Microsoft Purview Compliance Manager
Operationalising a risk-based compliance program — assessments, a 500-item improvement action backlog and a full ISO/IEC 27001:2013 control mapping across a Microsoft 365 tenant.
Difficulty
Advanced
Environment
Microsoft 365 / Purview
Deployment
Production
Est. Implementation
60–90 minutes
Executive Summary
This project documents an end-to-end configuration of Microsoft Purview Compliance Manager, the risk-based compliance scoring and workflow engine embedded in the Microsoft Purview compliance portal, operated against a tenant with an active compliance program already in flight.
The lab starts from a 59% compliance score (13,354.39 of 22,416 points), works two active assessments — AI Baseline and Data Protection Baseline for Microsoft 365 — prioritises a 500-item improvement action backlog by risk impact, reviews a 391-item regulation catalog, and maps the full ISO/IEC 27001:2013 control set (233 controls, 347 Microsoft actions) for certification readiness.
Business Problem
The organisation needed a single system of record for compliance posture instead of tracking hundreds of controls across spreadsheets, SharePoint sites and email threads, which does not scale and produces inconsistent evidence when auditors ask "prove it".
Manual control tracking cannot keep pace with simultaneous regulatory pressure — data protection laws, industry-specific standards, national frameworks and voluntary certifications such as ISO/IEC 27001 — while a 500-item improvement action backlog needs risk-based prioritisation, not alphabetical processing.
Business Risks
- 500 open improvement actions, many showing a Failed – High Risk test status, with no structured prioritisation
- Inability to demonstrate shared-responsibility coverage between Microsoft-managed and customer-managed controls
- Unpreparedness for an ISO/IEC 27001:2013 certification or surveillance audit across 233 applicable controls
Compliance Concerns
- Data Protection Baseline and AI Baseline assessments for Microsoft 365
- ISO/IEC 27001:2013 Annex A control mapping toward ISMS certification readiness
Solution Overview
Compliance Manager was reviewed from the Overview dashboard to confirm the starting 59% compliance score, split between 946.39 of 9,915 customer-managed points and 12,408 of 12,501 Microsoft-managed points, before drilling into the two active assessments.
The 500-item improvement action register was filtered to Test status: Failed - High Risk and sequenced by identity and access controls first, then device compliance, then data protection, while the Regulations catalog (391 templates) and the ISO/IEC 27001:2013 control mapping (233 controls, 347 Microsoft actions) were reviewed to plan certification-readiness work and export audit-ready reports.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Purview Compliance Manager
Risk-based compliance scoring and workflow engine in the Purview compliance portal
Assessments
Data Protection Baseline for Microsoft 365 and AI Baseline, tracked at 61% and 64% progress
Improvement Actions register
500-item filterable compliance backlog spanning technical and operational controls
Regulations catalog
391 regulatory and industry templates spanning data protection, AI governance and premium frameworks
ISO/IEC 27001:2013 mapping
233 Annex A controls and 347 Microsoft/Azure Control Framework actions
Lab Environment
- Portal
- Microsoft Purview compliance portal (compliance.microsoft.com)
- Starting compliance score
- 59% (13,354.39 of 22,416 points)
- Active assessments
- AI Baseline (64%), Data Protection Baseline for Microsoft 365 (61%)
- Improvement actions tracked
- 500 (37 completed, 0 out of scope)
- Regulations catalog reviewed
- 391 templates, 3 of 3 purchased licenses available
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Sign in to the Microsoft Purview compliance portal and review the Overview dashboard to confirm the starting compliance score and Microsoft-managed versus customer-managed point split.
- Sign in with an account holding the Compliance Manager Administrator role
- Review the Overall compliance score gauge and the points-achieved breakdown
- Review the Key improvement actions table for the highest-impact unresolved items
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Illustrative Compliance Manager export scaffold
# Illustrative scaffold - this lab was performed entirely through the Purview compliance portal UI.
Connect-IPPSSession -UserPrincipalName admin@yourtenant.onmicrosoft.com
# Illustrates how improvement action export could be automated via the Microsoft Graph Compliance Manager APIs
Get-ComplianceManagerAssessment | Select-Object AssessmentName, Progress, PointsAchievedConfiguration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Validation
Baseline compliance score confirmed
Overview dashboard verified 59% overall - 13,354.39 of 22,416 points achieved - Pass
Active assessments reviewed
AI Baseline at 64% (2 of 80 actions) and Data Protection Baseline at 61% (36 of 489 actions) - Pass
Improvement actions backlog triaged
500 improvement actions reviewed and filtered by Test status: Failed - High Risk - Pass
ISO/IEC 27001:2013 mapping reviewed
233 Annex A controls and 347 Microsoft actions confirmed under the regulation entry - Pass
Challenges
Score is point-weighted, not count-weighted
Assessment progress percentages did not track linearly with completed action counts, since a few high-point actions outweigh many low-point actions - required prioritising by point value rather than backlog size.
500-item backlog risked appearing unmanageable
Segmenting improvement actions by test status and point value converted an unstructured 500-item list into an ordered, workable remediation sprint plan.
Lessons Learned
- The compliance score is a communication tool, not the goal - chasing the percentage without validating genuine control implementation risks an audit that fails despite a high displayed score.
- Customer-managed points are where the real remediation work is - Microsoft-managed points arrive largely through the shared-responsibility model.
- ISO/IEC 27001 pre-built Azure Control Framework mapping (347 actions, 233 controls) is a substantial accelerator for certification readiness compared with manual cross-referencing.
- Evidence staleness is a silent risk - a Passed test status from months ago, without recurring verification, is a weaker audit position than an honest Not Assessed with a scheduled test date.
Business Impact
59%
Baseline Compliance Score
500
Improvement Actions Tracked
391
Regulatory Templates Reviewed
233
ISO/IEC 27001 Controls Mapped
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
Microsoft-Purview-Compliance-Manager
PublicEnterprise implementation of Microsoft Purview Compliance Manager - compliance assessments, improvement action remediation and ISO/IEC 27001:2013 control mapping.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon