Compliance Features in Government Clouds

• Purview and other Microsoft compliance features in U.S. government clouds lag behind those in the company’s commercial clouds.
• The feature gaps and weak documentation can make it difficult for U.S. government compliance professionals to plan controls when systems migrate to Microsoft’s clouds.
• U.S. government agencies and contractors should consider third-party products to fill Microsoft gaps and gain negotiation leverage.

Purview and other Microsoft compliance features must be certified for each of the company’s U.S. government clouds, which serve U.S. government agencies and contractors. The certification process delays feature rollouts and makes it difficult to predict what controls it will be possible to enforce, and when. Some resources from Microsoft can help, but government compliance professionals might not be able to depend on Microsoft alone.

Compliance Features, Certification, Clouds

For the Microsoft 365 and Azure clouds, Microsoft recently bundled most, but not all, its regulatory and legal compliance offerings under the Purview brand. These features help organizations enforce rules for data classification, sensitivity labeling, retention, and appropriate communications, among others. (For a summary, see “The Nine Faces of Purview: A Cheat Sheet” on page 16 of the Jan. 2023 Update.) Not included in Purview (nor the Microsoft 365 E5 suite) is Priva, the company’s privacy compliance service, which must be purchased separately.