Microsoft 365 compliance you can show an auditor, any day

Microsoft 365 compliance, day to day, means checking that your tenant follows your written policies, not only that they exist. Your rules become automatic checks across Teams, SharePoint, OneDrive, Exchange, Entra ID, Power Platform and Microsoft Copilot (formerly Microsoft 365 Copilot). Findings go to the owner who can fix them, and evidence is exported on a schedule for auditors.

Last reviewed:

Talk to us about compliance evidence Read the FAQ
Example dashboard: an overall compliance score of 78%, with 31 high-severity, 64 medium-severity and 117 low-severity findings open. The score rose from 61% to 78% over six months, a gain of 17 points. Scores by category: Security 82%, Costs 74%, Operations 88%, Sprawl 61%.

Compliance overview

78%

Overall score

  • High severity 31
  • Medium severity 64
  • Low severity 117

Score, last 6 months

+17 pts

Score, last 6 months
May 61%
Jun 64%
Jul 66%
Aug 70%
Sep 73%
Oct 78%

Score by category

  • Security 82%
  • Costs 74%
  • Operations 88%
  • Sprawl 61%

Example data, for illustration only

The problem

Why compliance breaks in Microsoft 365

The policies are usually sound. What fails is checking them across a tenant that changes every day.

  • Policies nobody checks

    Rules on guest access, sharing and ownership are written down, but nothing compares them with the tenant, so gaps build up unnoticed.

  • Audit evidence in spreadsheets

    Before each audit, someone exports lists from several admin centres and assembles a spreadsheet. It is out of date the day it is sent.

  • Reports scattered across admin centres

    Teams, SharePoint, Entra ID and Power Platform settings sit in separate admin centres, with separate reports. Getting one overall picture means stitching them together by hand.

  • AI brings gaps to the surface

    A sharing rule that is not enforced does not stay hidden for long: Copilot can find the overshared file and use it in an answer.

How it works

How does Microsoft 365 compliance checking work?

Five parts, run every day in your tenant by a governance tool that we select, implement and support with your team.

Rules from your policies

Your written policies become rules the tenant is checked against.

Ready-made rule templates cover the usual policies on ownership, sharing, guests, labels, licences and agents. You switch them on, adjust the thresholds or build your own rule by choosing the object, the condition and the severity. Before a new rule is saved, a preview shows how many objects it would flag today.

What it covers

  • Ready-made templates you switch on or off
  • Your own rules, built without code
  • A severity for each rule
  • A preview of what a new rule would flag

How we deliver it

  • We map your written policies to rules with your security team.
  • New rules start in report mode.
  • Your admins learn to add and tune rules.

Daily checks across services

Every rule is checked every day, across every service.

Checks run every 24 hours against the whole tenant, not a sample: Teams, SharePoint, OneDrive, Exchange, Entra ID, Power Platform and Copilot. Each finding is ranked by severity, so your team works on what matters first, and an overall score shows where you stand.

What it covers

  • Teams, SharePoint and OneDrive
  • Exchange and Microsoft Entra ID
  • Power Platform and Copilot agents
  • An overall score, recalculated daily

How we deliver it

  • We agree which services and rules come first.
  • We review the first results with you before anything is enforced.
  • Your admins see the score and open findings in one dashboard.

Compliance score

78%

Overall score

  • Rules checked 64
  • Objects checked 18,400
  • Open findings 212
Example data, for illustration only

Scores by category

See where you stand by service and by category, month after month.

The dashboard splits the score by service and by category: security, costs, operations and sprawl. A six-month trend shows whether things are improving, so a manager or an auditor can follow progress without asking for a new report. M365 compliance reporting comes from the dashboard, not from spreadsheets.

What it covers

  • Score by service
  • Score by category: security, costs, operations, sprawl
  • A six-month trend

How we deliver it

  • We set up the views each audience needs.
  • Management gets a short summary on a schedule.
  • We review the trend with you after go-live.

Score by category

  • Security 82%
  • Costs 74%
  • Operations 88%
  • Sprawl 61%
Example data, for illustration only

Findings sent to owners

Each finding goes to the person who can fix it.

IT should not chase every finding alone. Each one goes to the owner of the team, site, guest or agent concerned, in Microsoft Teams, with a plain explanation. The owner fixes it or explains why it should stay, and the decision is recorded. Where the tool supports it, the fix is applied once the owner approves.

What it covers

  • Owner requests in Microsoft Teams
  • Fix or justify, with a record of the decision
  • Automatic fixes after owner approval

How we deliver it

  • We agree who owns what, using Entra ID data where it helps.
  • Requests are short and written for non-specialists.
  • Routine decisions follow runbooks your team keeps.

Evidence for auditors

The audit evidence is ready before the auditor asks.

Reports are scheduled or run on demand: the inventory, findings for each rule, the trend and owner decisions with their dates. When an auditor asks how a policy was applied in a given month, you send the export instead of rebuilding a spreadsheet. Microsoft also records Copilot interactions in the Microsoft Purview audit log.

What it covers

  • Inventory of the objects checked
  • Findings for each rule
  • Owner decisions, with dates
  • Trends over time

How we deliver it

  • We agree with you which exports auditors need.
  • Exports are scheduled to the right people.
  • We keep the report list up to date as rules change.

High-severity findings, last 6 months

High-severity findings, last 6 months
May 58
Jun 52
Jul 47
Aug 49
Sep 38
Oct 31
Example data, for illustration only

Frameworks

One set of controls, several frameworks

The same rules and records support several frameworks. Which ones apply depends on where you operate and what you do: your legal and compliance teams confirm it.

FrameworkWho it applies toWhat the controls help you show
GDPR (EU) Organisations established in the EU, and others that offer goods or services to people in the EU or monitor their behaviour. Where personal data sits, who can open it and who it is shared with. Input for your record of processing, and for an impact assessment where the risk is high.
EU AI Act Providers and deployers of AI systems used in the EU. It can also apply to UK and Swiss organisations whose AI output is used in the EU. Recently amended by the "AI Omnibus". Which AI tools and agents are in use, who uses them and who owns them: a practical basis for AI literacy measures. The Act does not require a formal AI inventory.
NIS2 (EU) As a rule, medium-sized and large organisations in the critical sectors it lists. Each Member State applies it through national law, and several, France among them, have not yet fully transposed it. Who has access to what, guests and their sponsors, settings that break your rules, and a dated record of decisions.
DORA (EU) Financial entities in the EU. Evidence that access and configuration in Microsoft 365 are checked and reviewed, with a history you can export.
United Kingdom UK GDPR and the NIS Regulations 2018 apply. The Cyber Security and Resilience Bill is still in Parliament. The same records of access, sharing and decisions, read against the UK rules that apply to you.
Switzerland The revised Federal Act on Data Protection applies, including directly to AI processing. The same records of access, sharing and decisions, read against the Swiss rules.

Controls produce evidence. Whether you comply is a judgement for your organisation and its auditors, and no tool can make it for you.

Microsoft Purview

Microsoft Purview and a governance layer: who does what

Many searches for Microsoft 365 compliance lead to Microsoft Purview. We keep Purview in place. The governance layer works next to it, on different objects.

AreaMicrosoft PurviewGovernance layer
What it works on The content itself: documents, emails and the sensitive data they hold. The objects around the content: teams, sites, links, guests, licences and agents.
What it does Sensitivity labels classify and protect content. Data Security Posture Management (DSPM) shows how AI apps and agents use sensitive data. Checks each object against your rules every day and ranks findings by severity.
Who acts Your security and compliance teams. The owner of each team, site, guest or agent, with a record of the decision.
What auditors get The audit log, including Copilot interactions. Scheduled exports of the inventory, findings, decisions and trends.

How Neptune delivers

From your policy document to daily checks

We select the tool, turn your policies into rules, train the people who act on findings and stay with you afterwards.

  • Select

    We choose the governance tool that covers your services and the frameworks you answer to. We work with several vendors, not one.

  • Translate

    We turn your written policies into rules with your security and compliance teams, starting in report mode.

  • Train

    Admins learn to tune rules and read the dashboard. Owners learn what a request means and how to answer it.

  • Support

    We stay reachable after go-live, adjust rules when policies change and keep pace with Microsoft updates.

FAQ

Compliance questions, answered.

What does a daily compliance check look at?

A governance tool keeps an inventory of your tenant and checks every object against the rules you have switched on, every 24 hours. Each finding gets a severity and goes to the owner of the object, who fixes it or explains why it should stay. The score, the trend and the decisions are kept for reporting.

Do we have to write every rule ourselves?

No. Ready-made templates cover the usual policies on ownership, sharing, guests, labels, licences and agents: you switch them on and adjust the thresholds. Your own rules are built by choosing the object, the condition and the severity, and a preview shows what a new rule would flag before it is saved. Checks then run every 24 hours.

What evidence can auditors receive?

Scheduled or on-demand exports: the inventory of objects checked, findings for each rule, owner decisions with their dates and the trend over time. Microsoft also records Copilot interactions in the Microsoft Purview audit log. We agree with you, and with your auditors if you wish, which exports they need.

Does this help with GDPR, NIS2, DORA and the EU AI Act?

The same checks and exports produce the evidence these frameworks ask for, where they apply to you. GDPR applies to organisations established in the EU, and to others that offer goods or services to people in the EU or monitor their behaviour. EU Member States had to apply NIS2 from 18 October 2024, and several, France among them, have not yet fully transposed it. DORA has applied to financial entities since 17 January 2025. The EU amended the AI Act in July 2026: rules for high-risk uses now apply from 2 December 2027, and from 2 August 2028 for AI built into regulated products.

Compliance remains a judgement made by your organisation and its auditors. A tool supplies the evidence; it cannot make that judgement for you.

Does NIS2 apply to UK and Swiss organisations?

Not as such: NIS2 is EU law, applied through the national rules of each Member State. In the UK, UK GDPR and the NIS Regulations 2018 apply, and the Cyber Security and Resilience (Network and Information Systems) Bill is still in Parliament. In Switzerland, the revised Federal Act on Data Protection applies directly to AI processing.

If you also operate in the EU, your legal team can confirm whether national NIS2 laws reach those operations. UK and Swiss organisations can also fall under the AI Act when their AI output is used in the EU. The same controls and records serve all of these rules.

Who fixes the findings?

The owner of the team, site, guest or agent concerned. Requests arrive in Microsoft Teams with a plain explanation; the owner fixes the issue or justifies it, and the decision is recorded. Where the tool supports it, the fix is applied automatically once the owner approves. IT keeps the overview.

Related pages

Talk to us about compliance evidence.

Tell us which policies and frameworks matter to you, and what your last audit asked for. We will explain how the checks and exports would run in your tenant.

Contact us Explore Microsoft 365 governance