Domain 4 of 4 · Chapter 2 of 4

Purview Compliance Management

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security, Compliance, and Identity Fundamentals premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • One portal, one tool, one number
  • The Microsoft Purview portal, and the portal it is not
  • Inside Compliance Manager: the building blocks
  • Who owns each control: Microsoft-managed, yours, and shared
  • The compliance score: progress, not a certificate
  • Exam pattern recognition

Three surfaces you'll confuse, and what each measures

What you're doingService Trust PortalCompliance score (Compliance Manager)Secure score (Defender for Cloud)
Whose posture or evidenceMicrosoft's, shown to youYour tenant's regulatory postureYour resources' security posture
What it measuresNothing; it is read-only evidenceProgress on regulatory improvement actionsSecure configuration of resources
Home surfaceService Trust PortalMicrosoft Purview portalMicrosoft Defender for Cloud
Example outputSOC 2 report, ISO certificateCompliance score, improvement actionsSecure score, recommendations
Read or actRead Microsoft's evidenceAct on your compliance workAct on your resource config

Decision tree

What are you assessing?Service Trust Portalread Microsoft's reportsRegulatory progress,or resource security?Defender for Cloudsecure scoreThe managing tool,or just the number?Compliance Managermanages the workCompliance scorethe percentageMicrosoft's cloudYour environmentResource securityRegulatory progressThe toolThe number
Cheat sheet

Cheat sheet

  • Portal contains Compliance Manager, which produces the compliance score
  • Compliance Manager is an end-to-end workflow tool for managing regulatory compliance
  • A control is a single requirement of a regulation, standard, or policy
  • An assessment groups a regulation's controls against in-scope services
  • Templates are the prebuilt regulation definitions you create assessments from
  • Improvement actions are the remediation work that raises the score
  • Controls split into Microsoft-managed, your (customer-managed), and shared
  • Every tenant starts with a default Data Protection Baseline assessment
  • The compliance score is a risk-based percentage of progress on improvement actions
  • Score points are weighted by action risk: mandatory and preventative count most
  • Use the score to understand posture, prioritize by risk, and track progress
  • A high compliance score is not a certification of compliance
  • Compliance score measures regulatory progress; secure score measures resource security
  • The Microsoft Purview portal replaced the compliance portal and M365 compliance center
  • Compliance Manager describes and tracks; configuring the controls happens elsewhere
  • A Compliance Manager improvement action earns its points only after it tests as passed

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Learn about the Microsoft Purview portal
  2. Microsoft Purview Compliance Manager
  3. Compliance Manager scoring