LEARN. PRACTICE. GROW.Concept and mechanism
Compliance requires connecting requirements, controls, scope, and evidence. Compliance Manager helps organize assessments and improvement actions; its score supports tracking and prioritization. It neither automatically certifies the organization nor measures the probability of no incident. Service Trust Portal provides assurance documentation for Microsoft services. Confirm service, period, and report scope before using it at a committee. Provider evidence does not demonstrate correct customer configuration of identities, permissions, or processes. A project should distinguish provider-managed, customer-managed, and shared controls, with suitable owners and evidence for each. Avoid closing an action merely because a product name appears in the inventory.
Guided application
During an authorized investigation, eDiscovery helps locate and review relevant case content. Audit supports searches over recorded activities, which are not complete document copies. Define permissions and scope to avoid unnecessary personal-data access. Insider Risk Management supports identifying and investigating insider-risk signals; an indicator does not prove intent or guilt. In operational work, confirm that required records exist and how long they are retained. Inspected documentation gives Audit Standard a 180-day period; longer periods depend on specific conditions. Buying a license afterward does not recreate already deleted events. For international handover, record sources, times, accounts, and search limitations, distinguishing missing evidence from proof of absence.
A provider report covers the service; the application’s access review needs customer evidence.
Common pitfalls
Score as certification; logs as full contents; more licensing as retroactive recovery; signal as proof of guilt.
Related topics: Responsibilities, identity, and risk · Entra: access and privileges
Use each source for the question it can answer and record its limits.
Reference: Compliance Manager · SC-900 objectives 2026-07-28; October 2026 update announced