Compliance Manager

Compliance work often fails at the translation layer. A law, standard, or certification may describe what an organization must achieve, but it rarely tells a security team which setting to change, which owner to assign, what evidence to collect, or what to do first. Microsoft Purview Compliance Manager is built for that gap. It converts selected regulations and standards into assessments, improvement actions, control mappings, evidence, and a risk-based compliance score that teams can use to manage progress across Microsoft 365, Azure, and, through Microsoft Defender for Cloud, other clouds such as Google Cloud Platform and Amazon Web Services.

The job of Compliance Manager

Compliance Manager is a Microsoft Purview solution for managing compliance work as an operational program rather than as a pile of legal text. It helps an organization inventory data protection risks, select the regulations or standards that apply, track the controls needed to meet them, assign work, monitor progress, and report status to internal leaders or external auditors.

Its core value is translation. A regulation may say that access to sensitive data must be controlled, monitored, and reviewed. Compliance Manager turns that broad requirement into improvement actions, such as configuring a Microsoft-managed control, assigning a customer-managed task, collecting evidence, or reviewing implementation status.

It does not make an organization compliant by itself. It gives the organization a structured way to understand what must be done, who owns each part, what Microsoft already operates as part of its cloud service responsibilities, and where the customer still has work to complete.

Assessments are the working unit

An assessment is the working container in Compliance Manager. It represents a specific regulation, standard, certification, or internal policy applied to a selected environment. Microsoft provides more than 360 prebuilt assessment templates covering industry and regional requirements, so teams do not have to start every control mapping exercise from a blank spreadsheet.

Each template maps external requirements to Microsoft’s control framework. That mapping is useful because regulations often use legal or policy language, while engineering teams need actionable control language. The assessment acts as the bridge between those two worlds.

A typical assessment contains improvement actions, control descriptions, ownership information, implementation guidance, testing status, and evidence areas. Some actions are Microsoft-managed, meaning Microsoft is responsible for operating or proving the control for its cloud service. Others are customer-managed, meaning the organization must configure, document, operate, or prove the control itself.

• Use prebuilt assessments when a recognized law, standard, or certification applies.
• Use custom assessments when the organization needs to track internal policies or obligations that are not covered by a prebuilt template.
• Treat each assessment as a living work plan, not a one-time report.
• Assign owners to customer-managed actions early, because unowned compliance work rarely moves.

The compliance score is a prioritization tool

Every assessment contributes to a risk-based compliance score. The score summarizes progress against improvement actions, weighted by the relative risk and value of the controls. This gives leaders a single number to watch and gives practitioners a way to decide which work should be addressed first.

The score is most useful when it starts a conversation rather than ends one. A rising score can show that meaningful work is being completed. A flat score can reveal that owners are missing, evidence is incomplete, or difficult controls are being deferred. A high score does not automatically mean an auditor will approve everything, and a low score does not always mean the organization is unsafe; it means the selected assessment work is incomplete or not yet proven.

Good teams use the score to sequence work. Instead of trying to remediate hundreds of items at once, they focus on high-impact actions, controls that reduce real exposure, and areas where evidence will be needed for an audit or certification deadline.

Shared responsibility matters

Cloud compliance is built on shared responsibility. Microsoft operates many controls for its cloud services, such as parts of the physical data center, platform security, and service-level controls. The customer remains responsible for areas such as data classification, user access decisions, policy configuration, endpoint behavior, business approvals, and evidence for its own processes.

Compliance Manager makes this split visible. For Microsoft-managed actions, it can show implementation details and audit-related results that indicate the control is in place for the service. For customer-managed actions, it provides guidance and a place to track implementation, testing, ownership, and evidence.

This distinction prevents a common mistake: assuming that because a cloud provider has certifications, every customer workload is automatically compliant. Provider certifications are important, but they do not replace the customer’s duty to configure and operate its own environment correctly.

Multicloud posture comes through Defender for Cloud

Many organizations no longer run in one cloud. Compliance evidence may need to cover Microsoft 365, Microsoft Azure, Google Cloud Platform, and Amazon Web Services. Compliance Manager connects with Microsoft Defender for Cloud to extend compliance posture tracking beyond Microsoft 365.

Microsoft Defender for Cloud is Microsoft’s cloud security posture management service. Through that integration, Compliance Manager can use resource-level testing and configuration signals from Azure, Google Cloud Platform, and Amazon Web Services to help assess whether technical controls are in place. This is especially useful when a regulation applies to the business as a whole, not just to one cloud console.

The practical gain is consolidation. Instead of asking separate teams to export separate reports from separate platforms and reconcile them manually, Compliance Manager can present a more unified view of compliance posture across the digital estate. The organization still needs to validate scope, connect the right accounts or subscriptions, and confirm that the tests match the control intent.

The real decisions leaders must make

Compliance Manager is not just a technical dashboard. It forces management decisions that are often left vague. Which regulations and standards are in scope? Which business units, tenants, subscriptions, and cloud accounts are covered? Who owns each action? Which risks will be accepted temporarily, and who has the authority to accept them?

For a chief information security officer, the tool can become a way to explain compliance posture in plain terms: here are the applicable assessments, here is the current score, here are the highest-risk gaps, here is the work already completed, and here is what remains unfunded or unassigned.

For a practitioner, the same tool becomes a queue of concrete work. Instead of arguing about abstract compliance language, the team can review specific improvement actions, implementation guidance, current test status, missing evidence, and deadlines.

• Choose assessment templates based on real business obligations, not curiosity.
• Define scope carefully so the score reflects the environment that auditors and regulators actually care about.
• Assign every customer-managed action to a named owner or accountable team.
• Review high-impact actions before low-value cosmetic work.
• Set a recurring evidence review cadence before an audit date is announced.

How to operate it over time

Compliance Manager works best as a cycle. The organization selects assessments, reviews the generated actions, assigns ownership, implements controls, gathers evidence, checks the score, and repeats as regulations, services, and business priorities change.

The first pass should not try to make every assessment perfect. A better approach is to select the most important obligations, confirm scope, fix the highest-risk gaps, and build the evidence process. Once that operating rhythm exists, additional assessments and custom controls are easier to absorb.

The tool also needs governance of its own. Someone must decide which templates are active, which teams can change action status, how evidence is reviewed, and how exceptions are documented. Without those rules, the score can become another dashboard that looks precise but is not trusted.

Limits and good practice

Compliance Manager reduces ambiguity, but it does not remove judgment. Legal counsel, privacy officers, risk leaders, auditors, and system owners still need to interpret obligations, validate scope, approve risk decisions, and confirm that implemented controls meet the organization’s specific requirements.

Not every control can be tested automatically. Some controls depend on human process, policy approval, training, vendor management, contractual language, or business records that live outside Microsoft systems. These still need evidence, ownership, and review.

Product capabilities also change. Assessment templates, cloud integrations, scoring behavior, and available evidence can evolve over time. A mature program checks current Microsoft documentation, confirms licensing and regional availability, and treats Compliance Manager as a management system, not as a substitute for professional compliance advice.

Glossary

Compliance Manager

A Microsoft Purview solution that helps organizations translate compliance requirements into assessments, actions, evidence, and a risk-based score.

Assessment

A working container that maps a regulation, standard, certification, or policy to controls and improvement actions.

Prebuilt assessment template

A ready-made Microsoft template that maps a known requirement set to Microsoft’s control framework.

Improvement action

A specific task that can be assigned, implemented, tracked, and used to improve an assessment score.

Risk-based compliance score

A numerical summary of progress against selected compliance actions, weighted by the relative value and risk of those actions.

Microsoft-managed action

A control action for which Microsoft is responsible as the cloud service provider and can provide related implementation or audit evidence.

Customer-managed action

A control action that the customer must configure, operate, document, or prove within its own environment.

Microsoft Defender for Cloud

Microsoft’s cloud security posture management service, used with Compliance Manager to assess technical controls across Azure and connected clouds.

Shared responsibility

The cloud operating model in which the provider and customer each own different parts of security, compliance, configuration, and evidence.