Microsoft Compliance Score: How to Raise It in Compliance Manager
Microsoft Compliance Score is the number shown on the Microsoft Purview Compliance Manager dashboard, and it moves only when an improvement action is implemented and its test status is Passed. The score starts from the Microsoft 365 data protection baseline assessment every tenant gets, and the fastest points come from a short list of technical actions that Compliance Manager tests automatically. This guide explains how the points work, which roles and assessments to set up, how to work the actions in the right order, and a 90-day sequence that raises the score for the right reasons.
What the score is and where it lives
Compliance Manager is a solution in the Microsoft Purview portal (purview.microsoft.com, under Solutions). Its dashboard shows one overall compliance score, which Microsoft describes as a measure of your progress in completing the recommended improvement actions within controls. Three properties matter before you try to move it:
- It is derived from assessments. Every tenant starts with the Microsoft 365 data protection baseline assessment, and each assessment you add brings its own actions and points.
- It counts two kinds of points: those Microsoft earns for the controls it operates in the service, which appear the moment you open the tool, and those you earn by implementing and testing the actions that are yours.
- It updates within 24 hours of a change in an action's status.
Microsoft also states that the score does not certify compliance with any regulation; an auditor wants the assessment report and the evidence behind each action, so the steps below treat the score as the by-product of doing the work in order.
How points are earned
Each improvement action carries a fixed number of points set by two attributes: whether it is mandatory or discretionary, and whether it is preventative, detective or corrective.
| Action type | Points | Example |
|---|---|---|
| Mandatory preventative | 27 | Require MFA for administrators; a control that cannot be bypassed |
| Discretionary preventative | 9 | Security awareness training; a control that depends on people following it |
| Mandatory detective | 3 | Audit logging turned on |
| Mandatory corrective | 3 | An incident response procedure that restores a service |
| Discretionary detective | 1 | A periodic manual access review |
| Discretionary corrective | 1 | A lessons-learned review after an incident |
Points are awarded in full when the action's test status is Passed; a Failed or Not assessed action earns nothing, whatever its implementation status. Microsoft's scoring page sets out the counting rules that explain why the overall score is not the average of the assessment scores: each Microsoft-managed action is counted once, each technical action you manage is counted once across the tenant even when it appears in several assessments, and each non-technical action you manage is counted once per group.
The mandatory preventative technical actions are worth 27 points each and are the ones Compliance Manager tests automatically; that is where the first 90 days go.
Step 1: Give four people the right roles
Compliance Manager has its own role set in the Purview portal, and Microsoft's setup guidance is to assign them rather than hand out Global Administrator:
- Compliance Manager Reader: sees everything, changes nothing. The auditor and the executive sponsor.
- Compliance Manager Contribution: edits improvement actions, updates status, uploads evidence. Each control owner.
- Compliance Manager Assessment: creates and manages assessments and templates. The compliance lead.
- Compliance Manager Administration: everything above plus settings such as automated testing. One person, plus a deputy.
Global Reader and Compliance Administrator in Entra ID also see or manage Compliance Manager, so an existing Compliance Administrator needs no second role. Assign the roles in the Purview portal under Settings, Roles and scopes, and review the list each quarter.
Step 2: Pick the assessments you actually owe
Microsoft's template list marks each regulation as included or premium. The Microsoft 365 data protection baseline is included for every tenant. A set of common regulations, among them the EU GDPR, ISO/IEC 27001 and NIST SP 800-53, is included with Microsoft 365 E5 and the E5 compliance add-ons. Everything else, from HIPAA and SOC 2 to the state privacy laws and CMMC, is a premium template licensed per template: the Compliance Manager Premium Assessment Add-On is $500.00 per month on an annual commitment ($6,000.00 per year), or $600.00 month to month, Microsoft list price, October 2026 price list.
Add a template only when someone outside the company will ask you to prove it: a customer questionnaire, a cyber insurance application, a regulator or an auditor.
To create one: Assessments, Add assessment, choose the regulation, name it, choose the group and the services in scope, create. The actions populate at once, with the technical ones already carrying the status the baseline found.
Where a regulation needs an interpretation as well as a template, the fixed-price assessments do that work: HIPAA Compliance Assessment for Microsoft 365 ($4,950 per project), SOC Compliance Readiness Check ($15,000 per project), CMMC and NIST 800-171 Compliance Readiness Assessment (from $12,500) and FINRA and SEC 17a-4 Compliance for Microsoft 365 ($4,950 per project).
Step 3: Work the improvement actions by points, not by list order
Open Improvement actions, filter to Your actions, and sort by points. The first page is the same in most tenants: MFA, Conditional Access, legacy authentication blocked, a DLP policy, a retention policy, sensitivity labels published, audit logging, Defender preset security policies and Intune compliance policies. These are technical, mandatory preventative, and tested automatically from Secure Score signals.
For each action:
- Assign an owner and a due date from the action's detail page; an unowned action does not get done.
- Set the implementation status: Not implemented, Implemented, Alternative implementation, Planned or Out of scope. Out of scope needs a reason in the notes, because an auditor will ask.
- Record implementation notes that say what was configured and where (policy name, portal, date).
- Upload evidence: an export of the policy, a dated screenshot, the change ticket.
- Set the test status, or let automated testing set it for the technical actions, and record the test date.
Work the 27-point actions first, then the 9-point policy and training actions, and leave the 1-point items for the quarter after. The technical actions are the work of the Microsoft 365 Security Baseline and Secure Score Remediation ($3,450 per project), which closes them in the Defender, Entra and Purview portals and leaves the evidence in the action record.
Step 4: Evidence and testing that survive an audit
Two settings decide whether the score means anything in an audit. First, turn on automated testing in Compliance Manager settings, so the technical actions are retested from Secure Score and a control that drifts (someone turns off a Conditional Access policy) changes the test status by itself. Second, for every non-technical action, make the test a real one: a named tester, a test date, a result, and the document the tester read. A test status of Passed with no evidence attached is the finding auditors write first.
Export the assessment report at the end of each quarter and file it with the policy exports it refers to, because the report is a point-in-time record and the tenant will have changed by the audit. The Compliance Evidence and Audit Readiness Retainer ($950 per month) does that quarterly cycle: retest, refresh the evidence, export, and hand the auditor a folder instead of a portal login.
A 90-day sequence
| Days | Work | What moves |
|---|---|---|
| 1 to 10 | Assign the four roles; export the starting assessment report; filter Your actions by points; give every 27-point action an owner | Nothing yet; the baseline is recorded |
| 11 to 30 | Close the technical actions: MFA, Conditional Access, legacy authentication, DLP in simulation, a retention policy, labels, audit, preset security policies, Intune compliance; turn on automated testing | The 27-point actions pass as Secure Score picks them up |
| 31 to 60 | Write and approve the 9-point documents: acceptable use, incident response, access review procedure, vendor management; test each with a named tester and a date | The discretionary preventative actions pass with evidence |
| 61 to 90 | Add the assessment for the regulation you owe (premium template if required); map its actions to the ones already passed; schedule the rest by quarter; export the report | The new assessment inherits the shared technical actions at once |
Do not set a target number at the start. The total available depends on which assessments you add, so the right measure is the share of mandatory preventative actions passed and the age of the oldest open one. The score follows.
Compliance Manager, Secure Score and Defender for Cloud
| Tool | Question it answers | Scope | Where |
|---|---|---|---|
| Microsoft Secure Score | How well is the tenant's security configured? | Entra ID, Microsoft 365 apps, Defender, Intune | Microsoft Defender portal |
| Compliance Manager (compliance score) | How much of the control set a regulation requires has been implemented and tested, with evidence? | Microsoft 365 services plus anything you track by hand | Microsoft Purview portal |
| Defender for Cloud regulatory compliance | Do Azure and connected cloud resources meet a security benchmark or regulatory standard? | Azure, AWS, GCP, on-premises servers through Azure Arc | Defender for Cloud in the Azure portal |
Secure Score is the engine behind Compliance Manager's automated testing: when a Secure Score recommendation is satisfied, the matching improvement action is marked Passed. The order of work is Secure Score first, Compliance Manager second, and Defender for Cloud only when you run workloads in Azure.
Licensing
Compliance Manager comes with the Microsoft 365 enterprise suites; what differs by tier is the templates and the depth of the Purview features its actions refer to. Microsoft list prices from the October 2026 price list, per user per month on an annual term:
- Microsoft 365 E3 ($39.00): Compliance Manager with the data protection baseline, and the basic retention, labeling and DLP features many actions require.
- Microsoft 365 E5 ($60.00): the included regulatory templates, plus the premium Purview features the higher-value actions depend on.
- For an E3 tenant that needs the E5 compliance features without the full suite: the Purview Suite ($12.00), or the smaller E5 Information Protection and Governance ($7.00), E5 eDiscovery and Audit ($6.00) and E5 Insider Risk Management ($6.00) add-ons.
- Premium assessment templates: $500.00 per template per month on an annual commitment, as above.
Microsoft subscription charges are always the customer's own; IT Partner's fixed-price services are quoted in writing before work begins.
Frequently asked questions
Is Microsoft Compliance Score the same as Secure Score?
No. Secure Score measures security configuration in the Defender portal; the compliance score measures how many of the improvement actions your assessments require have been implemented and tested. Secure Score feeds Compliance Manager's automated testing.
What is a good compliance score?
There is no published target, because the total available depends on which assessments you add. Measure against your own starting report, and use the share of mandatory preventative actions that have passed as the working number; those are worth 27 points each and are the ones auditors check first.
How often does the score update?
Microsoft states that a change to an action's status appears on the dashboard within 24 hours. Automated testing retests the technical actions from Secure Score signals, so a control that is switched off shows up as a drop.
Does a high compliance score mean we are compliant?
No. Microsoft says the score does not certify compliance, and an auditor assesses the evidence behind each action, not the number. Treat it as a progress measure for a control set you chose deliberately.
Which assessment templates are included?
The Microsoft 365 data protection baseline is included for every tenant. A set of common regulations, including the EU GDPR, ISO/IEC 27001 and NIST SP 800-53, is included with Microsoft 365 E5 and the E5 compliance add-ons. Other regulations are premium templates licensed per template.
Sources
- Microsoft Purview Compliance Manager — Microsoft Learn, checked 2026-10-11
- Compliance score calculation — Microsoft Learn, checked 2026-10-11
- Get started with Compliance Manager (setup, roles and permissions) — Microsoft Learn, checked 2026-10-11
- Build and manage assessments in Compliance Manager — Microsoft Learn, checked 2026-10-11
- Working with improvement actions in Compliance Manager — Microsoft Learn, checked 2026-10-11
- Compliance Manager regulations and templates list — Microsoft Learn, checked 2026-10-11
- Microsoft Purview licensing guidance — Microsoft, checked 2026-10-11
Key takeaways
- Microsoft Compliance Score is the number on the Purview Compliance Manager dashboard; it starts from the data protection baseline assessment and updates within 24 hours of a status change.
- Points are fixed per action: 27 for mandatory preventative, 9 for discretionary preventative, 3 for mandatory detective or corrective, 1 for discretionary detective or corrective, and only a Passed test earns them.
- Assign the four Compliance Manager roles instead of Global Administrator, and add only the assessments someone outside the company will ask you to prove.
- Work the 27-point technical actions first with automated testing on; they are the MFA, Conditional Access, DLP, retention, labeling, audit and Intune items Secure Score already measures.
- Evidence attached to each action and a quarterly exported report are what an auditor reads; the score itself does not certify compliance.
- Premium assessment templates are $500.00 per template per month on an annual commitment; the EU GDPR, ISO/IEC 27001 and NIST SP 800-53 templates are included with Microsoft 365 E5.
If the actions are closed but the evidence lives in people's heads, the Compliance Evidence and Audit Readiness Retainer ($950 per month, quoted in writing before work begins) retests the actions, refreshes the evidence and exports the assessment report every quarter, so the audit starts from a folder rather than a portal login.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.