Topic hub / 45 guides
Compliance on Microsoft 365
Frameworks ask for controls and evidence; Microsoft 365 produces both when it is configured for it. These guides map each requirement to the Entra, Intune, Purview and Defender settings that satisfy it.
Start here
2026-09-27NewSOC 2 on Microsoft 365: Mapping the Trust Services Criteria to Entra, Intune, Purview and Defender EvidenceHow SOC 2 criteria map to Entra, Intune, Purview and Defender evidence, what auditors export, the gaps Microsoft 365 cannot close, and Type I vs Type II.ComplianceSecurityMicrosoft 3652026-10-11NewHIPAA on Microsoft 365: A Real Implementation ModelImplement HIPAA safeguards in Microsoft 365 with identity, device, DLP, sharing, audit, evidence, and licensing controls for healthcare ePHI.ComplianceSecurityMicrosoft 365Purview2026-09-20NewThe Cyber Insurance Questionnaire: Where the Microsoft 365 Evidence for Each Question LivesThe questions cyber insurers ask, and for each one the Microsoft 365 control, the report or export that proves it, and the role that can pull it.SecurityComplianceMicrosoft 365
Services that do the work
Fixed-price engagements, quoted in writing before work begins and paid after you approve delivery. Prices are the published catalog prices.
- Microsoft Purview Records Management Implementation — $4,950 per project · 3 weeks
- Microsoft Purview eDiscovery Premium Implementation — $3,950 per project · 2 weeks
- Microsoft Purview Data Lifecycle Management Implementation — $4,500 per project · 30 days
- CMMC Self-Assessment Assistance — $4,000 per project · 30 days
- Microsoft Purview Insider Risk Management Implementation — $4,950 per project · 4 weeks
- Microsoft 365 Commercial to GCC High Migration — From $25,000 (scoped by tenant and CUI boundary) · 12 weeks
- CMMC and FedRAMP Readiness Assessment — $25,000 per project · 60 days
- Microsoft Purview eDiscovery Search Assistance — $500 per project · 5 days
Calculators and plan pages
- Microsoft Purview Suite — plan page with every term and billing option at Microsoft's list price
- Microsoft 365 E5 — plan page with every term and billing option at Microsoft's list price
All 45 guides, newest first
2026-10-11Accessibility in Microsoft Teams: Inclusive Collaboration in 2026Microsoft Teams has evolved from a chat and meeting app into an inclusive collaboration hub. With the right user settings, meeting options, and admin…TeamsMicrosoft 365AdoptionCompliance2026-10-11NewCISA's SCuBA Secure Configuration Baselines for Microsoft 365: What They Require, How to Check Your Tenant with ScubaGear, and What to Fix FirstWhat CISA's SCuBA secure configuration baselines require of a Microsoft 365 tenant, how to run ScubaGear and read its report, and which findings to fix first.SecurityComplianceMicrosoft 365Entra ID2026-10-11NewCompliance Certifications and Microsoft 365: A Complete GuideMicrosoft's SOC and ISO reports cover Microsoft, not your tenant. Five evidence steps, the 180-day audit log rule, and what each plan adds at list price.CompliancePurviewMicrosoft 365Licensing2026-10-11NewCopilot Oversharing: The Hidden Risk and How to Fix ItMicrosoft 365 Copilot exposes overshared SharePoint, Teams, OneDrive, guest and OAuth access. The checks, the remediation order, and what to monitor after.Copilot and AIPurviewSharePointSecurity2026-10-11NewGovernment Tenants: GCC vs GCC High vs Commercial — A Practical Decision GuideChoose the right Microsoft 365 tenant for CUI, DFARS, CMMC, ITAR, CJIS, and public-sector data before migration and audits create risk.ComplianceMicrosoft 365Security2026-10-11NewGDPR Data Discovery in Microsoft 365: Purview and Auditor EvidenceFind EU personal data in Exchange, SharePoint, OneDrive and Teams with Purview: what Business Premium, E3 and E5 include, and what auditors accept.PurviewComplianceHow-to2026-10-11NewHow Secure Is Microsoft Teams? Defaults, Settings and LimitsTeams encrypts everything in transit and at rest. The risk is six admin defaults and the controls that need Defender for Office 365, E5 or Teams Premium.TeamsSecurityMicrosoft 365Defender2026-10-11NewHow to Run a Microsoft 365 License Audit (and What to Look For)Run a Microsoft 365 license audit to find unused seats, duplicate add-ons, downgrade candidates, and renewal risks before recurring spend grows.Microsoft 365LicensingCost2026-10-11NewExchange Online Data Protection: The Settings That Matter in 2026Nine Exchange Online protection decisions in order: MFA, preset policies, DMARC, forwarding, DLP, encryption, retention, backup and monitoring.Exchange OnlineSecurityPurviewDefender2026-10-11NewSensitivity Labels in Word and Excel: Set Up, Apply, and EnforceCreate and publish Purview sensitivity labels for Word and Excel, apply them from the Home tab, and what Business Premium ($22.00) covers versus E5.PurviewMicrosoft 365ComplianceHow-to2026-10-11NewManaging Data Risk After GDPR: The Microsoft 365 Controls That CountSeven Microsoft 365 controls for post-GDPR data risk: audit retention (180 days or 1 year), labels, DLP, retention, sharing, subject requests and evidence.PurviewComplianceMicrosoft 365Security2026-10-11NewManaging Company Macs with Intune: Enrollment, Platform SSO, Compliance and Conditional Access, and When Jamf Is Still the AnswerManaging company Macs with Intune: ADE enrollment, Platform SSO with Entra ID, compliance and Conditional Access, Defender, and when Jamf still wins.IntuneEntra IDSecurityHow-to2026-10-11NewCopilot Readiness Checklist: Why Many Microsoft 365 Tenants Are Not ReadyAssess Microsoft 365 Copilot readiness: permissions, SharePoint oversharing, identity, Purview, Teams transcripts and a pilot-or-hold decision table.Copilot and AIMicrosoft 365PurviewSecurity2026-10-11NewMicrosoft 365 Copilot vs ChatGPT Business and ChatGPT EnterpriseCopilot vs ChatGPT Business and Enterprise for Microsoft 365 tenants: vendor data statements, Purview coverage, $252 and $360 list prices, buying pattern.Copilot and AIPurviewLicensingMicrosoft 3652026-10-11Microsoft 365 Security Audit Guide for 2026: Steps, Checklist & Best PracticesA nine-step Microsoft 365 security audit with pass criteria for identity, email, sharing, devices, apps and logging, how to read Secure Score, and a P1-to-P3 remediation order.SecurityMicrosoft 365DefenderEntra ID2026-10-11NewMicrosoft Compliance Score: How to Raise It in Compliance ManagerMicrosoft Compliance Score lives in Purview Compliance Manager: how points are earned (27, 9, 3, 1), the roles, which assessments to run, a 90-day plan.PurviewComplianceMicrosoft 365How-to2026-10-11NewMicrosoft Purview Data Security Investigations: What It Does, When to Use It, and What It CostsWhat Purview Data Security Investigations does after a data incident, how it differs from eDiscovery, the Azure pay-as-you-go meters and the limits.PurviewSecurityCompliance2026-10-11NewPurview DSPM for AI: What It Shows About Copilot and ChatGPT UseWhat Purview DSPM for AI reports on Copilot, agents and ChatGPT, the E5 or $12.00 Purview Suite license it needs, and a 14-day setup order.PurviewCopilot and AICompliance2026-10-11Microsoft Teams Governance for 2026: Secure Collaboration Without Slowing Users DownMicrosoft Teams governance is no longer just about who can create a team. In 2026, a good governance model connects Microsoft Teams, Microsoft Entra ID,…TeamsMicrosoft 365Entra IDPurview2026-10-11NewWhat Is GDPR and How Does It Apply to a US Business? 2026 GuideGDPR reaches a US company that sells to or tracks people in the EU: the seven obligations, the EU representative test and the 72-hour breach clock.CompliancePurviewMicrosoft 365Security2026-09-27NewMicrosoft 365 E5 Security and E5 Compliance Add-Ons vs Full E5: The Math for an E3 TenantE5 Security (now Defender Suite) and E5 Compliance (now Purview Suite) add-ons vs full Microsoft 365 E5, with September 2026 totals for 100 and 300 users.LicensingMicrosoft 365SecurityCompliance2026-09-27NewMicrosoft 365 for CPA and Accounting Firms: IRS Publication 4557, the Written Information Security Plan, and the Controls That Satisfy BothWhat IRS Publication 4557 and the FTC Safeguards Rule ask of a CPA firm, the Microsoft 365 controls that satisfy each, tax season, and the client portal.ComplianceMicrosoft 365Security2026-09-27NewMicrosoft Purview DLP for a 50-User Firm: The First Five Policies, What They Catch, and What Licenses They NeedThe first five Purview DLP policies for a 50-user firm, what each catches, simulation mode before blocking, what Business Premium includes, and the E5 add-ons.CompliancePurviewMicrosoft 3652026-09-20NewFTC Safeguards Rule Checklist and a WISP Outline for Microsoft 365 TenantsEach FTC Safeguards Rule element mapped to Microsoft 365 controls and evidence, the 5,000-consumer exceptions, the 30-day FTC notice, and a WISP outline.ComplianceSecurityMicrosoft 3652026-09-06NewCalifornia's CPPA Regulations: ADMT by 1 January 2027, Risk-Assessment Submissions by 1 April 2028California's CPPA rules: ADMT duties from 1 January 2027 and risk-assessment filings by 1 April 2028. What a Microsoft 365 business needs ready.CompliancePurview2026-09-06NewNYDFS Part 500: the 15 April 2027 certification, and the Microsoft 365 evidence you should be collecting nowThe NYDFS certification due 15 April 2027 covers all of 2026. What 23 NYCRR 500 asks for, and the Microsoft 365 evidence to collect before the year ends.ComplianceSecurityMicrosoft 3652026-06-16NewCMMC 2.0: What Defense Contractors Need to Know in 2026Prepare for CMMC 2.0 in 2026 with CUI scoping, Microsoft 365 controls, evidence readiness, and a practical path to assessment.SecurityComplianceMicrosoft 3652026-06-16NewShadow AI Is Already in Your Microsoft 365 Tenant — Control It With PurviewControl shadow AI in Microsoft 365 with Purview discovery, labels, DLP, audit, and Copilot readiness before sensitive data leaks.PurviewCopilot and AI2026-06-16Data Loss Prevention in Microsoft 365: How to Prevent Data Loss in 2026Microsoft 365 Data Loss Prevention is no longer just an email and file-sharing control. In 2026, it is a core part of Microsoft Purview data security,…Microsoft 365PurviewSecurityCompliance2026-06-16Microsoft Purview eDiscovery in Microsoft 365Microsoft Purview eDiscovery helps organizations preserve, search, review, and export Microsoft 365 content for litigation, investigations, regulatory…PurviewMicrosoft 365Compliance2026-06-16How to offboard former employees in Microsoft 365 and preserve mailbox dataWhen an employee leaves, the goal is not simply to delete an account. A secure Microsoft 365 offboarding process must stop access quickly, preserve…Microsoft 365SecurityComplianceHow-to2026-06-16How to export a Microsoft 365 mailbox to PST using Microsoft PurviewNeed a PST copy of a Microsoft 365 mailbox for legal discovery, offboarding, migration, or a one-time archive? In 2026, the supported admin path is…How-toMicrosoft 365Exchange OnlineCompliance2026-06-16How to open a Microsoft Purview encrypted email from Gmail or another external email accountReceived a secure email from a Microsoft 365 user but you use Gmail, Yahoo, iCloud, or another non-Microsoft mailbox? In most cases, you can open it by…Microsoft 365Security2026-06-16NewIf Your Microsoft 365 Tenant Were Breached Today, What Could You Prove?Can your Microsoft 365 tenant prove breach scope? Learn what logs, retention, Sentinel workflows, and evidence you need before an incident.SecurityComplianceMicrosoft 365Sentinel and MDR2026-06-16NewMicrosoft Entra ID Governance: Access Reviews, PIM, and Lifecycle WorkflowsImplement Microsoft Entra ID Governance with PIM, Access Reviews, and Lifecycle Workflows to reduce standing privilege and stale access.SecurityComplianceEntra ID2026-06-16Microsoft Purview Information Protection for Microsoft 365Sensitive data now moves through email, Teams, SharePoint, OneDrive, endpoints, SaaS apps, and AI-assisted workflows. Microsoft Purview helps…SecurityComplianceMicrosoft 3652026-06-16Navigate SharePoint Online data governance, protection, and backup strategies in 2026SharePoint Online remains a core collaboration platform in Microsoft 365, but protecting it in 2026 requires more than permissions and a recycle bin. A…SharePointMicrosoft 365SecurityPurview2026-06-16NewNIST SP 800-171 on Microsoft 365 GCC High: A Practical GuideLearn how to align Microsoft 365 GCC High with NIST SP 800-171, CMMC controls, SSP evidence, endpoint security, and CUI governance.SecurityComplianceMicrosoft 3652026-06-16Microsoft Purview eDiscovery for Microsoft 365Advanced eDiscovery has evolved into Microsoft Purview eDiscovery Premium. For organizations that must preserve, search, review, and export Microsoft 365…PurviewMicrosoft 365Compliance2026-06-16NewHow Law Firms Should Structure SharePoint for ComplianceLearn how law firms should structure SharePoint by matter to govern permissions, guest access, metadata, retention, labels, and audit evidence.Microsoft 365SharePointSecurityCompliance2026-06-16Microsoft Purview Compliance Portal Guide for Microsoft 365 Compliance Teams (2026)The old “Microsoft 365 Compliance Center” has evolved into Microsoft Purview. For compliance, legal, security, and IT teams, Purview is now the central…Microsoft 365CompliancePurviewSecurity2026-06-16NewWhat Is a vCISO and Does Your Business Need One?Need security leadership without a full-time CISO? Learn what a vCISO does, when to hire one, typical costs, and what outcomes to expect.SecurityComplianceMicrosoft 365
Reading about your own tenant? Book 30 minutes with Mike, the founder, or send a note. A person answers the same business day, and every order is confirmed by a human.