Compliance Score and Improvement Actions

Compliance Score is a feature in the Microsoft 365 Compliance Center that provides a quantitative measurement of your organization's compliance posture against regulatory standards and best practices. It aggregates data from various Microsoft 365 services (Exchange Online, SharePoint, Teams, etc.) and evaluates configurations, user activities, and policies to generate a score from 0 to 100. The primary purpose is to help organizations identify gaps in their compliance controls, prioritize remediation efforts, and demonstrate progress over time. The MS-102 exam tests your understanding of how this score is calculated, what influences it, and how to use improvement actions to raise it.

Compliance Score is built on the Microsoft Purview Compliance Portal and integrates with the Compliance Manager. The system works by:

- Azure Active Directory (user settings, MFA status) - Exchange Online (mail flow rules, retention policies) - SharePoint Online (sharing settings, external sharing) - Teams (guest access settings) - Microsoft Defender for Cloud Apps (app permissions) - Microsoft 365 Data Loss Prevention (DLP policies)

- Compliance Score Scale: 0 to 100, where 100 indicates full compliance with all selected assessments. - Improvement Actions: Specific tasks that, when implemented, increase the score. Each action has: - Point Value: The number of points added to the overall score when fully implemented. - Effort: Estimated time to implement (e.g., Low, Medium, High). - Category: Such as 'Access Control', 'Data Protection', 'Incident Response'. - Status: Not started, In progress, Completed, or Acknowledged. - Refresh Frequency: The Compliance Score is recalculated approximately every 24 hours. However, some changes (like enabling MFA) may trigger a near-real-time update. - Default Assessments: Microsoft provides out-of-the-box assessments for major regulations (GDPR, HIPAA, ISO 27001, etc.). You can also create custom assessments. - Data Retention: Historical scores are kept for 90 days, allowing trend analysis.

To view and manage Compliance Score, you use the Microsoft 365 Compliance Center at https://compliance.microsoft.com. There is no direct PowerShell cmdlet for Compliance Score, but you can use the following cmdlets from the Exchange Online PowerShell module to retrieve related data:

# Check MFA status (affects compliance score)
Get-MsolUser -All | Select-Object UserPrincipalName, StrongAuthenticationRequirements

# Check Conditional Access policies
Get-AzureADMSConditionalAccessPolicy | Select-Object DisplayName, State

# Check DLP policies
Get-DlpCompliancePolicy | Format-Table Name, Mode

For monitoring, use the Microsoft 365 Defender portal's Advanced Hunting to query events related to compliance controls.

Compliance Score integrates deeply with:

The overall score for an assessment is:

Assessment Score = (Sum of (Control Score * Control Weight)) / (Sum of (Maximum Control Score * Control Weight)) * 100

For example, if an assessment has three controls:

Then:

This calculation is important for understanding why some actions yield more points than others.

A large hospital network uses Microsoft 365 for email, document storage, and telehealth. They need to demonstrate HIPAA compliance. The compliance officer accesses Compliance Manager and sees an overall score of 65. The top improvement actions include 'Enable encryption for email communications' (point value: 15), 'Implement data loss prevention policies for patient data' (point value: 20), and 'Configure audit logging for all user activities' (point value: 10). The team prioritizes DLP policies because of the highest point value. They create DLP rules to detect and protect Protected Health Information (PHI) in Exchange and SharePoint. After implementation, they mark the action as completed. The next day, the score increases to 85. However, they notice that the score is not automatically updated if they later disable the DLP policy; they must manually re-assess. In production, this organization also uses custom assessments to track internal controls not covered by Microsoft templates. Common misconfiguration: assuming that enabling a feature automatically updates the score—it does not; you must mark the action as completed.

A bank uses Microsoft 365 and needs to achieve ISO 27001 certification. They enable all relevant assessments in Compliance Manager. The overall score is 72. They focus on improvement actions like 'Enable multi-factor authentication for all administrators' (point value: 8) and 'Implement conditional access policies to block legacy authentication' (point value: 12). The IT team implements MFA for all admin accounts and creates a Conditional Access policy to block legacy authentication. They mark both actions as completed. The score rises to 82. However, the audit reveals that the score does not prove compliance; it only indicates that certain controls are in place. The bank must still provide evidence (logs, policies) to the auditor. A common pitfall is relying solely on the Compliance Score as proof, which the exam will highlight as incorrect. The score is a monitoring tool, not an audit certificate.

In large tenants with thousands of users, Compliance Score calculations can take longer to refresh. The 24-hour refresh cycle is standard, but Microsoft may throttle API calls if the tenant has excessive data. It is advisable to implement changes in batches and check the score after each batch to avoid confusion. When misconfigured, such as marking actions as completed without actually implementing them, the score becomes inaccurate, leading to false confidence. The exam may present a scenario where the score is high but the organization fails an audit—this illustrates the danger of self-reporting without verification.