Where Does My Microsoft Entra ID Data Reside? Understanding Azure Regions and Data Residency
Hello everyone! Zoheb Shaikh here again. I’m a Senior Cloud Solution Architect with Microsoft, based in Doha, Qatar. It’s been almost three years since my last blog, and I’m happy to be back sharing another interesting customer conversation. This time, we’ll explore what the new Saudi Azure region really means for Microsoft Entra ID and data residency. I was recently having a conversation with a customer about Microsoft’s announcement of the Saudi Arabia East Azure region, which is expected to become available in November 2026. Naturally, there was a lot of excitement around it. We started discussing what this means for workloads, applications, data, resiliency and, of course, data residency. And then came a very simple question. “Great. So once the Saudi Azure region is available, our Microsoft Entra ID will also be in Saudi, right?” It is actually a very good question. And I think this is something we are going to hear more often as local Azure regions become available across different countries. My answer was: “Not exactly. Azure region availability and Microsoft Entra ID data residency are two different things.” And that started an interesting conversation. “But Entra runs on Azure, right?” Yes, But this is where we need to understand the difference between a workload that we deploy into Azure and a cloud service that Microsoft operates for us. Think about a normal Azure workload, you want to deploy a VM > Azure asks you: Where do you want to deploy it? Saudi Arabia East, UAE North, UK South, West Europe. You select the region based on your requirements. The same concept applies to many other supported Azure services. With the new Saudi Arabia East region, customers will be able to access supported Microsoft cloud and AI services and host eligible workloads and data locally in the Kingdom. Microsoft has announced that the region will also include three Availability Zones. That is the Azure region conversation But Microsoft Entra ID is different. You don’t create your Microsoft Entra tenant and then say: “Deploy my Entra tenant into Saudi Arabia East.” That is not how the service is designed. So how does Microsoft Entra actually work? This is where the architecture becomes interesting. Microsoft Entra ID is designed as a geographically distributed identity service. When an Entra tenant is created in the public cloud, the country or region selected during tenant creation is mapped by Microsoft Entra to a geo-location and a scale unit. Microsoft’s documentation currently lists geo-locations such as EMEA, North America, Asia/Pacific, Japan, Australia and Worldwide. The tenant location isn’t simply determined by where you later deploy your Azure VMs or applications. I explained it to the customer like this. If you deploy an application into Azure, you are largely deciding: “Where should my workload run?” For Microsoft Entra, Microsoft is managing a global identity platform and deciding: “How do we keep identity available, resilient and responsive while respecting the service’s data-residency architecture?” They are two very different design problems. Then the customer asked the next obvious question “Why does Entra need to work this way?” And this is probably my favourite part of the discussion. Imagine your company’s entire authentication service was dependent on one datacenter. Your users are signing in, Your applications are authenticating, Microsoft 365 depends on identity, Azure depends on identity. Thousands of applications may depend on the same identity platform and now imagine that datacenter has a problem. Identity is one of those services where availability really matters, this is one of reasons Microsoft Entra uses a distributed architecture. Microsoft’s published architecture describes a directory partition as having a primary replica and multiple secondary replicas. The primary replica handles writes, Before a write is acknowledged as successful, Microsoft Entra replicates that write to a secondary replica in another datacenter. Reads work differently, Directory reads, including authentication requests, can be serviced by secondary replicas that are geographically distributed. Microsoft routes these requests so that they can be serviced from datacenters close to customers. Now the architecture starts making more sense. It isn’t distributed randomly, It is distributed because the identity platform needs to provide things such as: availability, resiliency, performance and data durability. “So when I authenticate, am I always talking to where my directory data is stored?” Not necessarily in the way we traditionally think about it. This was another useful part of our conversation. Microsoft documents the Microsoft Entra authentication service itself as stateless. The directory data required for authentication resides in the Microsoft Entra Core Store. When users authenticate, Microsoft can route them to an authentication service instance in the geographically nearest datacenter that forms part of the applicable Microsoft Entra logical region. This is an important concept. The place from which a service responds to you and the place where the underlying authoritative data is managed do not always have to be the same thing. That is quite normal in large cloud services. And then came the real question: “Where is my data?” This is where I normally slow the conversation down a little. Because there are actually a few different questions hiding inside that one question. The customer might be asking: Where does my application data reside? Or Where does my Microsoft Entra directory data reside? Or Where is my authentication request being processed? Or perhaps the actual concern is Do I meet a specific regulatory requirement? These questions sound similar. But technically, they are not the same. For Microsoft Entra ID, Microsoft’s public documentation says the country/region selected during tenant creation is mapped to a Microsoft Entra geo-location and a scale unit. Microsoft Entra Core Store data is then managed according to that geo-location, considering areas such as performance, usability, residency and other requirements. That is why simply saying: “I have an Azure datacenter in my country, therefore every Microsoft cloud service must now store its data there” would be an oversimplification. There is actually an interesting Saudi-specific detail here At this point the conversation usually gets a little more interesting. Microsoft’s public documentation explains that Microsoft Entra directory location is determined when the tenant is originally created. Changing the country code later doesn’t move the directory data location. There is also some historical behaviour worth understanding. Microsoft documents that several country codes — including Saudi Arabia, UAE, Qatar, Bahrain, Kuwait and Oman — were mapped to the Asia region until 2013 and later mapped to Europe. As a result, tenants from those countries created before July 2013 can be provisioned differently from tenants created afterward. Why do I like this example? Because it makes one thing very clear: You shouldn’t determine your Microsoft Entra data location simply by looking at where your Azure workloads are deployed today but tenant provisioning history matters as well. “Okay, but is distributed data less secure?” This is another place where two conversations sometimes get mixed together. Data residency and security are related, but they are not the same thing. Data residency generally talks about where data is geographically stored. Security talks about how that data and the service around it are protected. Microsoft documents several protections around the Entra service. For example, Microsoft Entra directory data is signed and encrypted while it is being transferred between datacenters within a scale unit, and customer-facing web services use TLS. Microsoft also documents tenant-isolation controls around the Entra Core Store. Microsoft Entra also uses geographically distributed replicas, automated routing, monitoring and failover as part of its service architecture. So I wouldn’t look at a distributed architecture and conclude: “The data isn’t sitting in my local Azure region, therefore it is less secure.” That isn’t the right comparison. But I also wouldn’t say: “The service is secure, therefore data residency doesn’t matter.” That isn’t correct either. Security and regulatory residency are two different conversations This is probably the most important takeaway from the whole discussion. Imagine a customer tells me: “Our concern is security.” Then we should discuss the security architecture, tenant isolation, encryption, authentication controls, privileged access, service resilience and the controls Microsoft has put around the service. But imagine the customer says: “Our regulator specifically requires this category of data to be stored within Saudi Arabia.” That becomes a data-residency and compliance conversation. The right thing to do in that situation is not to make an assumption based on the availability of a local Azure region. Instead, check the official Microsoft documentation for the specific service and the specific data type involved. Microsoft’s Trust Center provides service-specific information for Microsoft Azure, Microsoft 365, Microsoft Entra ID, Intune, Defender and other cloud services. This is important because not every Microsoft cloud service follows exactly the same data-storage architecture. Back to the Saudi Azure region, So after all of this, we came back to where our conversation started. What does Saudi Arabia East actually change? A lot. Microsoft has announced that Saudi Arabia East will allow government and private-sector organizations to access supported Microsoft cloud and AI services and host eligible workloads and data locally in the Kingdom. The region will contain three Availability Zones, providing another important building block for organizations designing resilient local architectures. For customers running Azure applications, data platforms, infrastructure and AI workloads, this is a very significant development. But does that automatically mean an existing Microsoft Entra tenant moves into the Saudi Arabia East Azure region? No, And that shouldn’t really be surprising once we understand how Microsoft Entra is designed. The easiest way I explain it By the end of the conversation, I normally reduce everything into two simple questions. Azure Region is “Where do I want to deploy my workload?” For eligible Azure services, Saudi Arabia East gives customers another local option. Microsoft Entra ID “How does Microsoft’s identity service manage and protect my directory data?” That involves Microsoft Entra geo-locations, scale units, replicas and a geographically distributed service architecture. And then there is a third question which is equally important: Data residency “What does Microsoft commit to regarding the storage of my specific data for this specific cloud service?” That answer should always come from the relevant service documentation rather than from assumptions about where the nearest Azure datacenter happens to be. One last thought I actually think conversations like this are healthy. When customers ask “Where is my data?”, we shouldn’t try to answer the question with one sentence. Because modern cloud architecture doesn’t always work like the datacenter architecture we grew up with. An Azure region. A Microsoft Entra geography. A scale unit. A service endpoint. A replica. A data-residency commitment. They can all be part of the same cloud architecture, but they don’t necessarily mean the same thing. The Saudi Arabia East region is a major step forward for customers wanting to run Azure workloads locally in the Kingdom. And at the same time, it gives us a great opportunity to have a deeper conversation about how global cloud services such as Microsoft Entra ID are actually built. My conversation with the customer started with: “So Entra will now also be in Saudi, right?” By the end, the question had changed to something much better: “What is our actual data-residency requirement, and how does Microsoft Entra meet it?” And I think that is the right conversation to have. References Microsoft announces Saudi Arabia East datacenter region https://news.microsoft.com/source/emea/2026/08/microsoft-announces-saudi-arabia-east-datacenter-region-will-be-available-in-november-2026/ Microsoft Entra ID and data residency https://learn.microsoft.com/en-us/entra/fundamentals/data-residency Microsoft Entra architecture https://learn.microsoft.com/en-us/entra/architecture/architecture Customer data storage and processing for European customers in Microsoft Entra ID https://learn.microsoft.com/en-us/entra/fundamentals/data-storage-eu Microsoft Entra data protection considerations https://learn.microsoft.com/en-us/entra/fundamentals/data-protection-considerations Microsoft Trust Center – Data location https://www.microsoft.com/en-us/trust-center/privacy/data-location I hope this blog helped clarify the difference between Azure regions and Microsoft Entra ID data residency. These are the kinds of interesting customer conversations that I enjoy sharing, and I hope to continue writing more regularly. As always, feel free to share your thoughts, questions or experiences in the comments. I'd love to hear your views! Thanks for reading, and until next time! Zoheb Shaikh Senior Cloud Solution Architect | Microsoft Doha, QatarWhere is Teams meeting hosted?
Hi all, Old memory started to running in my head, and I found Tom Talk's article: Where in the world will my Microsoft Teams meeting be hosted? Where he wrote: "Your Teams conference location is allocated at the time the first joiner joins (not the organiser, but any first joiner) and it is automatically allocated to the conferencing service in the region nearest to that first joiner." Question is. is this still valid? If this is still valid, them any thoughts how about the EU companies which are under the EU privacy regulations and all data should be kept inside EU boundaries. how much this behavior breaks this regulation rule? In case that you are in EU but invite person outside EU, and that person joins faster than you into that meeting.
Microsoft Purview - Compliance Score (Part 3) - HITRUST
Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link: Microsoft Purview - Compliance Score (Part 1) - Overview Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will only be discussing the assessment specific to HITRUST and which Purview components are needed to meet those requirements in the assessment and its associated certification. Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the HITRUST assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. Overview of Document We will be walking through how the HITRUST assessment can be leveraged to meet HITRUST certification and provide quantifiable results for meeting that certification. What is HITRUST Certification? What is the Compliance Manager HITRUST assessment? Process of taking assessment information and score and narrowing to Purview related solutions HITRUST assessment details (Control Family, Purview relevant olutions breakdown and Purview Compliance Score) Use Case Looking at a HITRUST assessment at a high level Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed in side of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Notes It is highly recommended that you run your own HITRUST assessment to see the following information in your own Tenant. Pre-requisites It is highly recommended that you run your own HITRUST assessment to see the following information in your own Tenant. What is HITRUST certification? Here is the definition listed in Microsoft Purview Compliance Manager. “The HITRUST CSF is a single harmonized framework based on recognized security, privacy and compliance standards, regulations and leading practices. Established in collaboration with private sector, government, technology and information privacy and security leaders, the HITRUST CSF can be used by any organization that creates, accesses, stores, or exchanges sensitive information. This template reflects the update from V9.6.” You can also find more information at the HITRUST official website, listed in the Appendix and Links section below. What is the Compliance Manager HITRUST assessment? This is the official Microsoft tool that scans your tenant and compares it to the HITRUST CSF. It then provides a report and workflow on how to meet this certification. Narrowing HITRUST to applicable Purview tools We narrow the scope of from All HITRUST Control Families (21x) the Assessment runs to just the Compliance applicable HITRUST Control Families (6x). Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families. Here is one way to view this All Control Families (21x) -> Compliance applicable Control Families (6x) -> applicable Microsoft Purview tools This graphic shows another way to visualize this. HITRUST Assessment details Let us look at the details of the HITRUST assessment as they related to Microsoft Compliance Purview solutions and your Compliance Score for your Microsoft tenant. All Control Families (21x) The HITRUST assessment will report back on ALL the Control Families that are part of the HITRUST certification. Compliance applicable All Control Families (6x) From a Purview perspective, here are the 6 Control Families that are applicable to HITRUST certification workloads. Relevant Purview Solutions (12x) Now that you know which Control Families are relevant to HITRUST certification, here are the Purview solutions that are part will help you meet those certification needs. Purview Compliance Score Let us look at a diagram the HITRUST assessment’s points that it applies 1) HITRUST Controls over all, 2) points that can specifically be addressed by Purview related tools, and 3) then the percentage of the HITRUST assessment points covered by implementing the Purview tools. Appendix and Links HITRUST Alliance | HITRUST CSF | Information Risk Management Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft LearnMicrosoft Purview - Compliance Score (Part 4) - HIPAA / HITECH
Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link: Microsoft Purview - Compliance Score (Part 1) - Overview Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will only be discussing the assessment specific to Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) and which Purview components are needed to meet those requirements in the assessment and its associated regulations. Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. Overview of Document We will be walking through how the Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) assessment can be leveraged to meet HIPAA / HITECH regulations and provide quantifiable results for meeting those regulations. What are the Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)? What is the Compliance Manager Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) assessment? Process of taking assessment information and score and narrowing to Purview related solutions HIPAA / HITECH assessment details (Control Family, Purview relevant solutions breakdown and Purview Compliance Score) Use Case Looking at a Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) assessment at a high level Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed inside of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Notes It is highly recommended that you run your own Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) assessment to see the following information in your own Tenant. Pre-requisites It is highly recommended that you run your own Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) assessment to see the following information in your own Tenant. What are HIPAA / HITECH? Here is the definition listed in Microsoft Purview Compliance Manager. “The Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) mandate a set of federal requirements for protecting electronic Protected Health Information (ePHI) for U.S. healthcare institutions." You can also find more information at the HIPAA / HITECH official website, listed in the Appendix and Links section below. What is the Compliance Manager HIPAA / HITECH assessment? This is the official Microsoft tool that scans your tenant and compares it to the HIPAA / HITECH It then provides a report and workflow on how to meet these acts. Narrowing HIPAA / HITECH to applicable Purview tools We narrow the scope of from All HIPAA / HITECH Control Families (9x) the Assessment runs to just the Compliance applicable HIPAA / HITECH Control Families (5x). Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families. Here is one way to view this All Control Families (9x) -> Compliance applicable Control Families (5x) -> applicable Microsoft Purview tools This graphic shows another way to visualize this. HIPAA / HITECH Assessment details Let us look at the details of the HIPAA / HITECH assessment as they related to Microsoft Compliance Purview solutions and your Compliance Score for your Microsoft tenant. All Control Families (9x) The HIPAA / HITECH assessment will report back on ALL the Control Families that are part of the HIPAA / HITECH regulations. Compliance applicable All Control Families (5x) From a Purview perspective, here are the 5 Control Families that are applicable to HIPAA / HITECH workloads. Relevant Purview Solutions (10x) Now that you know which Control Families are relevant to HIPAA / HITECH, here are the Purview solutions that are part will help you meet those regulatory needs. Purview Compliance Score Let us look at a diagram the HIPAA / HITECH assessment’s points that it applies 1) HIPAA / HITECH Controls overall, 2) points that can specifically be addressed by Purview related tools, and 3) then the percentage of the HIPAA / HITECH assessment points covered by implementing the Purview tools. Appendix and Links HIPAA for Professionals | HHS.gov HITECH Act Enforcement Interim Final Rule | HHS.gov Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such. Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.Microsoft Purview - Compliance Score (Part 5) - GDPR
Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link: Microsoft Purview - Compliance Score (Part 1) - Overview Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will only be discussing the assessment specific to General Data Protection Regulation (GDPR) and which Purview components are needed to meet those requirements in the assessment and its associated regulation. Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the General Data Protection Regulation (GDPR) assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. Overview of Document We will be walking through how the General Data Protection Regulation (GDPR) assessment can be leveraged to meet GDPR and provide quantifiable results for meeting that regulation. What is the General Data Protection Regulation (GDPR)? What is the Compliance Manager General Data Protection Regulation (GDPR) assessment? Process of taking assessment information and score and narrowing to Purview related solutions GDPR assessment details (control Family, Purview relevant solutions breakdown and Purview Compliance Score) Use Case Looking at a General Data Protection Regulation (GDPR) assessment at a high level Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed inside of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Notes It is highly recommended that you run your own General Data Protection Regulation (GDPR) assessment to see the following information in your own Tenant. Pre-requisites It is highly recommended that you run your own General Data Protection Regulation (GDPR) assessment to see the following information in your own Tenant. What is General Data Protection Regulation (GDPR)? Here is the definition listed in Microsoft Purview Compliance Manager. “The General Data Protection Regulation (GDPR) is a European Union (EU) regulation that mandates how an organization should handle personal data. GDPR is applicable if your organization sells to, provides services to, or employs citizens of the EU.” You can also find more information at the General Data Protection Regulation (GDPR) official website, listed in the Appendix and Links section below. What is the Compliance Manager General Data Protection Regulation (GDPR) assessment? This is the official Microsoft tool that scans your tenant and compares it to the GDPR. It then provides a report and workflow on how to meet this regulation. Narrowing General Data Protection Regulation (GDPR) to applicable Purview tools We narrow the scope of All General Data Protection Regulation (GDPR) Control Families (5x) the Assessment runs to just the Compliance applicable GDPR Control Families (6x). Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families. Here is one way to view this All Control Families (5x) -> Compliance applicable Control Families (5x) -> applicable Microsoft Purview tools This graphic shows another way to visualize this. General Data Protection Regulation (GDPR) Assessment details Let us look at the details of the General Data Protection Regulation (GDPR) assessment as they related to Microsoft Compliance Purview solutions and your Compliance Score for your Microsoft tenant. All Control Families (5x) The General Data Protection Regulation (GDPR) assessment will report back on ALL the Control Families that are part of the GDPR. Compliance applicable All Control Families (5x) From a Purview perspective, here are the 5 Control Families that are applicable to General Data Protection Regulation (GDPR) workloads. Relevant Purview Solutions (12x) Now that you know which Control Families are relevant to General Data Protection Regulation (GDPR), here are the Purview solutions that are part will help you meet those regulatory needs. Purview Compliance Score Let us look at a diagram the General Data Protection Regulation (GDPR) assessment’s points that it applies 1) GDPR Controls overall, 2) points that can specifically be addressed by Purview related tools, and 3) then the percentage of the GDPR assessment points covered by implementing the Purview tools. Appendix and Links General Data Protection Regulation (GDPR) – Official Legal Text (gdpr-info.eu) Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such. Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.Microsoft Purview - Compliance Score (Part 6) - CCPA
Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link: Microsoft Purview - Compliance Score (Part 1) - Overview Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will only be discussing the assessment specific to California Consumer Privacy Act (CCPA) and which Purview components are needed to meet those requirements in the assessment. Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the California Consumer Privacy Act (CCPA) assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. Overview of Document We will be walking through how the California Consumer Privacy Act (CCPA) assessment can be leveraged to meet the California Consumer Privacy Act (CCPA) and provide quantifiable results for meeting that act. What is the California Consumer Privacy Act (CCPA)? What is the Compliance Manager California Consumer Privacy Act (CCPA) assessment? Process of taking assessment information and score and narrowing to Purview related solutions California Consumer Privacy Act (CCPA) assessment details (control Family, Purview relevant solutions breakdown and Purview Compliance Score) Use Case Looking at a California Consumer Privacy Act (CCPA) assessment at a high level Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed in side of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Notes It is highly recommended that you run your own California Consumer Privacy Act (CCPA) assessment to see the following information in your own Tenant. Pre-requisites It is highly recommended that you run your own California Consumer Privacy Act (CCPA) assessment to see the following information in your own Tenant. What is the California Consumer Privacy Act (CCPA)? Here is the definition listed in Microsoft Purview Compliance Manager. “The California Consumer Privacy Act (CCPA) is a California state law that regulates privacy rights and consumer protections for residents of California. This template includes the September 2020 amendments.” You can also find more information at the California Consumer Privacy Act (CCPA) official website, listed in the Appendix and Links section below. What is the Compliance Manager California Consumer Privacy Act (CCPA) assessment? This is the official Microsoft tool that scans your tenant and compares it to the California Consumer Privacy Act (CCPA). It then provides a report and workflow on how to meet this act. Narrowing California Consumer Privacy Act (CCPA) to applicable Purview tools We narrow the scope of from All California Consumer Privacy Act (CCPA) Control Families (21x) the Assessment runs to just the Compliance applicable California Consumer Privacy Act (CCPA) Control Families (6x). Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families. Here is one way to view this All Control Families (21x) -> Compliance applicable Control Families (6x) -> applicable Microsoft Purview tools This graphic shows another way to visualize this. California Consumer Privacy Act (CCPA) Assessment details Let us look at the details of the California Consumer Privacy Act (CCPA) assessment as they related to Microsoft Compliance Purview solutions and your Compliance Score for your Microsoft tenant. All Control Families (10x) The California Consumer Privacy Act (CCPA) assessment will report back on ALL the Control Families that are part of the California Consumer Privacy Act (CCPA) assessment. Compliance applicable All Control Families (10x) From a Purview perspective, here are the 6 Control Families that are applicable to California Consumer Privacy Act (CCPA) assessment workloads. Relevant Purview Solutions (12x) Now that you know which Control Families are relevant to California Consumer Privacy Act (CCPA) assessment, here are the Purview solutions that are part will help you meet those assessment needs. Purview Compliance Score Let us look at a diagram the California Consumer Privacy Act (CCPA) assessment’s points that it applies 1) CCPA Controls overall, 2) points that can specifically be addressed by Purview related tools, and 3) then the percentage of the CCPA assessment points covered by implementing the Purview tools. Appendix and Links California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such. Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.Microsoft Purview - Compliance Score (Part 7) - Data Protection Baseline
Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link: Microsoft Purview - Compliance Score (Part 1) - Overview Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will only be discussing the assessment specific to the Microsoft Data Protection Baseline and which Purview components are needed to meet those requirements in the assessment and its associated certifications and regulations. Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the Microsoft Data Protection Baseline assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. Overview of Document We will be walking through how the Microsoft Data Protection Baseline assessment can be leveraged to meet the multiple certification and regulatory needs and provide quantifiable results for meeting those certification and regulatory needs. What is the Microsoft Data Protection Baseline? What is the Compliance Manager Microsoft Data Protection Baseline assessment? Process of taking assessment information and score and narrowing to Purview related solutions Microsoft Data Protection Baseline assessment details (Control Family, Purview relevant solutions breakdown and Purview Compliance Score Use Case Looking at the Microsoft Data Protection Baseline assessment at a high level. Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed inside of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Notes It is highly recommended that you run your own Microsoft Data Protection Baseline assessment to see the following information in your own Tenant. Pre-requisites It is highly recommended that you run your own Microsoft Data Protection Baseline assessment to see the following information in your own Tenant. What is the Data Protection Baseline assessment? Here is the definition listed in Microsoft Purview Compliance Manager. “The Microsoft 365 data protection baseline is a set of controls that includes common industry regulations and standards. This baseline draws elements primarily from NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization), as well as from FedRAMP (Federal Risk and Authorization Management Program) and GDPR (General Data Protection Regulation of the European Union).” You can also find more information at the Microsoft Data Protection Baseline official website, listed in the Appendix and Links section below. What is the Compliance Manager Microsoft Data Protection Baseline assessment? This is the official Microsoft tool that scans your tenant and compares it to the Microsoft Data Protection Baseline. It then provides a report and workflow. Narrowing Microsoft Data Protection Baseline to applicable Purview tools We narrow the scope of from All Microsoft Data Protection Baseline Control Families (21x) the Assessment runs to just the Compliance applicable Microsoft Data Protection Baseline Control Families (9x). Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families. Here is one way to view this All Control Families (21x) -> Compliance applicable Control Families (9x) -> applicable Microsoft Purview tools This graphic shows another way to visualize this. Microsoft Data Protection Baseline Assessment details Let us look at the details of the Microsoft Data Protection Baseline assessment as they related to Microsoft Compliance Purview solutions and your Compliance Score for your Microsoft tenant. All Control Families (21x) The Baseline assessment will report back on ALL the Control Families that are part of the Microsoft Data Protection Baseline assessment. Compliance applicable All Control Families (9x) From a Purview perspective, here are the 9 Control Families that are applicable to Microsoft Data Protection Baseline workloads. Relevant Purview Solutions (11x) Now that you know which Control Families are relevant to Microsoft Data Protection Baseline, here are the Purview solutions that are part will help you meet those baseline needs. Purview Compliance Score Let us look at a diagram the Microsoft Data Protection Baseline assessment’s points that it applies 1) Baseline Controls overall, 2) points that can specifically be addressed by Purview related tools, and 3) then the percentage of the Baseline assessment points covered by implementing the Purview tools. Appendix and Links Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such. Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.Microsoft Purview - Compliance Score (Part 2) - Sample Assessment Scoring
Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link: Microsoft Purview - Compliance Score (Part 1) - Overview Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will be covering: the goal of this blog series discussing Compliance Manager assessment at a high level and how to leverage them to meet a business need such as HIPAA, GDPR, CCPA, NIST, etc Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the HITRUST assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. Overview of Document We will be walking through: Sample Assessment details and Purview Score Use Case Using Compliance Manager assessments to meeting government regulations or industry certifications. Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed in side of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Regulations – the regulations or standards pertaining to the action (Microsoft) Solutions – the solution where you can go to perform the action Action Types – indicates whether the improvement action is technical, meaning it can be implemented within a solution or product, or non-technical, which would be implemented outside of a technical solution Group - the group to which you assigned the action Categories – the related data protection category (such as, protect information, manage devices, etc.) Notes None Pre-requisites You should have a basic understanding of Compliance Manager and how it works. You can find this information in the blog named “Paint By Numbers” and the official Microsoft documentation found at docs.microsoft.com. You an find links to these in the section below labeled Appendix and Links. You should have read Part 1 of this blog series (Microsoft Purview – Compliance Score Series (Part 1) – Overview). Sample Assessment Details Let us look at a sample of what each blog in this series will look like. All Control Families Section You will first see that ALL the Control Families relevant to your regulation/certification/assessment. Compliance applicable All Control Families Secondly, you will next find the section of the blog that shows you all the Control Families applicable relevant to the your regulation/certification/assessment Relevant Purview solutions You will next find the section of the blog that shows the Purview components relevant to the your regulation/certification/assessment Purview Score Last, you will see your Purview Compliance score for your the certification/regulation/assessment Appendix and Links Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Build and manage assessments in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs About the Microsoft Purview Compliance Manager premium assessment trial - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview Compliance Manager alerts and alert policies - Microsoft Purview (compliance) | Microsoft Docs Get started with Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such. Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.Microsoft Purview - Compliance Score (Part 1) - Overview
Blog Series Part 1 - Microsoft Purview - Compliance Score (Part 1) - Overview Part 2 - Microsoft Purview - Compliance Score (Part 2) - Sample Assessment Scoring Part 3 - Microsoft Purview - Compliance Score (Part 3) - HITRUST Part 4 - Microsoft Purview - Compliance Score (Part 4) - HIPAA / HITECH Part 5 - Microsoft Purview - Compliance Score (Part 5) - GDPR Part 6 - Microsoft Purview - Compliance Score (Part 6) - CCPA Part 7 - Microsoft Purview - Compliance Score (Part 7) - Data Protection Baseline Part 8 - Microsoft Purview - Compliance Score (Part 😎 - ARMA GARP Part 9 - Microsoft Purview - Compliance Score (Part 9) - NIST Privacy Framework Part 10 - Microsoft Purview - Compliance Score (Part 10) - ISO 15489 Disclaimer This document is not meant to replace any official documentation, including those found at docs.microsoft.com. Those documents are continually updated and maintained by Microsoft Corporation. If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed. Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix. All of the following steps should be done with test data, and where possible, testing should be performed in a test environment. Testing should never be performed against production data. Target Audience This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs. Document Scope This document will be covering: the goal of this blog series discussing Compliance Manager assessment at a high level and how to leverage them to meet a business need such as HIPAA, GDPR, CCPA, NIST, etc Out-of-Scope This document does not cover any other aspect of Microsoft E5 Purview, including: Compliance Manager (configuration) Data Classification Information Protection Data Protection Loss (DLP) for Exchange, OneDrive, Devices Data Lifecycle Management (retention and disposal) Records Management (retention and disposal) eDiscovery Insider Risk Management (IRM) Priva Advanced Audit Microsoft Cloud App Security (MCAS) Information Barriers Communications Compliance Licensing For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner. We will not be walking through the HITRUST assessment step-by-step. For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below. You can also find a blog series covering how to do this and how to run other Purview functions at the following link: Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Overview of Document We will be walking through: the goal of this blog series Compliance Manager and What it does Compliance Score Compliance Manager – finding applicable Microsoft Solutions Use Case Using Compliance Manager assessments to meeting government regulations or industry certifications. Definitions Actions– the things that need to be done to mark a Control as completed and Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment. Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world. Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. Controls – the various requirements in your tenant that must be met to meet a part of an assessment Control Family – a grouping of Controls Microsoft Actions – These are actions that Microsoft has performed in side of your tenant to help it meet a specific assessment. Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment Your Improvement Actions – These are actions that you and your organization must perform to meet a specific assessment. Regulations – the regulations or standards pertaining to the action (Microsoft) Solutions – the solution where you can go to perform the action Action Types – indicates whether the improvement action is technical, meaning it can be implemented within a solution or product, or non-technical, which would be implemented outside of a technical solution Group - the group to which you assigned the action Categories – the related data protection category (such as, protect information, manage devices, etc.) Notes None Pre-requisites You should have a basic understanding of Compliance Manager and how it works. You can find this information in the blog named “Paint By Numbers” and the official Microsoft documentation found at docs.microsoft.com. You an find links to these in the section below labeled Appendix and Links. Overview of this blog series This blog will review specific Microsoft Compliance Manager Assessments and how they relate to Microsoft Purview solutions. Here is a list of the specific assessments: HITRUST for Microsoft 365 HIPAA/HITECH for Microsoft 365 GDPR for Microsoft 365 California Consumer Privacy Act (CCPA) for Microsoft 365 Data Protection Baseline for Microsoft 365 This is not meant to be an exhaustive list as there are 700+ assessments in Compliance Manager as of the writing of this blog. Overview of Compliance Manager and What it does Here is the official answer as listed in docs.microsoft.com “Microsoft Purview Compliance Manager is a feature in the Microsoft Purview compliance portal that helps you manage your organization’s compliance requirements with greater ease and convenience. Compliance Manager can help you throughout your compliance journey, from taking inventory of your data protection risks to managing the complexities of implementing controls, staying current with regulations and certifications, and reporting to auditors.” Compliance Manager – What does it scan and track? Each assessment in Microsoft Purview Compliance Manager tracks all the regulatory/certification requirements relative to your Microsoft 365/Office 365 environment. Here is a visualization on how this scanning and tracking works. Compliance Score Here is the official definition as found in docs.microsoft.com. The URL can be found in t Appendix and Links section below. “Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture. Compliance Manager gives you an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance.” Compliance Manager – Finding Applicable Microsoft Solutions Built into Compliance Manager is a way to review which Microsoft Solutions will be applicable to each certification/regulation along with the Compliance Score that each of these solutions will bring to your organization. Go to Compliance Manager -> Solutions Here you will see all the Microsoft solutions that are applicable to the assessments you have run. On the right hands side, click Filters You can filter these solutions based on various criteria: Regulations – the regulations or standards pertaining to the action (Microsoft) Solutions – the solution where you can go to perform the action Action Types – indicates whether the improvement action is technical, meaning it can be implemented within a solution or product, or non-technical, which would be implemented outside of a technical solution Group - the group to which you assigned the action Categories – the related data protection category (such as, protect information, manage devices, etc.) You can filter any of these criteria, but we will choose Regulation -> Data Protection Baseline for purposes in this blog. This will narrow ALL Microsoft Solutions down to just the ones relevant to a particular Assessment/Regulation/Certification. You can narrow this further by Categories. Here I will select the categories relevant to Purview/Compliance workloads: Discover and Respond, Govern information, Manage compliance, Privacy Management, and Protect information. For now, we will not run any other filters inside the Compliance Manager -> Solutions section. Returning to the Solutions page, we will now look at the two columns relevant to your Compliance Score: Current score contribution and Potential score remaining. These will allow you to know which Microsoft Solutions will provide the most value to meeting your regulation/certification needs. We are now done with looking at the Compliance Manager – Solutions page. Microsoft Managed Scoring Compliance Manager keeps track of both 1) the organizations responsibilities (ie. Your organization) and 2) Microsoft’s responsibilities, as they pertain each assessment, and then maps a score to those responsibilities. Here is an example of where you would find both of these scores in a Compliance Manager assessment that I have already run. I have gone to Compliance Manager -> Assessment -> HITRUST Then go to Progress tab on the right side to find the Your points achieved score and Microsoft managed points achieved score. Thank Yous Before finishing this overview, I want to thank the members of the Microsoft Health Life Sciences Purview Technical Specialist team (HLS Purview TS) team for their assistance in creating, researching and developing this blog series. This includes, but is not limited to: Erfan Setork, Ken Sicinski, and Chad Lightfoot. Appendix and Links Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Build and manage assessments in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs About the Microsoft Purview Compliance Manager premium assessment trial - Microsoft Purview (compliance) | Microsoft Docs Microsoft Purview Compliance Manager alerts and alert policies - Microsoft Purview (compliance) | Microsoft Docs Get started with Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Learn Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community Note: This solution is a sample and may be used with Microsoft Compliance tools for dissemination of reference information only. This solution is not intended or made available for use as a replacement for professional and individualized technical advice from Microsoft or a Microsoft certified partner when it comes to the implementation of a compliance and/or advanced eDiscovery solution and no license or right is granted by Microsoft to use this solution for such purposes. This solution is not designed or intended to be a substitute for professional technical advice from Microsoft or a Microsoft certified partner when it comes to the design or implementation of a compliance and/or advanced eDiscovery solution and should not be used as such. Customer bears the sole risk and responsibility for any use. Microsoft does not warrant that the solution or any materials provided in connection therewith will be sufficient for any business purposes or meet the business requirements of any person or organization.
