# Communication Compliance

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/communication-compliance

## Quick definition

Communication compliance is about monitoring workplace messages like emails, chats, and calls to ensure they follow laws and company rules. It helps organizations catch risky behavior, such as sharing confidential information or using inappropriate language. Tools scan messages automatically and flag violations for review. This is important for industries like finance and healthcare that must keep records of communications.

## Simple meaning

Think of communication compliance like having a safety inspector in a busy factory. In a factory, you have many workers moving around, operating machines, and handling materials. The safety inspector watches to make sure everyone follows the rules so nobody gets hurt and the products come out safe. In the same way, communication compliance watches over all the emails, instant messages, phone calls, and video chats that employees send and receive every day. The goal is to make sure nobody breaks important laws, leaks secret information, or behaves inappropriately.

Imagine you work in a big office where everyone uses company email and a messaging app like Microsoft Teams. You might send hundreds of messages a day coworkers, clients, and partners. Most messages are harmless: "Can you send me that report?" or "Let us have lunch at noon." But some messages could cause trouble. For instance, an employee might accidentally share a customer's private credit card number. Another might joke about insider trading. A manager might write something that sounds like harassment. Without communication compliance, these messages would disappear into the digital noise, and the company would never know until a lawsuit or regulator came knocking.

Communication compliance tools act like a smart, automated inspector that reads every message without bothering anyone unnecessarily. They use rules and machine learning to find only the messages that might be problematic. For example, if a rule says "no sharing of social security numbers," the tool flags any message containing a pattern that looks like a social security number. A human reviewer then looks at the flagged message and decides whether it is a real violation or just a false alarm. This way, the company can fix problems early, prove to regulators that it is following the law, and protect its reputation.

A simple analogy is a lifeguard at a swimming pool. Most swimmers are having fun and following the rules. The lifeguard does not stare at every single splash, but they are trained to spot specific dangers: a person struggling in the water, a child running on the deck, someone diving in the shallow end. When the lifeguard sees a danger, they blow their whistle and take action. Communication compliance works the same way: it filters through millions of messages to find the few that need attention, allowing the organization to respond before a small mistake becomes a big disaster.

## Technical definition

Communication Compliance is a capability within Microsoft Purview, integral to the Microsoft 365 compliance ecosystem, that enables organizations to monitor and manage internal and external communications for regulatory compliance, legal risk, and inappropriate behavior. It supports capture, ingestion, pattern-based detection, review, and remediation of communications across Exchange Online email, Microsoft Teams, Yammer, and third-party platforms via connector integration. The system is built on a foundation of policy-driven architecture, machine learning classifiers, and role-based access control to ensure that only authorized reviewers see flagged content.

At its core, Communication Compliance operates through policies. A policy defines which communications to supervise, who is supervised (users or groups), which detection conditions apply, and what percentage of communications to review. Detection conditions include keyword matching, sensitive information types (like credit card numbers or passport numbers), offensive language classifiers, and even custom machine learning models. For example, a policy might detect any message that contains words from a custom list of financial terms combined with a percentage value, which could indicate insider trading. The policies can also include threshold rules, such as detecting a minimum number of matches within a specified window.

Once a communication is flagged, it is stored in a dedicated secure review queue. Authorized reviewers use the Communication Compliance workspace in the Microsoft Purview compliance portal. Reviewers can view the original message in context, including attachments, reply chains, and translated content if needed. The interface allows tagging items as compliant, non-compliant, or pending further investigation. Non-compliant items can trigger remediation actions like notifying the sender, escalating to management, or initiating an eDiscovery case for legal holds.

From a data flow perspective, communications are ingested via the Exchange Online message tracing pipeline and Teams chat history. The system uses eDiscovery export tools to extract message data from the Microsoft 365 substrate. For third-party sources like Slack or Zoom, organizations deploy connectors that pull messages into a unified Azure Data Lake, where they are processed through the same detection logic. All ingested data respects existing retention policies and is subject to audit logging via the Azure Active Directory audit logs.

Communication Compliance is distinct from other compliance tools like Data Loss Prevention (DLP) and eDiscovery. DLP focuses on preventing data exfiltration at the point of sharing, while Communication Compliance is post-delivery detection. eDiscovery is used for legal hold and search after a case is opened, whereas Communication Compliance is proactive monitoring. The three tools often work together: DLP blocks a risky attachment, Communication Compliance flags the attempted share, and eDiscovery holds the relevant data if litigation arises.

Implementation considerations include licensing requirements (typically E5 or E5 Compliance add-on), user scope management (using Azure AD groups to exclude executives or legal counsel), and policy tuning via test mode before full enforcement. Microsoft provides pre-built templates for regulated industries like financial services (FINRA, SEC rules) and healthcare (HIPAA). Administrators must also configure supervised user groups, reviewer groups, and notification templates. The system supports optical character recognition (OCR) for images embedded in messages, which broadens detection to scanned documents and screenshots.

Performance and scalability are designed for enterprise environments. The platform can handle millions of messages per day across thousands of users. Review queues are prioritized by severity level, and automated alerts can be sent via email or Teams to reviewers when high-priority items arrive. Machine learning classifiers improve over time as reviewers feedback on false positives and false negatives. The entire system is backed by Microsoft's compliance boundary guarantees, including data residency options and Customer Lockbox for reviewer access.

## Real-life example

Imagine a large hospital, CityMed Health, with thousands of employees including doctors, nurses, administrators, and support staff. Every day, they send countless emails and messages discussing patient cases, lab results, billing, and insurance claims. One nurse sends an email to a colleague about a patient named John Smith, mentioning his diagnosis and social security number. This email is well-intentioned but violates HIPAA privacy rules because it shares protected health information without needing to. Without communication compliance, this might go unnoticed until a patient complains or a regulator audits. The hospital could face huge fines and loss of trust.

Now think of communication compliance as a diligent librarian who also works as a security guard. The librarian does not read every single book or question every visitor. Instead, the librarian has a special list of forbidden words and patterns: words like "Social Security", patterns like three digits, two digits, four digits (the format of a social security number), and phrases like "patient diagnosis" combined with a name. When the librarian sees a message that matches this list, they pull that message aside, place it in a special folder, and alert the security team.

The hospital sets up a Communication Compliance policy in Microsoft Purview that monitors all emails and Teams messages for sensitive information types like U.S. Social Security Number, U.S. Health Insurance Claim Number, and International Classification of Diseases (ICD) codes. The policy also scans for keywords like "confidential" and "patient" in the same message. The nurse's email is captured, flagged, and sent to a reviewer in the privacy office. The reviewer sees that the nurse violated policy by sharing the SSN. Because the violation is minor and unintentional, the reviewer sends an automated notification to the nurse reminding them of proper procedures. The message is also stored for retention in case of future audits.

Later, a different employee in billing sends a Teams message to a friend saying, "We are getting a huge audit next month, sell your stock now if you have it." This is a potential insider trading tip. The Communication Compliance policy for financial monitoring detects the combination of "audit" and "sell your stock" and flags it. The reviewer escalates this to the legal team for investigation. Without the system, this message would have disappeared into the chat history, and the hospital could have faced securities fraud liability.

In both cases, communication compliance did not prevent the message from being sent; it detected it after delivery. This is like a security camera that records everything and has a motion detector that only alerts when something suspicious happens. The hospital (like any organization) needs this because it is impossible to manually review every message the same way it is impossible for a security guard to watch every camera feed simultaneously. The system makes monitoring practical and effective.

## Why it matters

In today's digital workplace, communication channels have exploded. Employees use email, instant messaging, video calls, social media, and collaboration platforms to exchange information constantly. This creates enormous compliance risk for organizations, especially those in regulated industries like finance, healthcare, insurance, and government. Regulatory bodies such as the SEC, FINRA, HIPAA, GDPR, and the FCA require firms to capture, monitor, and retain business communications for periods ranging from three to seven years. Failure to comply can result in fines of millions of dollars, legal sanctions, and reputational damage that takes years to repair.

Communication Compliance matters because it provides a systematic, scalable way to manage this risk. Without it, organizations rely on manual audits or hope that employees follow rules on their own, which is unreliable. Automated monitoring ensures that no communication slips through unnoticed, even in organizations with tens of thousands of users. It also helps organizations detect and address internal issues such as harassment, discrimination, or leakage of trade secrets before they escalate into public scandals or lawsuits.

From an IT perspective, Communication Compliance is a cornerstone of a modern compliance program. It integrates with existing Microsoft 365 infrastructure, reducing deployment complexity. It also supports continuous improvement through machine learning, reducing false positives over time. For IT professionals, understanding Communication Compliance is essential for designing compliant architectures, configuring policies correctly, and training end-users. As regulators increasingly expect proactive monitoring rather than reactive investigation, Communication Compliance has become a business necessity, not just a nice-to-have feature.

## Why it matters in exams

Communication Compliance appears in several major certification exams, but with varying weight. For the Microsoft SC-900 (Microsoft Security, Compliance, and Identity Fundamentals), this concept is a primary objective. The SC-900 exam tests candidates on core compliance capabilities in Microsoft 365, including Communication Compliance, data loss prevention, and information protection. Expect scenario-based questions that ask you to identify which Microsoft Purview solution is appropriate for a given business requirement. For example, a question might describe a financial firm that needs to monitor employee emails for insider trading language, and you must choose Communication Compliance as the answer.

For the MS-102 (Microsoft 365 Administrator), this term is also primary because administrators are responsible for configuring and managing compliance features. The exam tests your ability to set up supervisory policies, assign reviewer permissions, and interpret compliance reports. You might be asked to troubleshoot why a policy is not capturing communications, which requires knowledge of supervised user groups, policy scoping, and licensing requirements. The AZ-104 (Microsoft Azure Administrator) only has light_supporting relevance. While AZ-104 does not directly cover Communication Compliance, you may need to know that Communication Compliance relies on Azure AD for identity and that compliance data is stored in Azure regions. The exam focuses more on infrastructure than compliance applications.

For security-focused exams like the ISC2 CISSP and CompTIA Security+, Communication Compliance plays an also_useful role. It aligns with domain topics such as security and risk management, legal and regulatory compliance, and security operations. You will not see Communication Compliance as a named term, but the underlying principles of monitoring, detecting, and responding to policy violations are central to the CISSP Common Body of Knowledge. In the CySA+ (Cybersecurity Analyst), this term is also_useful because it relates to continuous monitoring and incident response. You might see a question where you have to recommend a solution for monitoring insider threats via communications, and Communication Compliance could be the correct choice.

The CompTIA Security+ exam (SY0-601 and SY0-701) includes this term as also_useful. It falls under the domain of technologies and tools for monitoring and securing communications. Questions may ask about the purpose of communication monitoring, differences between monitoring and data loss prevention, or the importance of retention policies. The MD-102 (Microsoft 365 Endpoint Administrator) touches this term at a light_supporting level, as endpoint administrators may need to understand how Communication Compliance policies interact with devices, particularly in Bring Your Own Device (BYOD) scenarios where communications happen on managed and unmanaged devices.

To succeed in exam questions, remember that Communication Compliance is a reactive monitoring solution (post-delivery), not a blocking solution. It is also policy-driven and requires careful scoping to comply with privacy laws. Many questions test this distinction against DLP and eDiscovery. Also memorize the Microsoft 365 licensing requirement: Communication Compliance is part of the E5 suite or the E5 Compliance add-on. A typical trap question will offer a solution that requires only E3 licensing, which is incorrect.

## How it appears in exam questions

Exam questions about Communication Compliance generally fall into one of three patterns: scenario-based identification, configuration troubleshooting, and tool comparison.

Scenario-based identification questions present a business requirement and ask you to select the appropriate Microsoft Purview solution. For example: "A financial services company must monitor all employee Teams messages for potential insider trading activity. Which solution should they implement?" The correct answer is Communication Compliance. Distractors might include Data Loss Prevention (which blocks sharing), eDiscovery (used for case-based search), or Microsoft Entra ID (identity management). The key is to recognize the monitoring use case.

Configuration troubleshooting questions test your understanding of how policies work. You might be given a scenario where a policy is set up but not capturing any communications. The question then asks: "What is the most likely cause?" Possible answers include: the supervised users are not in the correct Azure AD group, the reviewer group does not have the Communication Compliance admin role, the policy is still in test mode, or the license for the supervised users is E3 instead of E5. The correct answer often relates to licensing or group membership. For instance, if all users have E3 licenses, Communication Compliance will not work because it requires E5.

Tool comparison questions ask you to differentiate between Communication Compliance, DLP, eDiscovery, and retention policies. An SC-900 question might say: "What is the primary purpose of Communication Compliance compared to Data Loss Prevention?" The answer should highlight that DLP prevents data from being shared (prevention), while Communication Compliance monitors communications after they have been sent (detection). Another variation: "Which Microsoft Purview solution is designed to detect inappropriate language in employee emails?" Again, Communication Compliance.

For more advanced exams like MS-102, questions may involve step-by-step configuration. You might be asked: "You need to create a Communication Compliance policy that monitors all executives for conflicts of interest. Which two components must you configure first?" Answer: supervised users group and a detection condition (like keyword list). Another question might ask about automated remediation: "When a communication is flagged as non-compliant, which action can be automatically triggered?" Options include: notify the sender, escalate to manager, or hold for eDiscovery. The answer depends on the policy configuration.

Finally, the security exams (CISSP, Security+) will ask about the concept rather than the specific Microsoft product. A question might say: "Which type of control is implemented when an organization monitors employee emails for policy violations?" Answer: detective control. Or: "What is the primary benefit of automated communication monitoring?". Answer: it scales to large volumes of data and reduces reliance on manual review.

To handle these questions, focus on understanding the why and when behind Communication Compliance. Do not just memorize product names; understand the underlying purpose of monitoring, the difference between prevention and detection, and the importance of scoping to avoid privacy violations. Also be aware that Communication Compliance is part of the Microsoft 365 compliance ecosystem, so questions may reference other tools that you need to distinguish.

## Example scenario

You are the compliance officer at a medium-sized insurance company called Shield Insurance. Your CEO has received a complaint from a customer who claims an employee shared their policy information with an unauthorized person via email. The CEO asks you to ensure all employee communications are monitored to prevent data leaks and regulatory non-compliance.

You decide to implement Microsoft Purview Communication Compliance. First, you create an Azure AD group named "Monitored Employees" and add all insurance agents and support staff. You do not include the legal team because their communications are privileged. Next, you define a policy named "Customer Data Protection". The policy targets the Monitored Employees group and scans for sensitive information types like U.S. Social Security Number (Sensitive Information Type). You also add keywords like "policy number" and "confidential". You set the policy to review 100% of communications to start.

After a week, the policy flags a message from an agent named Sarah to an external email address. The message contains a customer's name and a mention of their policy number. The reviewer sees that Sarah was emailing the customer directly with a policy update. This is allowed, so the item is marked compliant. However, another flagged message shows an agent named Tom writing to his brother, including a screenshot of a claim form with a visible claim number. The reviewer identifies this as a violation of the company's data handling policy and escalates it to Tom's manager. Tom receives an automated training reminder.

Later, the policy detects a Teams chat where two agents are joking about a customer's medical condition. The classifier for offensive language flags it. The reviewer tags it as non-compliant and sends a notification to both employees and their manager. The company now has a record of the incident for HR follow-up.

This scenario demonstrates how Communication Compliance helps Shield Insurance meet regulatory obligations (like protecting consumer information), reduces legal risk by catching violations early, and provides a audit trail to satisfy regulators that the company is monitoring communications appropriately. Without the tool, the CEO would not have known about the chat or the screenshot share until it became a lawsuit.

## Understanding Communication Compliance and Its Role in Regulatory Compliance

Communication Compliance is a Microsoft 365 solution designed to help organizations detect, capture, and act on inappropriate or risky communications within their digital workplace. It is a critical component of the broader compliance and security posture, enabling organizations to meet regulatory requirements such as the Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HIPAA), the General Data Protection Regulation (GDPR), and the Financial Industry Regulatory Authority (FINRA) rules. The primary purpose of Communication Compliance is to monitor internal and external communications-including email, Microsoft Teams messages, Yammer posts, and third-party data-for content that violates company policies or regulatory mandates.

From an exam perspective, especially for certifications like MS-102, SC-900, and Security+, Communication Compliance is often tested as a data loss prevention and insider risk management tool. It allows compliance officers to define policies that scan for specific types of content, such as harassing language, financial disclosures, or confidential data sharing. The solution leverages machine learning to classify content and can be integrated with Microsoft Purview for unified governance. Administrators must understand that Communication Compliance policies are built on conditions and actions, similar to DLP policies, but focus specifically on communication channels.

One key concept is the supervisory review workflow, where designated reviewers can investigate flagged messages, escalate issues, or resolve them. This workflow supports arbitration, allowing organizations to ensure fair handling of violations. Communication Compliance also integrates with Microsoft eDiscovery for legal hold capabilities and with audit logs for tracking reviewer actions. In exam scenarios, questions often revolve around policy scoping-such as targeting specific users or groups-and understanding the difference between Communication Compliance and other compliance solutions like Insider Risk Management or Information Barriers.

Another critical aspect is the handling of third-party data, such as from Slack, Zoom, or Salesforce, through custom connectors. This makes Communication Compliance a versatile tool for hybrid environments. The solution also respects user privacy by default, allowing users to see only their own flagged messages unless they are designated reviewers. For exam preparation, remember that Communication Compliance is licensed under Microsoft 365 E5, Compliance E5, or as an add-on, and requires proper permissions for reviewers and administrators. Common exam topics include the policy creation wizard, the role of communication compliance analysts, and the automatic retention of flagged items for one year by default.

Ultimately, Communication Compliance is not just a monitoring tool but a cultural enforcement mechanism. It helps organizations reduce legal risks, prevent insider threats, and maintain a respectful workplace. Exams test your ability to configure policies without causing over-capture, understand the data lifecycle, and troubleshoot common issues like policy mismatches or reviewer access problems. Mastery of these concepts is essential for roles like Microsoft 365 Administrator, Security Administrator, or Compliance Administrator.

## Step-by-Step Policy Configuration for Communication Compliance in Microsoft 365

Configuring Communication Compliance policies in Microsoft 365 requires a systematic approach to ensure effective monitoring without overwhelming compliance teams. The process begins in the Microsoft Purview compliance portal, under the Communication Compliance section. Before creating a policy, administrators must enable auditing in the organization, as Communication Compliance relies on audit logs to capture reviewer actions and policy changes. Permissions must be assigned via the Compliance Center role groups, typically granting roles like Communication Compliance Admin and Communication Compliance Analyst.

To create a policy, navigate to Communication Compliance > Policies > Create policy. The wizard guides you through several steps. First, choose a policy template based on common use cases: Detect inappropriate content, Monitor for regulatory compliance, Conflict of interest, or Custom policy. For example, the "Detect inappropriate content" template uses pre-built classifiers for offensive language, harassment, and threats. Selecting a template pre-fills conditions but allows customization. Next, name the policy and assign it to specific users or groups. You can choose to monitor all users, specific users, or groups. This is critical because monitoring all users can generate high volumes of false positives; exam questions often test the ability to scope policies correctly.

The next step involves choosing the communication channels to monitor: Exchange mail, Microsoft Teams, Yammer, or third-party connectors. You can also configure direction-inbound, outbound, or internal. For regulatory compliance, you might monitor only communications sent to external recipients. Then, define conditions using classifiers or keyword dictionaries. For example, you can add a custom keyword list for financial terms like "confidential" or "insider trading." You can also use trainable classifiers from Microsoft, such as "harassment" or "profanity." These classifiers use machine learning to detect patterns.

After conditions, define actions. For instance, you can enable automatic retention of flagged items for one year or send notifications to reviewers. The policy also allows setting up supervisory review, where designated reviewers receive alerts. Reviewers can tag items as compliant, non-compliant, or unresolved. You can also set a percentage of messages to review for arbitration. Finally, review the policy and create it. Once active, the policy begins scanning communications retroactively up to 90 days, depending on the data stored.

For exam preparation, remember that policies can be tested in simulation mode before enforcement. Also, note that Communication Compliance policies require a Microsoft 365 E5 or Compliance E5 license per user being monitored. Common exam pitfalls include forgetting to assign reviewer roles, failing to enable auditing, or misunderstanding that policies apply only to users in the monitored group, not all users. Understanding the policy lifecycle-creation, activation, and review-is essential for MS-102 and SC-900 exams. Know that Communication Compliance integrates with eDiscovery for legal hold and with Microsoft 365 audit logs for tracking changes.

Best practices include starting with a pilot group, using custom dictionaries for industry-specific terms, and regularly reviewing classifier accuracy. Policy conflicts can occur if multiple policies overlap, so design policies to be mutually exclusive. Finally, remember that reviewers must have an appropriate license and the correct role to access flagged items. Troubleshooting common issues like missing flagged messages often involves checking audit logs or policy scoping. This section ensures you can configure Communication Compliance policies effectively in real-world scenarios and in exam questions.

## Supervisory Review Workflow and Case Management in Communication Compliance

The supervisory review workflow in Communication Compliance is a structured process that allows designated reviewers to analyze flagged communications, make determinations, and escalate as needed. This workflow is central to the solution's value, enabling organizations to enforce compliance policies while maintaining fairness and transparency. The workflow begins when a policy triggers on a message that matches certain conditions, such as offensive language or financial disclosures. These flagged items are aggregated into cases within the Communication Compliance workspace.

Each case contains one or more messages relevant to a specific policy violation. Reviewers-typically compliance analysts or managers-are assigned to these cases based on their role group permissions. The reviewer interface provides a rich view of the flagged message, including metadata like sender, recipient, timestamp, and communication channel. Reviewers can also view the message context, such as the entire thread in Teams or email chain, to understand the conversation. This contextual view is crucial for accurate judgment.

Reviewers have several options. They can mark the message as compliant, meaning no policy violation occurred, and the case is closed. They can mark it as non-compliant, which triggers an escalation to specified managers or legal teams for further action. Alternatively, they can mark it as unresolved if more information is needed, which keeps the case open for follow-up. Reviewers can annotate messages with notes for future reference or attach tags for categorization. This tagging feature helps compliance teams track trends, such as repeated violations by specific users.

The workflow also includes an arbitration stage for cases where multiple reviewers disagree. Administrators can configure a percentage of messages for arbitration, ensuring that a subset of flagged items receives a second review. This reduces bias and enhances compliance integrity. Once a case is resolved, it is archived and retained for a configurable period, defaulting to one year. Archived cases can be searched via eDiscovery if legal holds are in place.

From an exam perspective, especially for MS-102 and SC-900, you must understand the role of Communication Compliance Analyst vs. Communication Compliance Admin. Analysts can review cases but cannot create or modify policies. Admins can do both. Also, know that cases can be escalated to eDiscovery for legal holds, but Communication Compliance itself does not support legal holds directly. Another important feature is the automatic notification system: reviewers can be alerted via email when new cases are assigned, and users whose messages are flagged are notified only if the policy is configured to do so.

Common exam questions involve understanding what happens when a reviewer marks a message as non-compliant-the message is automatically escalated to a predefined manager or legal contact, and audit logs record the action. Another typical scenario: if a policy detects a conflict of interest, the reviewer must determine if the communication is actually a violation based on company policy. The workflow emphasizes human judgment, as machine learning classifiers can produce false positives.

Troubleshooting workflow issues often involves checking reviewer permissions, ensuring proper licensing, and verifying that the policy is actually evaluating communications. If cases are not appearing, check that auditing is enabled and that the policy is scoped to include the users involved. Reviewers can only see cases assigned to them; if a case is assigned to another group, they won't see it. This role-based access control is a critical concept for exam preparation and real-world administration.

the supervisory review workflow is the engine that turns flagged communications into actionable compliance outcomes. It requires careful role assignment, clear escalation paths, and regular training for reviewers. For certifications like Security+ or CySA+, understanding this workflow helps in designing audit trails and incident response procedures. This section provides a comprehensive view of the workflow and its management.

## Licensing, Cost, and Deployment Considerations for Communication Compliance

Communication Compliance is a premium feature within Microsoft 365, and its cost is directly tied to licensing requirements. To use Communication Compliance, each user whose communications are monitored must have a license that includes Communication Compliance capabilities. The primary licensing options are Microsoft 365 E5, Microsoft 365 Compliance E5, or Microsoft 365 E5 Security. Organizations can purchase the Microsoft 365 Communication Compliance add-on for other E3 or E5 plans, but this incurs an extra per-user monthly cost. For exam purposes, especially for MS-102 and SC-900, knowing the licensing requirements is critical because questions often present scenarios where a company has E3 licenses and wants to monitor communications; the answer typically involves recommending an upgrade to E5 or purchasing the add-on.

The cost of Communication Compliance can be significant for large organizations, as it is priced per user per month. In 2025, the approximate list price for the add-on is around $8 per user per month, while E5 licensing bundles many other features like DLP, eDiscovery, and Insider Risk Management. Therefore, organizations must weigh the total cost of ownership against regulatory risks. For example, a financial institution with 10,000 employees might need to monitor all traders' communications for FINRA compliance, making E5 licensing a cost-effective choice compared to per-add-on licensing for each user.

Deployment considerations extend beyond cost. First, organizations must assess which users need monitoring. Over-monitoring can lead to information overload and higher licensing costs. It is common to monitor only roles like executives, financial team members, or employees in regulated departments. Second, the organization must enable auditing in Exchange Online and Microsoft 365 before policies work. This is often overlooked and can delay deployment. Third, reviewer roles must be assigned-Communication Compliance Admin and Communication Compliance Analyst-each with specific permissions. Admins can configure policies, while analysts can only review flagged items. Licensing for reviewers is also required if they are being monitored, but not necessarily if they only review others' communications, though most organizations assign licenses to all users for consistency.

Another deployment consideration is data residency. Communication Compliance data is stored in the Microsoft 365 data center region associated with the tenant. For organizations in the EU, data must remain in EU data centers for GDPR compliance. Microsoft Purview supports data residency commitments, but administrators should verify this during setup. Also, third-party data sources like Slack or Zoom require separate connectors, which may have additional licensing or configuration costs.

From an exam perspective, typical questions involve identifying which licenses allow Communication Compliance, or troubleshooting a policy that isn't working because the user being monitored lacks an E5 license. Another common scenario: a company wants to monitor but only has Microsoft 365 Business Premium licenses; the answer is that Communication Compliance requires enterprise E3 or E5, not Business Premium. Know that Communication Compliance is available in Microsoft 365 Government Community Cloud (GCC) and GCC High, but with limitations; for example, trainable classifiers may not be fully available in GCC High.

Cost optimization strategies include using pilot programs with a small group first, leveraging built-in classifiers to reduce false positives (which saves reviewer time), and integrating with existing workflows to avoid duplicate effort. Finally, remember that Communication Compliance is only one part of a broader compliance ecosystem; organizations should evaluate how it fits with DLP, eDiscovery, and Audit logging to avoid overlapping solutions and unnecessary costs. This section equips you with the knowledge to make informed decisions about licensing and deployment, which is essential for both exams and real-world administration.

## Common mistakes

- **Mistake:** Assuming Communication Compliance blocks or prevents messages from being sent.
  - Why it is wrong: 
  - Fix: Understand that Communication Compliance is for detection and review; DLP is for prevention. Use Communication Compliance when the requirement is to oversight.
- **Mistake:** Thinking that any Microsoft 365 license includes Communication Compliance.
  - Why it is wrong: 
  - Fix: Check the licensing requirements. Only users with E5 licenses can be fully monitored. For exam questions, remember: Communication Compliance = E5.
- **Mistake:** Forgetting to configure a supervised users group and including all users by default.
  - Why it is wrong: 
  - Fix: Always define an Azure AD group for monitored users. Do not use 'all users' haphazardly. In exams, look for a policy that includes a 'supervised users' group.
- **Mistake:** Confusing Communication Compliance with eDiscovery.
  - Why it is wrong: 
  - Fix: If the scenario is about ongoing monitoring to detect violations, choose Communication Compliance. If the scenario is about searching all data for a specific legal case, choose eDiscovery.
- **Mistake:** Setting the detection conditions too broadly or too narrowly.
  - Why it is wrong: 
  - Fix: Start with pre-built templates and test mode. Gradually refine detection conditions based on false positive feedback. In exams, know that the condition must match the business need described.

## Exam trap

{"trap":"A question asks: 'Your organization needs to monitor employee emails for trade secrets being shared externally. Which Microsoft Purview solution should you use?' The options include Communication Compliance, Data Loss Prevention, Azure Information Protection, and Microsoft Cloud App Security.","why_learners_choose_it":"Learners often choose Data Loss Prevention because they think of 'preventing' data leaks. But the question says 'monitor' not 'prevent'. Communication Compliance is the correct answer because it is designed for monitoring and detecting violations after the fact.","how_to_avoid_it":"Read the question carefully for keywords like 'monitor', 'review', 'detect', and 'flag'. If the requirement is to block or prevent sharing, choose DLP. If it is to monitor and review communications for policy violations, choose Communication Compliance."}

## Commonly confused with

- **Communication Compliance vs Data Loss Prevention (DLP):** DLP prevents users from sharing sensitive information by blocking messages or files at the moment of sharing. Communication Compliance monitors communications after they have been sent. DLP is proactive, Communication Compliance is reactive. (Example: A DLP rule might block an email containing a credit card number from being sent. A Communication Compliance policy would flag that email after it is sent, for review.)
- **Communication Compliance vs eDiscovery (Microsoft Purview eDiscovery):** eDiscovery is used to search for and preserve content as part of legal or internal investigations. Communication Compliance is used for ongoing compliance monitoring. eDiscovery is case-based and reactive, while Communication Compliance is continuous and proactive. (Example: If a lawsuit is filed, the legal team uses eDiscovery to find all relevant emails. Communication Compliance would have already been flagging similar emails daily as part of routine oversight.)
- **Communication Compliance vs Records Management:** Records Management deals with classifying, labeling, and retaining content for legal and regulatory purposes. Communication Compliance is about monitoring content for policy violations. They work together but are not the same. (Example: Records Management ensures that flagged communications are kept for seven years. Communication Compliance determines which communications need to be retained as evidence of policy action.)
- **Communication Compliance vs Azure Information Protection (AIP):** AIP classifies and protects documents and emails based on sensitivity labels. Communication Compliance does not assign labels; it detects risky content after it has been labeled or not labeled. AIP is about protection, Communication Compliance is about supervision. (Example: AIP might automatically add a 'Confidential' header to an email. Communication Compliance would then monitor if that confidential email is sent to an unauthorized external domain.)
- **Communication Compliance vs Microsoft Cloud App Security (MCAS):** MCAS monitors and controls third-party cloud apps and shadow IT. Communication Compliance focuses on Microsoft 365 native communications. MCAS extends monitoring to apps like Dropbox or Slack, while Communication Compliance is for Exchange, Teams, and Yammer. (Example: MCAS can block downloads from Box.com. Communication Compliance can monitor Teams chats for the same file being mentioned.)

## Step-by-step breakdown

1. **Define Compliance Requirements** — Understand regulatory obligations (e.g., SEC, FINRA, HIPAA) and internal policies that require communication monitoring. This determines what types of content need to be captured and who should be monitored.
2. **Assign Licenses** — Ensure all monitored users have Microsoft 365 E5 licenses or the E5 Compliance add-on. Without this, Communication Compliance policies will not capture their communications.
3. **Create Azure AD Groups for Scoping** — Create groups for 'supervised users' (those being monitored) and 'reviewers' (those who will review flagged items). Exclude privileged groups like legal or executives from monitoring to avoid legal privilege issues.
4. **Assign Permissions** — Grant the Communication Compliance admin role to reviewers and the Communication Compliance role group to administrators. Use role-based access control to ensure only authorized personnel access flagged content.
5. **Configure Detection Conditions** — Define policies with detection conditions such as keywords, sensitive information types (e.g., SSN, credit card), offensive language classifiers, or custom machine learning models. Conditions determine what triggers a flag.
6. **Set Policy Scope and Percentage** — Specify the users and groups to be monitored. Set the percentage of communications to review (100% for high-risk groups, less for lower risk). Choose whether to include internal, external, or both types of communications.
7. **Test the Policy in Test Mode** — Run the policy in test mode to see which communications get flagged. Review the results to evaluate false positive and false negative rates. Adjust detection conditions based on this feedback before turning on the policy.
8. **Turn On the Policy** — After testing, enable the policy. The system will begin capturing and flagging communications. Reviewers see flagged items in the Microsoft Purview compliance portal and can take actions like marking compliant, non-compliant, or escalating.
9. **Provide Reviewer Training and Remediation** — Train reviewers on how to use the review interface, interpret flagged content, and take appropriate actions (notify sender, escalate to manager, initiate eDiscovery hold). Automated notifications can be sent to users who violate policy.
10. **Monitor and Refine the Policy** — Regularly review false positive reports and adjust detection conditions. Machine learning classifiers improve over time if reviewers provide feedback. Audit logs track who accessed flagged items to ensure compliance with privacy regulations.

## Practical mini-lesson

Communication Compliance in practice is a blend of policy design, identity management, and ongoing oversight. As an IT professional or compliance administrator, you will spend most of your time defining policies that are effective without being overly broad. A common mistake is to create a single policy that monitors all users for all conditions. This leads to thousands of false positives and reviewer burnout. Instead, follow a layered approach.

Start with pre-built templates from Microsoft Purview that align with common regulations. For example, the template "Financial regulatory compliance" includes conditions for insider trading, bribery, and conflicts of interest. You can copy this template and modify it to match your organization's specific risk profile. Create separate policies for different business units: one for finance, one for sales, one for HR. This allows you to fine-tune conditions per group.

When configuring detection conditions, use the built-in sensitive information types to automatically find credit card numbers, bank account numbers, and medical record numbers. Combine these with custom keyword lists for industry-specific terms. For example, a pharmaceutical company might add words like "clinical trial" or "FDA" combined with a date. The system allows you to create conditional detection using AND/OR logic, which reduces noise.

Role-based access control is critical. You must define who can create policies (Communication Compliance admin) and who can review flagged content (Communication Compliance reviewer). These roles should be separate to enforce segregation of duties. For example, the compliance officer can create policies, but the HR team reviews flagged items. The HR reviewers should not be able to modify the policy itself.

Another crucial aspect is data retention and access auditing. When a communication is flagged, it becomes part of the policy's data store. You need to configure retention policies to keep flagged data for as long as required by regulation. Audit logs record every action taken on flagged items, including who viewed them and what decision was made. This creates a defensible chain of custody for regulators.

A practical issue that arises is handling false positives. Even well-tuned policies generate false flags. Reviewers should be trained to quickly dismiss obviously benign items (like a message saying "my password is 12345" as a joke). If the same false positive pattern appears repeatedly, add it to a suppression rule or modify the detection condition. Over time, machine learning classifiers will improve if reviewers provide feedback.

What can go wrong? If you forget to exclude legal counsel from monitoring, you may violate attorney-client privilege. If you do not configure the correct group for supervised users, the policy will capture zero communications and you will think it is working. If you set the percentage too low on a high-risk group, you might miss violations. Always test in test mode first, and monitor the policy dashboard for activity.

Finally, remember that Communication Compliance is part of a larger compliance ecosystem. It works alongside DLP to prevent and detect, and with eDiscovery to hold and search. As an IT professional, you should design policies that integrate with these other tools. For example, when a user is flagged three times, you can automatically create an eDiscovery case. This kind of automation saves time and ensures consistent enforcement.

## Commands

```
New-CommunicationCompliancePolicy -Name "Regulatory Compliance Policy" -Scope AllUsers -RetentionDurationDays 365 -EnableRetention
```
Creates a new Communication Compliance policy in PowerShell targeting all users with a 365-day retention period for flagged items.

*Exam note: The -RetentionDurationDays parameter is often tested; default is 365 days, but this cmdlet demonstrates how to set it explicitly. Also note that Scope AllUsers requires E5 licenses for all users.*

```
Set-CommunicationCompliancePolicy -Identity "Regulatory Compliance Policy" -AddUserGroup @("group@contoso.com") -RemoveUserGroup @("oldgroup@contoso.com")
```
Modifies an existing policy to add a new monitored group and remove an old group using PowerShell.

*Exam note: This tests understanding of dynamic group management in Communication Compliance; exam questions often ask which cmdlet to use to change monitored users.*

```
New-CommunicationComplianceRule -Name "Harassment Detection" -Policy "Regulatory Compliance Policy" -SenderCondition "SenderDepartment -eq 'Sales' " -ReceiverCondition "RecipientDepartment -ne 'Compliance' " -Classifiers @("Harassment")
```
Creates a rule within a policy that flags only messages from Sales to non-Compliance recipients using the Harassment classifier.

*Exam note: Tests the concept of rule conditions vs. policy conditions. Classifiers are a common exam topic-only available in E5.*

```
Enable-CommunicationCompliancePolicy -Identity "Policy1"
```
Activates a previously created policy that was in a disabled state.

*Exam note: Sometimes a policy is created but not enabled; this cmdlet is needed to start scanning. Exam questions may test that policy status must be 'Active' to work.*

```
Set-CommunicationCompliancePolicy -Identity "Policy1" -Disabled $true
```
Disables an active policy, stopping all scans and case generation.

*Exam note: Used for temporary suspension, e.g., during maintenance. Exam questions may ask how to stop a policy without deleting it.*

```
Get-CommunicationComplianceCase -PolicyName "Policy1" -Status Resolved | Select-Object -First 10
```
Retrieves the first 10 resolved cases for a specific policy using PowerShell.

*Exam note: Knowing how to query cases is essential for auditing. Exam questions may test the difference between 'Resolved' and 'Active' statuses.*

```
Add-CommunicationComplianceCaseMember -CaseId "caseid123" -Member "user@contoso.com" -Role Reviewer
```
Adds a user as a reviewer to a specific case.

*Exam note: Tests the delegation model: cases can have multiple reviewers, but only those with appropriate roles can be added. Exam questions often present scenarios where a reviewer can't see a case because they aren't a member.*

```
Set-CommunicationCompliancePolicy -Identity "Policy1" -NotificationOptions @{NotifySender=$true; NotifyManager=$true; ManagerEscalation=$true}
```
Configures the policy to notify the sender and their manager when a message is flagged.

*Exam note: Notification settings are often tested in exam scenarios about workflow; only managers can be escalated, not random users.*

## Troubleshooting clues

- **No flagged messages appearing in Communication Compliance** — symptom: After creating and enabling a policy, no cases or flagged items appear in the review interface, even though communications are happening.. This usually occurs because auditing is not enabled in Exchange Online or the Microsoft 365 environment. Communication Compliance relies on audit logs to capture flagged communications. Without auditing, the policy has no triggers. Another cause could be that the policy is scoped to a group that doesn't exist or has no user mailboxes enabled. (Exam clue: Exam questions may describe a scenario where a compliance admin sees empty results, and the correct answer is to enable auditing via the Compliance Center or Set-AdminAuditLogConfig cmdlet.)
- **Reviewer cannot see assigned cases** — symptom: A user with the Communication Compliance Analyst role reports that they can see no cases, even though other reviewers can.. This is typically due to missing case membership. Even with the correct role, a reviewer must be explicitly added to a case as a member. Alternatively, the reviewer might not have the required license (E5 or Compliance E5) to access the feature. Also, check if the reviewer's account is part of the monitored group or not-it's not required but can affect visibility. (Exam clue: A classic exam trick: a reviewer can't see cases because they weren't added as a case member, not because of role or license. The solution is to use Add-CommunicationComplianceCaseMember.)
- **Policy not scanning third-party data (e.g., Slack)** — symptom: Communication Compliance policy is scanning emails and Teams messages but not picking up Slack messages from a connected third-party connector.. Third-party connectors must be configured separately using the Microsoft 365 Compliance Center or PowerShell. The connector requires proper credental management and may have latency issues. The policy must include the third-party channel in its configuration, or it will not scan that data source. Also, ensure the connector is in a healthy state and not paused. (Exam clue: Exams test that third-party data is not scanned by default; you must add the connector and then modify the policy's included channels.)
- **False positives from built-in classifiers** — symptom: The policy flags a high number of messages that are clearly not violations, such as a manager complimenting an employee being flagged as harassment.. Built-in classifiers like 'Harassment' or 'Profanity' are not perfect and can misinterpret context, sentiment, or sarcasm. The classifier may flag a message that contains words with dual meanings (e.g., 'kill' in 'killing it today'). This is a known limitation of machine learning models. To reduce false positives, use custom keyword dictionaries and trainable classifiers with feedback loops. (Exam clue: Exams may present a scenario with high false positives and ask for the best solution, which is to adjust policy conditions using custom dictionaries or exclude certain users/groups.)
- **Flagged messages not retained for review** — symptom: After a policy is disabled or deleted, flagged messages disappear from case view, even though they were previously captured.. Flagged messages are retained only during the retention period defined in the policy (default 365 days). If the policy is disabled, retention stops for new items, but existing flagged items should remain until the retention period expires. However, if the policy is deleted, all associated cases and flagged messages are also permanently removed after a short period (usually 30 days). (Exam clue: Exams test that deleting a policy permanently removes its cases; the correct action is to disable the policy instead, to preserve historical cases.)
- **Policy fails to create due to validation errors** — symptom: While creating a policy in the wizard, an error message appears saying 'Policy creation failed' or 'Invalid condition'.. This often happens if the policy name contains special characters, the selected classifier is not available in the tenant, or if the assigned group is a dynamic distribution group that doesn't have user mailboxes. Also, the policy must have at least one condition and one action. During exam, look for issues like mismatched parameters or unsupported classifiers. (Exam clue: Exam questions may list invalid inputs; the correction is to use a valid group (security group with mail-enabled) or a simpler policy name.)
- **Users not receiving notifications about flagged messages** — symptom: Policies are configured to notify senders or managers, but no emails are sent when a message is flagged.. Notification settings are not enabled by default; they must be explicitly turned on via policy configuration or PowerShell. Also, notifications are sent only if the sender is a licensed user. If the manager's mailbox is not reachable (e.g., external email), notifications may fail silently. (Exam clue: Exams test that notifications require explicit configuration; the default is no notifications. Check the -NotificationOptions parameter.)

## Memory tip

Think of Communication Compliance as the 'after the fact lifeguard': it watches, flags, and reviews, but it does not blow the whistle before the swimmer jumps in.

## FAQ

**Do I need E5 licenses for all users I want to monitor with Communication Compliance?**

Yes, every user whose communications are captured must have a Microsoft 365 E5 license or the E5 Compliance add-on. Users with E3 licenses cannot be monitored.

**Can Communication Compliance monitor messages in real time?**

No, it monitors messages after they have been sent. It is a post-delivery detection solution, not a real-time blocker.

**What types of communications can Communication Compliance monitor?**

It can monitor emails in Exchange Online, messages and chats in Microsoft Teams, posts in Yammer, and communications from third-party sources via connectors (e.g., Slack, Zoom).

**How do I exclude specific users from monitoring?**

When creating a policy, you specify which groups are supervised. Simply do not include the users you want to exclude, or create a separate exclusion group. Best practice is to exclude legal and senior executives to avoid privilege issues.

**What happens when a communication is flagged?**

The flagged item appears in the Communication Compliance review queue. Authorized reviewers can view it, tag it as compliant or non-compliant, send notifications, escalate, or initiate an eDiscovery hold.

**Is Communication Compliance part of the Microsoft 365 Defender suite?**

No, it is part of Microsoft Purview (compliance). Microsoft 365 Defender focuses on security threats, while Purview focuses on compliance and governance.

**Can I use Communication Compliance to monitor only external communications?**

Yes, when configuring a policy, you can choose to monitor internal communications, external communications, or both. This is set during policy creation.

## Summary

Communication Compliance is a critical tool in the Microsoft 365 compliance arsenal, designed to help organizations monitor electronic communications for policy violations, regulatory non-compliance, and inappropriate behavior. Unlike preventive tools like Data Loss Prevention, Communication Compliance operates after messages are sent, flagging content that matches predefined rules for later human review. It integrates with Exchange Online, Teams, Yammer, and third-party apps via connectors, and uses machine learning classifiers to improve detection over time.

For IT certification exams, understanding Communication Compliance means knowing its purpose, licensing requirements (E5), how it differs from DLP and eDiscovery, and how to scope policies using Azure AD groups. The most common exam traps confuse it with prevention tools or assume any license works. Successful exam takers will focus on scenario-based questions that require choosing the right tool based on keywords like 'monitor', 'review', or 'detect'.

In the real world, Communication Compliance helps organizations avoid massive fines, legal action, and reputational damage by catching risky communications early. IT professionals should approach it as part of a broader compliance strategy, pairing it with DLP, eDiscovery, and retention policies for a full lifecycle approach. As workplaces become more digital and regulators become stricter, the importance of Communication Compliance will only grow. For exam purposes, master the key distinctions and licensing gotchas, and you will be prepared for questions in SC-900, MS-102, and Security+ exams.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/communication-compliance