Compliance Manager & eDiscovery | Guided by A Guide to Cloud

Two compliance tools, two purposes

Simple explanation

Compliance Manager is your health checkup. eDiscovery is your search warrant.

Compliance Manager says: “Here’s your compliance score. You’re doing well on data protection, but you need to improve your retention policies. Here are the steps to fix it.” It’s a dashboard with a to-do list.

eDiscovery says: “We need to find every email and document related to this legal case.” It searches across Exchange, SharePoint, OneDrive, and Teams to find specific content for investigations or legal holds.

Compliance Manager

The compliance score

Score from 0 to a maximum based on your assessments
Higher = more compliant (not perfectly secure — it’s about configuration alignment)
Based on improvement actions you’ve completed
Found in Microsoft Purview → Compliance Manager

How it works

Assessments — choose regulatory frameworks (GDPR, ISO 27001, etc.)
Improvement actions — Compliance Manager generates a prioritised list of recommendations
Each action shows: what to do, which service to configure, impact on score, current status
Two types of actions:
- Microsoft-managed — actions Microsoft handles for you (infrastructure security)
- Customer-managed — actions YOU need to take (enable MFA, configure DLP, etc.)

Scenario: Clearfield Council's compliance assessment

Officer Patel adds a GDPR assessment to Compliance Manager:

Score: 62% (needs improvement)

Top 5 recommended actions:

✅ Enable MFA for all users (+8 points) — already done
⬜ Configure DLP policies for personal data (+12 points) — not started
⬜ Enable sensitivity labels (+10 points) — in progress
⬜ Set up retention policies for email (+6 points) — not started
⬜ Enable audit logging (+4 points) — already enabled but not verified

Officer Patel works through the list over 3 months → score rises to 84%.

Exam tip: Compliance Manager RECOMMENDS and SCORES — it doesn’t ENFORCE. You must take the actions yourself. Compare with Identity Secure Score (Module 10) which does the same for security.

eDiscovery

Content search — the basic tool

Content search lets you search for specific content across M365:

Where it searches: Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams messages
What you can search by: Keywords, date ranges, senders/recipients, file types, labels
What you can do with results: Preview, export, or add to an eDiscovery case

eDiscovery cases — for investigations

When you need more than a one-off search:

Feature	What It Does
Case creation	Organise searches and holds around a specific investigation
Legal holds	Prevent data from being deleted or modified during an investigation
Search	Run multiple searches within the case
Export	Export search results for external review (legal team, auditors)
Close	Close the case and release holds when investigation is complete

Scenario: Clearfield Council receives a legal request

Clearfield Council receives a freedom-of-information request: “Provide all emails and documents related to the North Bridge construction project from 2025-2026.”

Officer Patel’s process:

Create eDiscovery case — “North Bridge FOI Request 2026”
Place legal hold — on all relevant users’ mailboxes and the North Bridge SharePoint site (prevents deletion)
Run content search — keywords: “North Bridge”, date range: 2025-01-01 to 2026-12-31, locations: email + SharePoint
Preview results — 847 items found, review for relevance and redact sensitive content
Export — deliver to legal team for the FOI response
Close case — release holds after investigation is complete

🎬 Video walkthrough

🎬 Video coming soon

Compliance Manager & eDiscovery — AB-900 Module 18

~10 min

Flashcards

Question

What is Compliance Manager?

Click or press Enter to reveal answer

Answer

A tool in Microsoft Purview that provides a compliance score based on regulatory assessments. It recommends prioritised improvement actions (customer-managed and Microsoft-managed) to improve compliance posture. It recommends — it doesn't enforce.

Click to flip back

Question

What is eDiscovery used for?

Click or press Enter to reveal answer

Answer

Searching, collecting, and preserving electronic content (emails, files, Teams messages) for legal or compliance investigations. Includes content search, case management, legal holds, and export.

Click to flip back

Question

What is a legal hold in eDiscovery?

Click or press Enter to reveal answer

Answer

A legal hold prevents data from being deleted or modified during an active investigation. It's placed on mailboxes, SharePoint sites, or OneDrive accounts within an eDiscovery case. Data under hold is retained even if retention policies would normally delete it.

Click to flip back

Knowledge Check

Clearfield Council needs to prevent deletion of all emails related to an active investigation while they review the content. Which tool should Officer Patel use?

Next up: Activity Explorer & Data Monitoring — the tools that show you what’s happening to your data in real time.