Microsoft Purview Compliance Manager Cheat Sheet

• Microsoft Purview Compliance Manager is a feature within the Microsoft Purview compliance portal that helps organizations manage compliance requirements across their multicloud digital estate (Microsoft 365, Microsoft Azure, AWS, Google Cloud). It provides workflow capabilities to assess risk, implement controls, and report to auditors using pre-built and custom assessments. It calculates a dynamic Compliance Score to measure your posture and prioritize improvement actions.

Important Updates

• Multicloud Support (May 2023): Integrates with Microsoft Defender for Cloud to assess compliance posture across Microsoft 365, Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) from a single interface.
• AI Regulation Assessments (May 2024): Includes pre-built templates for key AI regulations like the EU AI Act, ISO/IEC 42001, and NIST AI RMF 1.0.
• Third-Party Connectors (May 2023): Use connectors (e.g., for Salesforce, Zoom) to bring compliance data from other services into Compliance Manager.
• Alerts and Audit Logging (Feb 2022, Sept 2024): Set alert policies for score changes and track user activities (like role changes) in the audit log.

• Pre-deployment Assessment (Preview, Nov 2024): Assess compliance posture before deploying new Microsoft services.
• Customizable Templates (Nov 2024): Modify pre-built regulatory templates by adding your own controls and actions to build custom assessments.

Features

• Compliance Score: A risk-based percentage that measures your progress in completing recommended improvement actions. It helps prioritize work.
• Improvement Actions: Prescriptive, step-by-step recommendations to address compliance gaps. They can be assigned to users for implementation and testing.
• Assessments: Groups of controls from a specific regulation (e.g., NIST CSF, GDPR). Completing an assessment helps meet a standard’s requirements.
• Controls & Responsibility Model:
  • Microsoft-Managed Controls: Implemented and managed by Microsoft.
  • Customer-Managed Controls: Your organization’s responsibility to implement.
  • Shared Controls: Responsibility is shared between Microsoft and your organization.
• Regulatory Templates: A library of over 360 pre-built templates (e.g., ISO 27001, NIST AI RMF, GDPR) to kickstart assessments. Custom templates can also be created.

Want to learn more about Azure? Watch the official Microsoft Azure YouTube channel’s video series called Azure Tips and Tricks.

Microsft Purview Compliance Manager Cheat Sheet References:

https://learn.microsoft.com/en-us/purview/compliance-manager
https://learn.microsoft.com/en-us/purview/compliance-manager-whats-new