regulations and certifications, and report back to auditors when they come knocking. That range is the point, because a compliance program that only handles one of those jobs still leaves you exposed on the others. And it isn't only for big enterprises with dedicated compliance teams, because the same structure scales down to a small business where one person wears five hats.

1:25 Here's the part that matters most for a beginner, because it turns a scary topic into a manageable one. The whole tool runs on three moving parts. There are assessments which work like report cards for a single rule. There are improvement actions, which are the to do items that move those report cards forward. And there's the compliance score, which is the single number that ties everything together. Understand those three and the rest of the interface stops feeling like a maze. You can click around without the sinking feeling that you're about to break something. Each action also comes with step by step guidance written for people who aren't lawyers. So the next move is always obvious. One more idea before we go deeper, because it explains why the tool looks the way it does. Compliance manager runs on a shared responsibility model. Microsoft already implements part of the work for its own cloud services, and your organization handles the rest.

2:10 The tool tracks both sides and gives you credit for the half Microsoft does on your behalf. You might assume every ounce of pressure lands on your team, but a surprising amount of it was never yours to carry in the first place. That split explains why a healthy score can show up even on a quiet week, and why you should never read it as a full picture of your own effort. Keep that in mind because it explains the number you're about to meet. The compliance score. The compliance score is the first thing you'll see, and it's also the thing people misunderstand the most. At its core, it's a percentage and you build it by earning points. You earn those points by completing improvement actions, and each action carries a set number of points. Points from the actions Microsoft handles count toward the score two. So the number reflects the whole picture rather than just your side of the work.

2:50 That single figure is the tool's way of answering a question that used to take weeks of meetings, and it updates as your environment changes. The very first score you see deserves a closer look because you haven't done anything yet. There's already a number on the screen. That number comes from a default assessment called the Data Protection Baseline, and it's available at every subscription level. It's a set of controls pulled from standards and rules you'd recognize by name, including NIST, ISO, FedRAMP, and GDPR. Compliance manager reads your existing Microsoft three hundred sixty five settings and gives you a starting point based on how they look today before you've configured a single thing. Now, not every action carries the same weight, and that's on purpose. The tool weights each action by the risk it represents, which is a quiet way of telling you where your attention pays off most.

3:32 A preventative action that stops a problem before it starts and that can't be bypassed is worth the most. A detective action that only watches for problems is worth far less. In practice. The highest value action comes in at twenty seven points, and the lowest value one lands at a single point. That gap between them is the tool ranking your priorities for you, so a number you barely understand still points you in a useful direction. Here's a detail that trips people up. So let's slow down for a second. Points are awarded per action per assessment. If an action carries ten points and it shows up in two assessments, it's worth twenty points to your overall score. There's a small exception for technical actions scoped to your whole tenant, but the main takeaway is simple your overall score isn't just the average of your assessment scores, because the same good work can count more than once.

4:12 That's good news. And it's also why two companies with identical settings can show different scores if they track different numbers of assessments. There's one last thing about timing because it manages expectations. The score isn't a live, second by second readout. When you change something, your action status updates on the dashboard within about twenty four hours. So this is a number that moves in the background while you work. And it isn't a slot machine that lights up the moment you click. Give it a day before you judge whether a change actually landed. And that brings us to the part people get wrong. It isn't the math, it's what they think the number actually means. Hold that thought because we're coming back to it at the end. Assessments. If the score is the headline assessments are the report cards behind it. An assessment gathers the controls from one specific regulation standard or policy.

4:53 Think of a rule you've heard of like a data protection law, and an assessment is the tool's version of it translated into checks you can actually act on. Complete the actions inside an assessment and you're working toward meeting that rule. Each assessment holds a few things worth knowing. It lists the services it covers, which shows whether you're measuring just Microsoft three hundred sixty five or a wider set of cloud services, it separates the controls Microsoft manages from the controls you manage, and it flags the ones you share, and it carries its own score, so you can see how you're doing on that single rule without squinting at the overall number at the top of the page. If one regulation is dragging you down, that per assessment score tells you exactly where the problem lives. Assessments live inside groups and groups are really just folders.

5:34 They exist so you can organize your work in whatever way makes sense to you, whether that's by year, by regulation or by team. A group has to hold at least one assessment. Group names have to be unique and groups can't be deleted. That last rule is the tool nudging you to think about structure before you start clicking. And it's the kind of thing you're glad to know on day one. Once you add an assessment to a group, you can't move it. So pick a simple grouping scheme early and save yourself the headache. Here's where assessments get really clever and it's the part that saves actual hours. One improvement action can serve several assessments at once. A technical action, one you complete by changing a setting syncs across all your groups, so doing it once counts everywhere. A non-technical action, such as a new policy you draft sinks within its own group.

6:16 You might expect to do the same work five times for five different rules, but the tool is built so that one good decision can satisfy several requirements at the same time. Every assessment also carries a status, so its place in the process is never a mystery. It can read as complete or incomplete in progress or not yet started. And when someone asks for proof, you can export the whole assessment as a spreadsheet. That export is a snapshot of exactly where things stood on the day you sent it, which is precisely what an auditor wants to see. It's the difference between saying you're compliant and showing the evidence. Regulations and templates. Assessments have to come from somewhere and you don't build them from a blank page. That's the whole point. Compliance manager gives you regulatory templates, and the template is a ready made blueprint for a rule.

6:57 It already contains the controls and the improvement actions you'd need to satisfy that regulation. So you skip the painful work of mapping a law by hand. For anyone who has ever tried to read a regulation called that alone is worth the price of admission. The scale here is worth pausing on Microsoft ships more than three hundred and sixty of these templates covering regulations, standards, and certifications from around the world. If your company operates in several countries or serves customers in a regulated industry, there's a decent chance the rule that applies to you already has a template waiting. You're choosing from a library, not writing from scratch, and it does the mapping work that used to eat up weeks of someone's calendar. Now, not all of them are free. And this is where honesty helps. The templates come in two buckets. One is the baseline template, the data protection baseline, which comes included at every subscription level so everyone gets a starting point.

7:43 The other bucket holds premium templates, the global, regional and industry rules that need a license to unlock. Depending on your agreement, your organization might be able to use a few premium templates at no extra cost, and premium licenses generally last about a year before they renew. If your situation is unusual, you can also build a custom template from scratch, though most organizations never need to. The practical takeaway is this you start with a library. You pick the rule that matters to you, and the structure is already built for you. You're not staring at an empty spreadsheet trying to remember what a regulation even requires, and that changes how quickly you can get moving. The hard part shifts from figuring out the rule to simply doing the work it asks for. Improvement actions. A template gives you the list, but a list doesn't do the work.

8:24 That's where improvement actions come in, and they're the engine of the whole tool. An improvement action is a single recommended task written in plain guidance that moves your score. When you complete it. Each one tells you what to do, points you toward the right place to do it, and tracks whether it's done in a field full of vague advice. That specificity is what makes the work possible. Every action can be assigned to a person in your organization, which is what turns a compliance program into actual work with names attached. Once assigned, the owner gets a notification and a direct link to the task. The action itself becomes a little container for everything related to that job. You can store notes, upload evidence like documents and screenshots, and record status updates all in one place so the proof doesn't get lost in somebody's inbox. Improvement actions come in two flavors, and the difference matters.

9:07 Technical actions are things you do by changing a setting inside a tool, like turning on a security feature. Non-Technical actions happen outside the technology and they split again into documentation like writing a policy and operational work, like training your staff. You might think compliance is all paperwork and red tape, but a large share of these actions are real technical changes you can make in an afternoon. The tool doesn't care who you are. It only cares whether the action is done and tested. Then there's the question of testing, which is how the tool knows an action actually worked. Some actions you test by hand, you do the work, record the date and mark the result. Many other actions test themselves because compliance manager reads signals straight from your environment. It pulls those signals from several sources.

9:47 It reads built in signals from other Microsoft security and compliance tools. It checks Microsoft Secure Score, and it reaches into defender for cloud to watch. Azure, Amazon Web Services, and Google Cloud. Automatic testing is switched on by default, and it takes about a week to fully gather its data. You don't have to trust your memory about whether a setting is still on, because the tool keeps checking for you. There's a trade off here, and it's worth saying out loud. Automatic testing removes the pile of repetitive busywork, but it comes with a catch. You can't hand edit the status or the notes on an action that tests itself because the tool owns that field, so the choice between manual and automatic is really a choice about control. You trade a little manual effort for a little more oversight, or you trade oversight for convenience. Who does what. All of that work needs owners and owners need permissions.

10:29 So let's talk about who gets to do what. Compliance manager uses role based access, which is a fancy way of saying that only people you invite can get in, and the role you give them decides what they're allowed to touch. Nothing happens by accident because access is granted on purpose. There are four roles and each one is easy to picture. A reader can look at everything and change nothing, which is perfect for someone who just needs visibility. A contributor can edit data and create new assessments. So this is your hands on builder. An assessor can also edit data but can't create assessments because their job is to check the work rather than design it. And an administrator runs the whole thing managing assessments, templates, and the people involved. Most beginners only ever need to see the reader view, and that's a perfectly good place to start.

11:11 Here's the part that makes adoption easier than you'd expect. These roles line up with Microsoft admin roles you may already have assigned, so the person who manages your tenant often slots straight in without a new identity to remember, and there's a neat extra layer. You can give someone a role on one single assessment so an outside auditor can see exactly the report card they need, and nothing else that keeps sensitive compliance work in the right hands. There's one plain rule to keep in mind. A person holds one role at a time, and changing that role replaces the old one that keeps permissions clean. And it means access is always deliberate rather than accidental. If someone's role changes, their old abilities disappear at the same moment, which is exactly what you want in a tool that touches sensitive data. The workflow end to end. Let's pull all of it together now, because the pieces make more sense as one continuous flow.

11:55 Imagine you've just been handed the keys to Compliance Manager, and you're logging in for the first time. You sign into the Microsoft Purview Portal and Open Compliance Manager, and you land on a dashboard that already shows a score. You didn't build anything yet. And that's fine, because the baseline assessment has been quietly reading your Microsoft three hundred sixty five settings the whole time. Your first job is simply to look at what's already there, and to notice that the tool has been working before you arrived. Next, you pick the regulation that actually matters to your organization and spin up an assessment from a template. The tool asks you a few questions like which services you want to cover, and then it builds the report card for you. Now you can see the full list of actions standing between you and that rule. From there, you read through the improvement actions and assign owners.

12:36 Some tasks belong to it, some to legal and some to whoever writes your policies. The tool sends each owner a link so nobody has to guess what they're responsible for. Then the work begins. People complete actions, upload evidence, and mark their status and the actions that test themselves. Credit your score automatically. As things get done, you move them from plan to implemented and from untested to tested. The score climbs slowly and honestly, one verified action at a time. This is also the moment to set up alerts if your score ever drops or an action flips its status, you hear about it. Instead of finding out the hard way during an audit. Over time, that habit turns compliance from a yearly panic into a steady routine. When leadership or an auditor wants proof, you export a report and hand it over. Then the cycle repeats because regulations change and your environment keeps moving.

13:20 And through all of it, Microsoft is quietly completing its own half of the work in the background, which is why your score reflects more than your team alone. Your job is the part that's genuinely yours, and the dashboard makes sure you can see it clearly. There's still that one thing about the score, though, and it's time to settle it. A quick recap and one open question. Let's bring it back to the three parts. Quick and clean. The compliance score is your progress in a single number. Assessments are the report cards for each rule, and improvement actions are the to do list that moves everything forward with roles keeping it all under control. That's the whole machine and it's smaller than it looks from the outside. Now let's talk about the one thing people get wrong about that score. It isn't a certificate of compliance, and Microsoft says so directly the score tracks your progress on recommended actions, and it never replaces your own judgment about whether a control actually works.

14:07 Treat it as a fitness tracker, not a finish line. If this made compliance feel a little less intimidating, subscribe to M365 FM, where we master the tools and the mindset shaping the future of work. So let me leave you with one question. When you picture your own dashboard, which regulation shows up first and which single improvement action would you start tomorrow morning?