Topic hub / 56 guides
Compliance on Microsoft 365
Frameworks ask for controls and evidence; Microsoft 365 produces both when it is configured for it. These guides map each requirement to the Entra, Intune, Purview and Defender settings that satisfy it.
Start here
2026-09-27NewSOC 2 on Microsoft 365: Mapping the Trust Services Criteria to Entra, Intune, Purview and Defender EvidenceHow SOC 2 criteria map to Entra, Intune, Purview and Defender evidence, what auditors export, the gaps Microsoft 365 cannot close, and Type I vs Type II.ComplianceSOC 2SecurityMicrosoft 3652026-06-16NewHIPAA on Microsoft 365: A Real Implementation ModelImplement HIPAA safeguards in Microsoft 365 with identity, device, DLP, sharing, audit, evidence, and licensing controls for healthcare ePHI.SecurityComplianceMicrosoft 365Healthcare2026-09-20NewThe Cyber Insurance Questionnaire: Where the Microsoft 365 Evidence for Each Question LivesThe questions cyber insurers ask, and for each one the Microsoft 365 control, the report or export that proves it, and the role that can pull it.SecurityComplianceMicrosoft 365
Services that do the work
Fixed-price engagements, quoted in writing before work begins and paid after you approve delivery. Prices are the published catalog prices.
- Microsoft Purview Records Management Implementation — $4,950 per project · 3 weeks
- Microsoft Purview eDiscovery Premium Implementation — $3,950 per project · 2 weeks
- Microsoft Purview Data Lifecycle Management Implementation — $4,500 per project · 30 days
- CMMC Self-Assessment Assistance — $4,000 per project · 30 days
- Microsoft Purview Insider Risk Management Implementation — $4,950 per project · 4 weeks
- Microsoft 365 Commercial to GCC High Migration — From $25,000 (scoped by tenant and CUI boundary) · 12 weeks
- CMMC and FedRAMP Readiness Assessment — $25,000 per project · 60 days
- Microsoft Purview eDiscovery Search Assistance — $500 per project · 5 days
Calculators and plan pages
- Microsoft Purview Suite — plan page with every term and billing option at Microsoft's list price
- Microsoft 365 E5 — plan page with every term and billing option at Microsoft's list price
All 56 guides, newest first
2026-09-27NewCISA's SCuBA Secure Configuration Baselines for Microsoft 365: What They Require, How to Check Your Tenant with ScubaGear, and What to Fix FirstWhat CISA's SCuBA secure configuration baselines require of a Microsoft 365 tenant, how to run ScubaGear and read its report, and which findings to fix first.SecurityComplianceMicrosoft 365Entra ID2026-09-27NewManaging Company Macs with Intune: Enrollment, Platform SSO, Compliance and Conditional Access, and When Jamf Is Still the AnswerManaging company Macs with Intune: ADE enrollment, Platform SSO with Entra ID, compliance and Conditional Access, Defender, and when Jamf still wins.IntunemacOSEntra IDSecurity2026-09-27NewMicrosoft 365 E5 Security and E5 Compliance Add-Ons vs Full E5: The Math for an E3 TenantE5 Security (now Defender Suite) and E5 Compliance (now Purview Suite) add-ons vs full Microsoft 365 E5, with September 2026 totals for 100 and 300 users.LicensingMicrosoft 365SecurityCompliance2026-09-27NewMicrosoft 365 for CPA and Accounting Firms: IRS Publication 4557, the Written Information Security Plan, and the Controls That Satisfy BothWhat IRS Publication 4557 and the FTC Safeguards Rule ask of a CPA firm, the Microsoft 365 controls that satisfy each, tax season, and the client portal.ComplianceMicrosoft 365SecurityAccounting2026-09-27NewMicrosoft Purview DLP for a 50-User Firm: The First Five Policies, What They Catch, and What Licenses They NeedThe first five Purview DLP policies for a 50-user firm, what each catches, simulation mode before blocking, what Business Premium includes, and the E5 add-ons.ComplianceMicrosoft PurviewData ProtectionMicrosoft 3652026-09-20NewFTC Safeguards Rule Checklist and a WISP Outline for Microsoft 365 TenantsEach FTC Safeguards Rule element mapped to Microsoft 365 controls and evidence, the 5,000-consumer exceptions, the 30-day FTC notice, and a WISP outline.ComplianceSecurityMicrosoft 3652026-09-14NewMicrosoft Entra ID P1 vs P2: Conditional Access, PIM, Identity Protection, Access Reviews and Entitlement Management, and Which Compliance Frameworks Push You to Which TierWhat Entra ID P1 and P2 each unlock, how Business Premium, E3 and E5 bundle them, how PIM licenses are counted, and which compliance controls need P2.Entra IDSecurityLicensing2026-09-06NewCalifornia's CPPA Regulations: ADMT by 1 January 2027, Risk-Assessment Submissions by 1 April 2028California's CPPA rules: ADMT duties from 1 January 2027 and risk-assessment filings by 1 April 2028. What a Microsoft 365 business needs ready.CompliancePrivacyMicrosoft PurviewCCPA2026-09-06NewNYDFS Part 500: the 15 April 2027 certification, and the Microsoft 365 evidence you should be collecting nowThe NYDFS certification due 15 April 2027 covers all of 2026. What 23 NYCRR 500 asks for, and the Microsoft 365 evidence to collect before the year ends.ComplianceSecurityNYDFSMicrosoft 3652026-06-16Accessibility in Microsoft Teams: Inclusive Collaboration in 2026Microsoft Teams has evolved from a chat and meeting app into an inclusive collaboration hub. With the right user settings, meeting options, and admin…Microsoft TeamsMicrosoft 365accessibilityCompliance2026-06-16NewCMMC 2.0: What Defense Contractors Need to Know in 2026Prepare for CMMC 2.0 in 2026 with CUI scoping, Microsoft 365 controls, evidence readiness, and a practical path to assessment.SecurityComplianceMicrosoft 365CMMC2026-06-16Compliance Certifications and Microsoft 365: A 2026 Guide for Secure Business OperationsMicrosoft 365 can be a strong foundation for GDPR, HIPAA, ISO, SOC, and industry compliance, but it does not make an organization compliant by itself. In…microsoft-365compliance-certificationsmicrosoft-purviewdata-security2026-06-16Microsoft Purview Compliance Manager: Track Compliance Score, Assessments, and Improvement ActionsCompliance requirements are still complex, but the Microsoft compliance experience has changed significantly since the old Office 365 Compliance Manager…Microsoft PurviewMicrosoft 365Cloud SecurityCompliance2026-06-16NewConditional Access Policies Every Business Should HaveClose Conditional Access gaps with MFA, legacy auth blocking, device controls, guest rules, and safer Microsoft Entra ID rollout.Security/ComplianceMicrosoft Entra IDMicrosoft 3652026-06-16NewShadow AI Is Already in Your Microsoft 365 Tenant — Control It With PurviewControl shadow AI in Microsoft 365 with Purview discovery, labels, DLP, audit, and Copilot readiness before sensitive data leaks.Microsoft PurviewMicrosoft 365 CopilotData GovernanceAI Security2026-06-16NewCopilot Oversharing: The Hidden Risk and How to Fix ItLearn how Microsoft 365 Copilot exposes overshared SharePoint, Teams, OneDrive, and guest access—and how to fix it with Purview governance.Microsoft CopilotMicrosoft PurviewData GovernanceAI Security2026-06-16Data Loss Prevention in Microsoft 365: How to Prevent Data Loss in 2026Microsoft 365 Data Loss Prevention is no longer just an email and file-sharing control. In 2026, it is a core part of Microsoft Purview data security,…microsoft-365microsoft-purviewSecurityCompliance2026-06-16NewDefender for Cloud vs. Defender for Endpoint: What's the Difference?Compare Defender for Cloud and Defender for Endpoint, understand licensing overlap, and decide which Microsoft security coverage you need.SecurityComplianceMicrosoft Defender2026-06-16Microsoft Purview eDiscovery in Microsoft 365Microsoft Purview eDiscovery helps organizations preserve, search, review, and export Microsoft 365 content for litigation, investigations, regulatory…Microsoft PurvieweDiscoveryMicrosoft 365Compliance2026-06-16Microsoft 365 Copilot in 2026: Readiness, Security, Licensing, and Adoption GuideMicrosoft 365 Copilot is no longer a preview concept—it is a generally available AI assistant embedded across Microsoft 365. The organizations getting the…Microsoft 365 CopilotMicrosoft 365Microsoft PurviewMicrosoft Entra ID2026-06-16Facilitate Compliance Work with Microsoft Purview Compliance ManagerCompliance is no longer a once-a-year audit exercise. In 2026, organizations need a repeatable way to map regulatory obligations to Microsoft 365…Microsoft 365Cloud SecurityComplianceMicrosoft Purview2026-06-16NewGovernment Tenants: GCC vs GCC High vs Commercial — A Practical Decision GuideChoose the right Microsoft 365 tenant for CUI, DFARS, CMMC, ITAR, CJIS, and public-sector data before migration and audits create risk.GovernmentComplianceMicrosoft 365Security2026-06-16How Secure Is Microsoft Teams in 2026? A Practical Breakdown of Teams Security FeaturesMicrosoft Teams can be a highly secure collaboration platform, but its protection depends on how Microsoft 365, Entra ID, Defender, Purview, Intune, and…microsoft-teams-securitymicrosoft-365-securitycloud-securityCompliance2026-06-16How to Build an Intelligent Workplace with SharePoint Online and Microsoft 365 in 2026SharePoint Online is no longer just a place to store documents. In a modern Microsoft 365 environment, it is the content foundation for Teams, OneDrive,…SharePoint OnlineMicrosoft 365Microsoft CopilotMicrosoft Purview2026-06-16How to offboard former employees in Microsoft 365 and preserve mailbox dataWhen an employee leaves, the goal is not simply to delete an account. A secure Microsoft 365 offboarding process must stop access quickly, preserve…Microsoft 365SecurityCompliancehowto2026-06-16How to export a Microsoft 365 mailbox to PST using Microsoft PurviewNeed a PST copy of a Microsoft 365 mailbox for legal discovery, offboarding, migration, or a one-time archive? In 2026, the supported admin path is…howtoMicrosoft 365Exchange OnlineCompliance2026-06-16How to open a Microsoft Purview encrypted email from Gmail or another external email accountReceived a secure email from a Microsoft 365 user but you use Gmail, Yahoo, iCloud, or another non-Microsoft mailbox? In most cases, you can open it by…Microsoft 365Cloud Securitymodern security2026-06-16NewHow to Run a Microsoft 365 License Audit (and What to Look For)Run a Microsoft 365 license audit to find unused seats, duplicate add-ons, downgrade candidates, and renewal risks before recurring spend grows.Microsoft 365LicensingCost OptimizationSecurity2026-06-16NewImprove Microsoft Secure Score Without Chasing PointsGet a practical Microsoft Secure Score remediation plan that prioritizes identity, email, endpoints, sharing, and Purview controls by risk.SecurityComplianceMicrosoft 3652026-06-16Use Microsoft Purview Sensitivity Labels in Word, Excel, Outlook, and Microsoft 365Sensitivity labels are no longer a new Office add-in experience; they are a core Microsoft Purview Information Protection capability built into Microsoft…Microsoft 365Cloud SecurityComplianceData Protection2026-06-16Managing Data Privacy and Compliance Risk in Microsoft 365 in 2026Data is still one of the most valuable assets in the digital economy—but in 2026 it is also one of the most regulated, exposed, and AI-accessible assets…Cloud SecuritygdprMicrosoft 365Compliance2026-06-16NewMDR: Why a SIEM Alone Isn't EnoughMicrosoft Sentinel can collect signals, but MDR turns them into confirmed incidents, containment actions, and audit-ready response records.Security/ComplianceMicrosoft SentinelMDR2026-06-16NewMicrosoft 365 for Behavioral Health: HIPAA-Ready ArchitectureBuild a HIPAA-ready Microsoft 365 tenant for behavioral health with ePHI boundaries, Conditional Access, Intune, DLP, audit evidence, and secure sharing.Microsoft 365ComplianceSecurityHealthcare2026-06-16NewIf Your Microsoft 365 Tenant Were Breached Today, What Could You Prove?Can your Microsoft 365 tenant prove breach scope? Learn what logs, retention, Sentinel workflows, and evidence you need before an incident.SecurityComplianceMicrosoft 365Microsoft Sentinel2026-06-16Ensuring License Compliance in Microsoft 365: Auditing and Best Practices for 2026Microsoft 365 licensing is no longer just a seat-count exercise. In 2026, organizations must manage user assignments, add-on licenses, service plans, CSP…microsoft365license-compliancecost-optimizationSecurity2026-06-16NewHow Companies Overpay 15–40% on Microsoft 365: Real Audit PatternsFind Microsoft 365 licensing waste from E5 overassignment, stale users, duplicate add-ons, and unused Project, Visio, Power BI, and Power Platform seats.Microsoft 365LicensingCost Optimization2026-06-16Microsoft 365 Security Audit Guide for 2026: Steps, Checklist & Best PracticesA Microsoft 365 security audit in 2026 is no longer just a Secure Score review. It should validate identity controls in Microsoft Entra ID, email and…microsoft365security-auditDefenderIntune2026-06-16NewZero Trust in Microsoft 365: What It Actually Looks Like in ProductionGet a production-ready Microsoft 365 Zero Trust plan to close MFA exceptions, legacy auth, unmanaged device access, OAuth consent, and sharing gaps.SecurityComplianceMicrosoft 365Zero Trust2026-06-16Microsoft Purview Compliance Manager and Compliance Score: How to Measure and Improve Compliance Risk in Microsoft 365Compliance requirements keep changing, but your Microsoft 365 environment can give you a practical starting point. Microsoft Purview Compliance Manager…Microsoft PurviewMicrosoft 365 complianceCompliance Managercompliance score2026-06-16NewMicrosoft Entra ID Governance: Access Reviews, PIM, and Lifecycle WorkflowsImplement Microsoft Entra ID Governance with PIM, Access Reviews, and Lifecycle Workflows to reduce standing privilege and stale access.SecurityComplianceMicrosoft EntraIdentity Governance2026-06-16Microsoft Purview Information Protection for Microsoft 365Sensitive data now moves through email, Teams, SharePoint, OneDrive, endpoints, SaaS apps, and AI-assisted workflows. Microsoft Purview helps…Cloud Securitymodern securityComplianceMicrosoft 3652026-06-16NewPut Microsoft Purview Controls in Place Before Microsoft 365 CopilotPrepare for Microsoft 365 Copilot with Purview controls for permissions, labels, DLP, retention, audit, and secure rollout readiness.Microsoft 365 CopilotMicrosoft PurviewData SecurityAI2026-06-16Microsoft Teams Governance for 2026: Secure Collaboration Without Slowing Users DownMicrosoft Teams governance is no longer just about who can create a team. In 2026, a good governance model connects Microsoft Teams, Microsoft Entra ID,…Microsoft TeamsMicrosoft 365Microsoft Entra IDMicrosoft Purview2026-06-16Microsoft Teams Security and Compliance: 2026 GuideMicrosoft Teams is now a core collaboration platform for meetings, chat, files, apps, external partners, webinars, and AI-assisted work. Securing it…Microsoft TeamsSecurityComplianceMicrosoft 3652026-06-16NewNIST SP 800-171 on Microsoft 365 GCC High: A Practical GuideLearn how to align Microsoft 365 GCC High with NIST SP 800-171, CMMC controls, SSP evidence, endpoint security, and CUI governance.SecurityComplianceMicrosoft 365CMMC2026-06-16Microsoft Purview eDiscovery for Microsoft 365Advanced eDiscovery has evolved into Microsoft Purview eDiscovery Premium. For organizations that must preserve, search, review, and export Microsoft 365…Microsoft PurviewMicrosoft 365ComplianceMicrosoft 365 E52026-06-16Microsoft 365 Security Links and Resources for 2026Microsoft security has changed significantly since the Office 365 era: Azure AD is now Microsoft Entra ID, Office 365 ATP is now Microsoft Defender for…Microsoft 365Cloud SecurityCybersecurityCompliance2026-06-16NewHow Law Firms Should Structure SharePoint for ComplianceLearn how law firms should structure SharePoint by matter to govern permissions, guest access, metadata, retention, labels, and audit evidence.Microsoft 365SharePointSecurityCompliance2026-06-16Microsoft Purview Compliance Portal Guide for Microsoft 365 Compliance Teams (2026)The old “Microsoft 365 Compliance Center” has evolved into Microsoft Purview. For compliance, legal, security, and IT teams, Purview is now the central…microsoft-365Compliancedata-governanceSecurity2026-06-16NewWhat Is a vCISO and Does Your Business Need One?Need security leadership without a full-time CISO? Learn what a vCISO does, when to hire one, typical costs, and what outcomes to expect.SecurityComplianceMicrosoft 3652026-06-16What Is GDPR and How Is It Related to Your Organization in 2026?GDPR compliance is no longer a one-time project or an EU-only concern. In 2026, organizations using Microsoft 365 need a practical privacy program that…gdprmicrosoft-purviewmicrosoft-privaCybersecurity2026-06-16NewWhy MFA Is Not Enough Anymore: Real Microsoft 365 Attack PathsSee where Microsoft 365 MFA still fails and how to reduce account takeover risk with Conditional Access, phishing-resistant auth, and OAuth controls.SecurityMicrosoft 365Compliance2026-06-16Worldwide Government Security with Microsoft 365 in 2026Government agencies are expected to deliver faster digital services, collaborate across jurisdictions, protect sensitive public data, and meet strict…Microsoft 365 GovernmentMicrosoft EntraMicrosoft Defender XDRMicrosoft Purview
Reading about your own tenant? Book 30 minutes with Mike, the founder, or send a note. A person answers the same business day, and every order is confirmed by a human.