compliance-manager

---
name: compliance-manager
description: Guidance for Microsoft Purview Compliance Manager — continuous compliance posture across Microsoft and non-Microsoft assets, mapped to 360+ regulatory templates (ISO 27001/27018/27701, SOC 2, NIST 800-53/171/CSF, PCI DSS, HIPAA, GDPR, FedRAMP, IRAP, Essential Eight, DORA, EU AI Act, etc.). Covers compliance score, improvement actions (Microsoft-managed vs customer-managed), evidence collection, assessment authoring (custom templates from CSV), multi-assessment grouping, automated testing of technical controls via Microsoft 365 / Defender for Cloud / Entra, evidence repository, audit-ready reports, and continuous assessment vs point-in-time. WHEN: Compliance Manager, compliance score, regulatory assessment Purview, NIST 800-53 assessment, ISO 27001 evidence, FedRAMP assessment, custom compliance template, improvement action, technical control automation, audit evidence M365, DORA assessment, EU AI Act assessment. DO NOT USE for Defender for Cloud regulatory dashboard (use defender-for-cloud-hardening), Records Management (use purview-records-management), or M365 secure score only.
license: MIT
---

# Microsoft Purview Compliance Manager

Compliance Manager is a posture and evidence platform. It maps Microsoft cloud controls,
your tenant configuration, and your manual evidence to **regulatory templates** (ISO, NIST,
SOC 2, PCI, HIPAA, GDPR, FedRAMP, IRAP, Essential Eight, DORA, EU AI Act, and more), gives
you a **compliance score**, and tracks **improvement actions** with audit-ready evidence
collection.

## When to use
- Authoring or maintaining one or more regulatory assessments.
- Producing audit evidence packages (SOC 2, ISO 27001 surveillance audits).
- Tracking compliance score over time as a leadership metric.
- Mapping a custom internal framework into a Compliance Manager assessment.

**Do not use this skill** for Defender for Cloud's regulatory dashboard
(`defender-for-cloud-hardening`), Records Management (`purview-records-management`), or
M365 Secure Score (general security telemetry).

## Concept map

| Concept | What it is |
|---|---|
| **Template** | A regulation/standard (e.g., "ISO/IEC 27001:2022") |
| **Assessment** | An instance of a template scoped to a product/group (e.g., "M365 ISO 27001") |
| **Improvement action** | A discrete control task (Microsoft-managed or customer-managed) |
| **Microsoft-managed action** | Microsoft maintains; you inherit credit — no work needed |
| **Customer-managed action** | You must implement, document, and provide evidence |
| **Evidence** | Files, links, or automated test results attached to an action |
| **Assessment group** | Logical bundle (e.g., all in-scope assessments for a business unit) |
| **Continuous assessment** | Automatic re-test of supported technical actions |

## Approach

1. **Map your obligations to templates first.** List the regulations the business is
   accountable for, then match to Compliance Manager templates. Coverage is broad — but
   not every internal framework is pre-built. Custom templates fill the gap.

2. **Start with one anchor assessment**, not ten. Usually ISO 27001 or NIST CSF, scoped to
   "Microsoft 365" or "Microsoft 365 + Azure." Demonstrate value before expanding.

3. **Walk Microsoft-managed actions first.** They auto-credit. The remaining
   customer-managed actions are the real work.

4. **For each customer-managed action:**
   - Assign an owner with a due date.
   - Define implementation status (Not implemented → Partial → Implemented).
   - Attach **evidence** (policy doc, screenshot, config export, Defender for Cloud
     compliance report, audit log query).
   - For technical actions with automated testing supported, configure the test so it
     re-runs continuously (M365, Entra, Defender for Cloud).

5. **Assessment grouping.** Multi-regulation environments get duplicate control work
   (NIST AC-2 and ISO 27001 A.9.2 are largely the same). Use shared improvement actions
   across grouped assessments so a single implementation credits everywhere.

6. **Author custom templates** for internal frameworks: build the template via the
   CSV/Excel import (control ID, family, title, description, test procedure, action
   type). Useful for industry frameworks not yet in Microsoft's catalog and for an
   internal compliance overlay.

7. **Evidence repository discipline.** Centralize evidence storage (SharePoint folder
   per assessment). Versioned, dated, owner-tagged. Audit time is not the moment to
   chase a screenshot from 8 months ago.

8. **Reporting.**
   - Compliance score trend per assessment (monthly to leadership).
   - Open improvement actions by owner and aging.
   - Evidence freshness (anything older than 12 months flagged).
   - Export to PDF/Excel for auditors and GRC tools.

9. **Continuous re-assessment.** Schedule a quarterly internal review per assessment.
   Don't wait for the external audit to discover drift.

## Guardrails
- **Compliance Manager score is not your audit verdict.** It's a posture indicator
  Microsoft computes from action status. An auditor still wants the evidence; the score
  helps prioritize work, not pass the audit.
- **Don't mark customer-managed actions "Implemented" without evidence.** That's the
  audit failure case. Score inflation now = embarrassment later.
- **Microsoft-managed credit is for the Microsoft service.** Your tenant configuration
  inside that service is still your responsibility (e.g., MS-managed encryption ≠ your
  CMK configuration).
- **Custom templates lack continuous testing.** Built-in templates with technical action
  automation re-test; custom templates rely on manual evidence updates.
- **Don't duplicate work across assessments.** Use grouping; otherwise the same
  control gets implemented 5 times.
- **Compliance Manager is a Purview-licensed feature.** Some templates are premium add-
  ons (specific regional/industry templates). Confirm template availability per SKU.
- **Evidence in Compliance Manager is not a legal record-retention store.** Combine with
  Records Management for actual record-keeping.

## Common anti-patterns
- **"Score 92% → we're compliant"** — score is an internal metric; auditors test
  controls, not Microsoft's score.
- **"Marked actions complete without uploading evidence"** — fails audit instantly.
- **"Authored 15 assessments in week one"** — none get evidence-maintained; all decay.
- **"Compliance Manager evidence in personal OneDrive folders"** — succession risk;
  unfindable at audit time.
- **"Ignored Microsoft-managed action context"** — claimed Microsoft credit without
  configuring the customer-side option (e.g., "encryption" credit without enabling
  Customer Key when the audit asks).
- **"Custom template authored in the UI by hand"** — slow, no versioning. Use CSV
  import, source-control the CSV.
- **"Continuous assessment ignored — manual screenshot evidence for technical controls
  that auto-test"** — wasted effort.

## Example prompts
- `Plan a Compliance Manager rollout: SOC 2 Type II, ISO 27001, and HIPAA grouped for
  a healthcare M365 + Azure tenant.`
- `Author a custom assessment template from our internal control framework CSV.`
- `Build the evidence repository structure and tagging convention for ISO 27001
  surveillance audit prep.`
- `Identify duplicate customer-managed actions across NIST 800-53 and ISO 27001 and
  merge into shared actions.`
- `Quarterly internal review SOP: how to validate evidence freshness, re-test status,
  and reassign aging actions.`
- `Compare Compliance Manager's NIST CSF coverage to our current GRC tool and propose
  migration.`
- `Wire automated technical testing for Entra, M365, and Defender for Cloud actions in
  a FedRAMP Moderate assessment.`

## Microsoft Learn
- Compliance Manager overview: https://learn.microsoft.com/purview/compliance-manager
- Templates list: https://learn.microsoft.com/purview/compliance-manager-templates-list
- Assessments: https://learn.microsoft.com/purview/compliance-manager-assessments
- Improvement actions: https://learn.microsoft.com/purview/compliance-manager-improvement-actions
- Continuous assessment: https://learn.microsoft.com/purview/compliance-manager-setup#turn-on-automatic-testing
- Custom templates (CSV import): https://learn.microsoft.com/purview/compliance-manager-templates
- Evidence: https://learn.microsoft.com/purview/compliance-manager-improvement-actions#how-to-export-an-improvement-action-report
- Compliance score calculation: https://learn.microsoft.com/purview/compliance-score-calculation
- Role permissions: https://learn.microsoft.com/purview/compliance-manager-setup#set-user-permissions-and-assign-roles