Microsoft 365 compliance monitoring
Could you prove compliance tomorrow morning, without opening a spreadsheet?
NIS2, GDPR, DORA, the EU AI Act, ISO 27001 and six more all ask about the same tenant. 1Security evaluates one shared set of 15 requirements - 11 of them measured live from tenant data, 4 recorded as attestations - and maps the result onto every framework that cites them. You connect read-only, and before anything has been remediated you can already put a dated, honest readiness picture in front of a regulator.
- 11 frameworksEU AI Act, NIS2, GDPR, DORA, SOC 2, NIST CSF 2.0, HIPAA, both ISO standards and both Polish acts
- 15 requirementsone shared set behind every framework - fix a requirement once and every article citing it moves
- 11 of 15requirements measured live by an evaluator running against your tenant - not self-graded
The problem
Every framework asks the same questions. You keep answering them separately.
Until now, Microsoft 365 compliance monitoring has mostly meant a ritual: a consultant, a spreadsheet, and weeks of mapping controls to paragraphs by hand - then the same weeks again for the next regulation. NIS2 asks about supply-chain security, DORA asks about ICT third-party risk, GDPR asks about processors, ISO 27001 has two Annex A controls for suppliers. Four framings, one underlying question, four separate proofs.
The mapping also goes stale the day it is finished. A spreadsheet records what someone believed in March. The tenant kept moving: accounts went dormant, an agent lost its owner, a blocked domain stayed active. Self-graded checklists have no mechanism for noticing.
Here is the arithmetic nobody prices in: across the eleven frameworks 1Security evaluates, all the cited controls collapse into 15 shared requirements - things an organization actually does, like "every AI agent has an accountable person" or "activity logs are retained six months". And 11 of those 15 are measurable directly from tenant data. Most of a compliance program is not paperwork. It is tenant facts, and tenant facts can be watched.
What you get
One evaluation, mapped onto every framework that cites it.
Requirements are evaluated once, continuously. Frameworks are views over the same verdicts - so the work is deduplicated by construction.
A crosswalk instead of eleven checklists
Each article in each framework names the requirements that satisfy it, and its status is the worst status among them. Fix a requirement once - an accountable owner on every agent, say - and the EU AI Act, KRiBSI and ISO/IEC 42001 articles citing it move together. Every open requirement appears once on the worklist, worst status first, ranked by how many articles in your scope it closes, with chips like "NIS2 ×2, DORA, ISO 27001".
Measured, not self-graded
11 requirements are checked live by an evaluator: agent ownership, log retention against the 183-day floor, restricted-data reachability, the third-party app inventory, external domains, monitoring freshness, protecting labels, device compliance, dormant accounts, Conditional Access coverage, captured agent instructions.
Statuses that under-promise
Met, at risk, not met, not evaluated - and "not evaluated" is honest, never a pass. A verdict that will be shown to an auditor is deliberately conservative, so the number you present is one you can defend.
Incident handling with a record behind it
The incident-handling and reporting articles rest on three things the platform writes as the work happens: anomaly episodes with a History & Comments trail, the Alerting notification log - sent, withheld with its reason, failed - kept up to three years, and incident reports generated from the detection itself: an Incident record, a briefing, or the NIS2 Article 23 early warning, notification and final report with their deadlines computed, not typed.
Snapshots and evidence packs
The whole status document is captured automatically every Monday and on demand. The overview shows what changed since the last capture, and each framework exports a dated evidence pack - the same document the API serves.
Frameworks you have not adopted, scored anyway
Everything outside your scope keeps being evaluated in the background and shows its own readiness percentage - so how close you already are on, say, ISO 27001 is visible before anyone commits to the certification project.
How deep it goes
From a supply-chain article to the two inventories that answer it.
One example, followed end to end - the control that appears in more frameworks than any other.
Every major framework carries a supply-chain control: NIS2 Article 21(2)(d), DORA Article 28, GDPR Article 28, ISO 27001 A.5.19 and A.5.23, ISO/IEC 42001 A.10, SOC 2 CC9.2, NIST CSF 2.0 GV.SC-07, HIPAA business associates. They all reduce to two questions: who has access to us, and who do we hand data to. The screen feeds those articles from both directions - the third-party application inventory for software coming in, including shadow apps nobody approved, and the external domain inventory for data going out, with declared sharing rules checked against observed activity.
Click any requirement and the panel shows its verdict and why, in plain language, with a progress bar where one makes sense - "12 of 15 agents have an accountable person" - plus the exact measurement, the numbers behind the verdict, and next-step links into the screens where the underlying data lives. At the bottom: every article across every framework this requirement satisfies, your scope first.
The 4 manual requirements - an AI impact assessment, an AI usage policy, an incident response procedure, risk management documentation - carry an attestation form instead: status, owner, next review date, an evidence link. One attestation counts in every framework that cites the document. The 11 measured requirements take an own assessment instead: when the whole picture differs from what is connected - agents that run on people's own machines, devices managed in another tool - you set Met, At risk, Not met or Not applicable, or keep the measured status and only add a note. The note is mandatory, because it is the reason an auditor will read. The status you set is the one in force for every article that cites the requirement and is labelled Own assessment; the measured status stays visible next to it on the screen, in reports, in snapshots and in the API.
In practice
Four steps from first visit to a document an auditor accepts.
The screen is useful on day one, before anything has been fixed.
- 01
Pick your frameworks
Open Compliance and choose your scope in the framework picker - cards grouped by region, each with who it applies to, its article count and a readiness bar you can inspect before adopting. Until you choose, a sensible default scope applies.
- 02
Read the worklist, not eleven checklists
Four tiles count your requirements by status; "What to fix" lists every open one exactly once, ranked by how many articles it unlocks. The top row is your best next hour of compliance work.
- 03
Fix where the data lives
Each requirement links into the screen that moves it - assign owners on Agents, resolve contradictions on Domains, expire what reaches restricted types. As each fix lands, every citing article recomputes on its own.
- 04
Snapshot it and hand it over
Take a snapshot, export the framework's evidence pack, and answer "what was our status on this date" with a dated document instead of a recollection. The Reports screen turns the same status into a branded compliance report - PDF, PowerPoint, HTML, CSV or JSON, in seven languages - and the same data is served over the API for whoever asks programmatically.
The difference
What continuous measurement adds over a compliance spreadsheet
The spreadsheet records an opinion about a date. The evaluator records the tenant.
- One set of 15 requirements behind all eleven frameworks - no control is re-proven per regulation
- 11 requirements measured live from tenant data; only 4 rely on a human attestation
- Article status computed as the worst of its cited requirements - never rounded up
- "Not evaluated" as an honest state that is never counted as a pass
- A deduplicated worklist ranked by articles unlocked, with framework chips per fix
- Supply-chain articles fed from both inventories - third-party apps in, external domains out
- Automatic Monday snapshots plus on-demand, with change-since-last-capture on the overview
- Per-framework evidence packs as dated exports, also served over the API
- Out-of-scope frameworks evaluated in the background with their own readiness percentage
- Own assessment on measured requirements with a mandatory note - the measured status stays visible alongside
- Incident notification documents generated from the detection itself, with deadlines computed rather than typed
Scope and honesty
Computed from data 1Security already collects.
There is nothing to configure, no questionnaire to fill in and no project to run first. Scope selection and the four attestations are the only human input, and neither is required for the screen to be useful on day one. An organization connects its tenant read-only and can put a dated readiness picture in front of a regulator before it has changed a single setting.
- 183 daysthe activity-log retention floor the evaluator checks - the six-month line the EU AI Act draws
- 4 statusesmet, at risk, not met, not evaluated - deliberately conservative, because auditors re-check
- 52 / yearautomatic Monday snapshots, plus on-demand captures whenever a dated record is needed
Related
Where the verdicts come from
The compliance view reads controls other parts of the product maintain. These three feed more articles than anything else.
Anomaly detection
Episodes with an earned severity, History & Comments and a Report button - the evidence behind the incident-handling articles, from detection to notification.
See anomalies →App governance
The third-party application inventory that answers every supply-chain article's first question.
See app governance →AI agent inventory
Every agent with its owner - the population behind the accountable-person requirement.
See agents →
The 1Security platform
Compliance is just the beginning
Compliance is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- ReportsSix report types in PDF, PowerPoint, HTML, CSV and JSON, under your brand with the client’s name, one report per client across the whole book.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
FAQ
Questions teams ask first
Does this replace Microsoft Purview Compliance Manager?
They answer different questions. Compliance Manager scores your Microsoft 365 configuration against recommended improvement actions and is genuinely useful for that. 1Security measures observed tenant facts - who actually reaches restricted data, which agents actually lack an owner, which blocked domains are still active - and maps one shared set of requirements onto eleven frameworks, including the two Polish acts. Many customers run both.
Do we need an E5 license or Purview for this?
No. The evaluator runs on data 1Security collects through its read-only connection, which works on standard licensing. Where a requirement depends on an optional Microsoft signal - Intune device compliance, for instance - the requirement honestly reports "not evaluated" rather than guessing.
Is "not evaluated" counted against us?
It is never counted as a pass, and it is not a fail either - it means there is no data yet, or a manual requirement has not been attested. Readiness percentages are computed from met, at risk and not met only. The conservative arithmetic is the point: the number you show an auditor should under-promise.
We have not adopted ISO 27001 yet. Can we see where we stand?
Yes. Frameworks outside your scope keep being evaluated in the background and appear with their own readiness percentage. You can open any framework's articles, see which requirements already hold, and decide whether the certification project is a quarter of work or a year - before committing to it.
The measurement says Not met, but we manage devices in another tool. Now what?
Record an own assessment on the requirement: set the status you can defend - Met, At risk, Not met or Not applicable - and write the note explaining why, which is mandatory. That status is the one in force for every article citing the requirement and is labelled Own assessment; the measured status stays next to it on the screen, in reports, in snapshots and over the API, so an auditor sees both and your reasoning. Remove the assessment and the requirement returns to its measured status.
Who writes the four attested documents?
Your organization does - an AI impact assessment, an AI usage policy and register, an incident response procedure, and risk management documentation are things a regulator expects a human to own. The compliance officer records each attestation once, with owner, review date and an evidence link, and it counts in every framework that cites the document.
See your readiness before the auditor asks for it.
Connect read-only and the evaluator starts scoring all eleven frameworks against your tenant - the worklist, the snapshots and the evidence packs come with it.
Or keep re-mapping the same controls, framework by framework.