Service Trust Portal and Privacy

Ask one question of everything in this domain and it sorts itself: is this about whether you can trust Microsoft, or about the duties you owe your own users? That single question splits the page cleanly in two.

Microsoft's obligations to you

When you move data into a cloud you do not run, you need proof the provider handles it well. Microsoft publishes that proof in two forms. The Service Trust Portal^[1] is where independent auditors' reports and compliance documents live, and the privacy principles^[2] are the contractual commitments Microsoft makes about how it treats your data. Both flow one way, from Microsoft to you. You read them; you do not configure them.

Your obligations to your users

The moment you hold other people's personal data, privacy law makes you responsible for it. Microsoft Priva^[3] is the product you operate to meet that responsibility, finding personal data in your Microsoft 365 environment and reducing the privacy risks around it. A related surface, Purview Compliance Manager, measures how well your tenant meets its regulatory obligations overall, and has its own subtopic (Purview compliance management).

The trap the exam sets is direction. The Service Trust Portal and Compliance Manager both deal with compliance, but one shows you Microsoft's evidence and the other measures your posture. Priva and the privacy principles both concern privacy, but one is a tool you run and the other is a promise Microsoft makes. Read every stem for who owns the obligation before you pick a service.

The Service Trust Portal (STP) is Microsoft's public site for publishing audit reports and other compliance information about its cloud services Get started with the Service Trust Portal^[1]. Think of it as Microsoft's evidence locker: external auditors examine Microsoft 365, Azure, and Dynamics 365, and their findings are posted here for you to download.

What you find there

STP groups its content into a few areas:

• Certifications, regulations, and standards. The independent audit artifacts: ISO/IEC (including ISO/IEC 27001 and the cloud-privacy code ISO/IEC 27018), SOC 1, SOC 2, and SOC 3 reports, FedRAMP, PCI DSS, CSA STAR, and national schemes.
• Reports, whitepapers, and artifacts. Penetration-test attestations, business-continuity and disaster-recovery documents, privacy and data protection material, and FAQs.
• Industry and regional resources. Guidance scoped to sectors such as financial services, healthcare, and government, and to specific regions.
• Resources for your organization. Documents restricted to your tenant, based on your subscription and role.

A My Library feature lets you save documents and be notified when a newer version is published, so you can track the reports that matter to you Get started with the Service Trust Portal^[1].

Access, and the portal it is not

Anyone can browse, but downloading many documents requires signing in with a Microsoft Entra organization account and accepting a non-disclosure agreement, and some restricted documents need a role such as Compliance Administrator or Security Reader Get started with the Service Trust Portal^[1].

Here is the distinction the exam leans on hardest. The Service Trust Portal is where you read Microsoft's compliance evidence. The Microsoft Purview portal is where you do compliance work on your own tenant: run Compliance Manager, configure policies, review your score. Same word, compliance, opposite roles. If a stem asks where to obtain Microsoft's SOC or ISO report, the answer is the Service Trust Portal, never Compliance Manager or the Purview portal.

Microsoft's privacy principles are the commitments it makes about how it handles the data you place in its commercial cloud. The current documentation groups that commitment into four areas SC-900: Microsoft's privacy principles^[2]:

• You control your data. Your data belongs to you. You can access, modify, or delete it, and Microsoft will not use it without your agreement. Microsoft does not use your data for advertising or mine it for marketing research, and any subprocessor it engages is bound by the same commitments.
• You know where your data is located. Microsoft offers data residency options and is transparent about where your data is stored and processed, so you can meet geographic requirements.
• Your data is secured at rest and in transit. Microsoft applies strong encryption, up to AES-256 for data at rest and industry-standard protocols such as TLS and IPsec in transit, with keys you can control through services like Azure Key Vault.
• Microsoft defends your data. Microsoft directs government requests for your data to you, gives no government direct or unfettered access, and challenges demands in court where it can lawfully do so Privacy and data management overview^[4].

These are contractual promises, grounded in the Product Terms and the Data Protection Addendum and validated by third-party audits such as ISO/IEC 27018 and ISO/IEC 27701, not a product you turn on Privacy and data management overview^[4]. Hold that difference: the principles describe what Microsoft will do, while the next section covers Priva, the product you run on your own data.

Everything so far pointed from Microsoft to you. Microsoft Priva points the other way: it is the product you operate on your own tenant to manage the personal data you hold Learn about Microsoft Priva^[3]. Privacy regulations such as the GDPR give individuals rights over their personal data and make your organization accountable for it, so you first need to know what personal data you have and where the risks are.

Priva Privacy Risk Management

Priva's Privacy Risk Management solution gives you visibility into the personal data across your Microsoft 365 services, Exchange Online, SharePoint, OneDrive for Business, and Teams, identifying it with the same data classifications and sensitive information types that underpin Microsoft Purview Learn about Microsoft Priva^[3]. It then flags privacy risks through built-in policy templates Priva Privacy Risk Management^[5]:

• Data minimization, to find and reduce personal data your organization keeps but no longer needs.
• Data overexposure, to catch personal data that is accessible to too many people.
• Data transfers, to spot personal data moving across departments or regional borders.

When a policy matches, Priva raises an alert and offers remediation such as making an item private, notifying its owner, or tagging it for review Priva Privacy Risk Management^[5]. Priva evaluates only data inside your Microsoft 365 environment and sources you register through Purview; it does not reach a user's personal account. Do not confuse it with Purview's information protection tools, sensitivity labels, data loss prevention, and retention (information protection and governance), which classify and protect data broadly. Priva is specifically about privacy risk in personal data.

From finding data to answering a request

Knowing where personal data lives is what lets you answer a data subject request (DSR, also called a subject rights request), an individual's demand to see, correct, export, or delete the personal data you hold on them under laws like the GDPR Data Subject Requests^[6]. The lifecycle is the same everywhere: someone submits a request, you locate their personal data in Microsoft 365, review and collate the matches, decide what to include and redact the rest, then respond by producing, correcting, or deleting it. Locating and producing that data across Microsoft 365 is handled with Microsoft Purview eDiscovery Microsoft Purview eDiscovery^[7], covered in the insider risk, eDiscovery, and audit subtopic. Keep the division of labor the exam tests: Priva finds personal data and reduces its risk across your tenant, while Purview eDiscovery locates and produces one individual's data to satisfy a request.

These topics appear as short which-surface and privacy-versus-security questions. Anchor on direction and on who owns the data.

Where is Microsoft's audit report? The Service Trust Portal. If a stem asks for Microsoft's SOC 2, ISO/IEC certificate, or FedRAMP documentation, it is STP, not Compliance Manager and not the Purview portal.

Where do I measure my own compliance? Microsoft Purview Compliance Manager, which scores your tenant and lists improvement actions (its own Purview compliance management subtopic). STP shows Microsoft's evidence; Compliance Manager measures yours.

Which product finds personal data and privacy risk in my Microsoft 365? Microsoft Priva, through Privacy Risk Management. Purview information protection labels and protects data broadly; Priva is about privacy risk in personal data specifically.

Privacy or security? Privacy is the appropriate handling of personal data and the rights people have over it; security is protecting data from unauthorized access. A stem about consent, data subject rights, or personal-data handling is privacy; a stem about blocking attackers is security. The security and compliance concepts subtopic defines the split.

Name the four privacy principles. You control your data; you know where it is located; it is secured at rest and in transit; Microsoft defends it. If an option offers a fifth principle that is really a product feature, it is a distractor.