In a Microsoft 365 environment, where security controls are distributed across services such as Defender, Intune, and Entra, what governance approaches or integrated reporting methods does Microsoft recommend to consistently map and demonstrate these controls against frameworks like NIST or SOC 2 in an audit context?