What is Microsoft Purview Compliance Manager? Turning Scores into Improvement Actions
About This Article
This article was created using an automated generation workflow powered by generative AI. Based on Microsoft Learn as of September 2026, it organizes the differences between Compliance Manager scores, assessments, regulatory templates, and E3/E5 licensing from a practical perspective.Verification Status: 📘 Microsoft Official Information Confirmed / Actual Environment Unverified
Microsoft Purview Compliance Manager is a framework for continuously managing improvement activities by organizing compliance with regulations and standards into units of Assessments, Controls, Improvement actions, and Evidence.
- Four Key Terms to Learn First
- "100% Score = Legal Compliance" is a Misconception
- What are the Differences Between E3 and E5?
- Try This First: Read One Improvement Action
- Dividing Responsibilities Between Business Teams and IT
- Check Before Adding Premium Regulations
- Checklist for Administrators
- Official Microsoft Information
Four Key Terms to Learn First
| Term | Meaning |
|---|---|
| Assessment | An evaluation unit against specific regulations, standards, etc. |
| Control | A control item that groups requirements together |
| Improvement action | The actual work performed to improve or verify compliance |
| Compliance score | A risk-based metric quantifying the progress of improvement actions |
"100% Score = Legal Compliance" is a Misconception
Microsoft explicitly states that the compliance score does not guarantee an organization's legal compliance. Even with a high score, you must separately verify the interpretation of applicable laws, contracts, actual operations, and the validity of evidence.
flowchart LR
A[規制・標準] --> B[Assessment]
B --> C[Controls]
C --> D[Improvement actions]
D --> E[担当・証跡・テスト]
E --> F[Compliance score]
F --> G[次の改善]
Compliance Manager is easier to understand if you view it as a ledger for improvement activities rather than a "pass/fail grading machine."
What are the Differences Between E3 and E5?
Compliance Manager itself is available to organizations with Office 365 or Microsoft 365 subscriptions. The Microsoft Data Protection Baseline also serves as the basic starting point. However, the scope of available assessments, premium regulations, and template management varies depending on your subscription.
According to Microsoft's current FAQ, organizations at the E5/A5/G5 level can, in addition to the Microsoft Data Protection Baseline,select up to three premium regulatory templates of their choice at no additional cost.There is a rule where templates within the same regulation family count as one. Other premium regulations may require separate purchase.
As of 2026, Microsoft 365 E7 also exists as a higher-tier SKU that includes E5's Advanced Purview. While this guide focuses on the E3/E5 comparison, keeping in mind that E7 is an option for new selections will help prevent confusion.
Try This First: Read One Improvement Action
Instead of trying to raise your score right from the start, select a single improvement action from the Microsoft Data Protection Baseline.
1. Improvement actionを1件選ぶ 2. 対象サービスを確認 3. Microsoft側 / 顧客側 / 共有責任を確認 4. 推奨実装を読む 5. 自組織で必要か判断 6. 担当者と証跡を決める
What to Look For
It is a success if you can explain "who will implement it," "what constitutes completion," and "what evidence needs to be retained."
Try Changing One Thing
Open another action in the same category and compare whether the required department in charge or the evidence changes. You will see that improvement targets include not only technical settings but also policies, training, and operational procedures.
Dividing Responsibilities Between Business Teams and IT
sequenceDiagram
participant C as Compliance担当
participant I as 情シス
participant O as 業務部門
C->>I: Improvement actionの技術確認
I-->>C: 設定状況・技術証跡
C->>O: 規程・運用の実施状況確認
O-->>C: 手順・教育・業務証跡
C->>C: Assessmentへ記録しレビュー
General Users: Typically act as the implementers of training and business rules, rather than directly interacting with the score.
Business Teams / Compliance Officers: Track assignees, deadlines, evidence, and policy revisions.
IT Department: Provide implementation status of Microsoft 365 settings and technical evidence.
Check Before Adding Premium Regulations
On the Regulations screen, you can check the number of premium regulations available under your subscription and the number currently in use. Microsoft Learn explains that using a premium regulation in an assessment activates the license, and purchased licenses generally auto-renew on a one-year basis.
Rather than "activating everything because it looks useful," it is much easier to manage if you select only what is necessary for your audit plan or applicable regulations.
Checklist for Administrators
Compliance Manager roles and least privilege
Microsoft Data Protection Baseline
Number of premium regulations included in the subscription
Purchase and renewal status of premium regulations
Assignees and deadlines for improvement actions
Ensuring personal or confidential information is not excessively included in Evidence
Not treating the score as a legal guarantee
Reconfirming the differences between E3/E5/E7 and add-on subscriptions at the time of deployment
Official Microsoft Information
Compliance Manager is not a "grading machine that automatically determines legal compliance."A practical tool for managing items to improve, assignees, evidence, and the next review all in one placeIts value becomes much clearer when used in this manner.
