Every enterprise buyer eventually asks the same question: "how does this help us meet our compliance obligations?" It is the right question, and it is often answered badly — with a vague "we're aligned with best practices" instead of a real mapping.
This post is a practical mapping between Microsoft 365 configuration controls and the frameworks organizations are actually measured against: GDPR, HIPAA, and ISO 27001 (with NIST as the connective tissue).
The principle: frameworks want evidence
Compliance frameworks rarely tell you which tool to use. They tell you what outcome you must be able to demonstrate — access control, audit logging, data protection, and so on. The tool is your problem; the evidence is the requirement.
For Microsoft 365, that evidence is, in practice, configuration state: is MFA enforced, are privileged roles minimized, is external sharing restricted, is auditing on, are retention and labeling applied. An audit that records that state, dated, is the evidence.
Access control (the common core)
Every framework below has an access-control requirement, and in Microsoft 365 they all land in the same place:
- MFA enforced for all users and admins
- Conditional Access governing sign-in by risk and device
- Least privilege on privileged roles, with just-in-time access
- Guest and external access restricted to what is necessary
This maps to the identity controls in CIS, CISA SCUBA, and EIDSCA — and to:
- GDPR Article 32 (security of processing), which requires appropriate technical measures including access control.
- HIPAA §164.312(a)(1), which requires access controls for systems containing ePHI.
- ISO 27001 Annex A 5.15 (access control) and the access-related clauses of the 2022 revision.
Auditing and logging
If you cannot audit access, you cannot demonstrate any of the above.
- The Microsoft 365 unified audit log should be enabled and retained.
- Sign-in logs should be available for investigation.
This maps to HIPAA §164.312(b) (audit controls), ISO 27001 A.8.16 (monitoring activities), and the accountability expectations under GDPR.
Data protection and sharing
Where frameworks get specific about data, Microsoft 365 configuration carries the weight:
- External sharing scope and link defaults in SharePoint and OneDrive
- Sensitivity labeling and retention policies
- Device access controls for corporate data
This maps to GDPR's data-protection-by-design expectations, HIPAA's integrity and transmission-security safeguards, and ISO 27001's data-handling controls.
Governance and risk
- Secure Score and configuration reviews show ongoing risk management (ISO 27001 clause 6, HIPAA's periodic evaluation).
- A recurring audit trail demonstrates monitoring over time, which is what "ongoing" requirements actually demand.
Why the mapping matters operationally
Two practical consequences:
- One audit covers many frameworks. The same configuration checks satisfy overlapping requirements across GDPR, HIPAA, ISO 27001, NIST, and CIS. You do not need a separate process per framework — you need one control-level audit and a mapping.
- Evidence is the deliverable. A dated report with findings mapped to controls is what goes into an audit file. A dashboard screenshot is not.
We publish a compliance-focused view of the coverage on the compliance page, and the control-level detail in the benchmark guides.
The short version
Compliance frameworks do not prescribe a tool — they require evidence, and for Microsoft 365 that evidence is configuration state: access control, audit logging, data protection, and governance. Audit those controls, map them to the frameworks, and keep dated reports. One good audit serves many frameworks at once.
Run an audit to produce control-mapped evidence for your compliance file.