MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Audit reports and compliance guides

  Why this is correct

  The Service Trust Portal (STP) is Microsoft's central web repository for trust-related documentation, including independent audit reports such as SOC 1/2/3 and ISO 27001 certificates, as well as compliance guides that map Microsoft cloud services to specific regulatory requirements. Customers rely on these artifacts to perform their own due diligence and to evidence Microsoft's operational controls during external audits, directly supporting the shared responsibility model. The portal also offers a searchable document library with version history, making these two elements foundational to the STP's purpose.

• ✗

  Azure portal

  Why it's wrong here

  Azure portal is a unified web-based management console used to provision, configure, and monitor Azure resources such as virtual machines, storage accounts, and App Service instances. It does not act as a repository for Microsoft's trust or compliance documentation, and it lacks the document library, compliance tools, and access-controlled downloadable reports that define the Service Trust Portal. While Microsoft Entra ID accounts may be used to authenticate to either portal, their functions are completely different: one is for operational resource management, the other is for regulatory evidence.

• ✓

  Compliance Manager

  Why this is correct

  Compliance Manager is a Microsoft Purview solution that is surfaced directly within the Service Trust Portal, providing a workflow-based risk assessment engine for regulations such as GDPR, HIPAA, and ISO 27001. It enables organizations to map Microsoft's internal control evidence to their own compliance requirements, assign control ownership to individuals, and track remediation actions against a compliance score. Because it shares the same underlying data as the audit reports and compliance guides, it is an interactive component of the Service Trust Portal rather than a separate asset, which is why it is correct along with audit reports.

• ✗

  Microsoft Purview compliance portal

  Why it's wrong here

  Microsoft Purview compliance portal is a distinct operational portal focused on data governance, data classification, information protection, and compliance features like eDiscovery, insider risk management, and data loss prevention. It is not a component of the Service Trust Portal and, unlike the STP, it does not publish Microsoft's own audit reports or compliance guides. Instead, the Purview portal helps customers manage their own compliance posture by applying labels, policies, and risk controls to data, whereas the STP gives visibility into Microsoft's independent assurance attests.

• ✗

  Microsoft 365 Defender portal

  Why it's wrong here

  Microsoft 365 Defender portal is an operational security console that unifies the Microsoft 365 Defender XDR suite, including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. Its purpose is incident detection, investigation, and response across the customer's environment, offering such features as the incident queue, advanced hunting, and automated attack disruption. It contains no repository of Microsoft's data-center audit reports or compliance guides, and it is neither a part of nor an entry point into the Service Trust Portal, so it is incorrect for this question about trust documentation.

Go deeper

Related to this question