One tenant, several regulations: getting Compliance Manager to work for you

In our Compliance Manager series, we already created separate assessments for the EU AI Act and NIS2 in Microsoft Purview Compliance Manager. Now imagine both assessments live in the same Microsoft 365 tenant. Different templates, same environment, same colleagues, same evidence. That is where things get interesting.

Most organizations are not dealing with one regulation at a time. They are dealing with several at once, such as NIS2, the EU AI Act, ISO 27001 and GDPR. The real question is simple: do you run each one as a separate compliance project, or do you organize the work once and reuse it where it makes sense?

There are two ways to look at it. You can treat every regulation as its own project, with its own assessment, owner and evidence folder. We advise that you treat them as one set of practical controls that happens to be checked against several rulebooks.

Get this right and you write your incident response procedure only one time. Get it wrong and you write it again for every framework. Let’s look at how to set it up, and just as important, where the combined picture can give you a false sense of progress.

Why structure matters

In data security projects, we see the same pattern all the time. A customer starts with sensitivity labels. A few months later, those same labels help answer questions in NIS2, the EU AI Act, ISO 27001 and GDPR assessments. The labels did not change. The people asking about them did. Here are a few examples we run into regularly:

If you assess each framework on its own, you end up documenting the same work four times, creating four evidence sets that gradually fall out of sync.

Auditors ask the same questions

One evidence pack covering several frameworks is easier to maintain than four that slowly get out of sync. It is also more convincing, because it shows how your organization actually manages the risks instead of just ticking boxes for a certificate.

Premium templates are not free

You don’t have unlimited premium templates you can add as assessments in Compliance Manager. Depending on your licensing agreement, you may have a limited number of premium regulatory templates. Once you have used them all, it is time to pay up. That means you need to choose the templates that matter most, not the ones that simply look interesting.

How sharing works

We covered this mechanic in the previous Compliance Manager article, but here is the short version.

Compliance Manager uses improvement actions to help you organize the work. Some actions can be checked automatically because Compliance Manager can detect signals from Microsoft services and, when configured, supported multicloud environments. Other actions need manual work, such as uploading evidence, adding notes or recording that a policy or training activity is complete. That difference matters when you work with several assessment groups. A tenant-wide technical setting can be picked up by assessments across groups, but manual evidence normally stays connected to the group where you added it. The table below shows the practical difference.

This changes the advice many people expect. Grouping does not magically reduce the technical work, because a setting such as multifactor authentication or data loss prevention still has to be configured properly in the tenant. The real benefit is in the reusable work around it: policies, procedures, training records, ownership decisions and evidence. That is where duplication hurts most.

Designing your structure

The following topics decide whether this works in practice:

• What to group together
• What to keep separate
• How to spend your templates

Think of this as designing the filing cabinet before everyone starts throwing documents into it.

What to group together

A useful way to start is by asking: “Which assessments need the same policies, procedures, training records or evidence?” The table below gives a simple starting point. The first column suggests a group name, the second shows which frameworks could fit in that group, and the third shows the kind of work they are likely to share.

Grouping affects how assessments reuse completed work and shared evidence. Changing the structure later can be difficult, so agree on the grouping model before you create assessments in the portal.

What to keep separate

Grouping is useful, but it is not always the answer. There are two common reasons to keep assessments separate.

Scope. If different business units, subsidiaries or environments need their own evidence trail, give them their own groups. A group can hold one assessment for the same product and regulation combination, so plan this before you start creating assessments.

Ownership. In our experience this is the big one. AI governance, security compliance and privacy often have different owners, deadlines and evidence needs. Separate groups let you scope access per group, so nobody has to scroll through another team’s improvement actions to find their own. You set this per assessment:

Figure 1: Access scoped to a single assessment. Note that a user can only hold one role at a time.

Be aware: a user can hold only one Compliance Manager role at a time. If you move someone from Reader to Contributor, the new role replaces the old one.

How to use your templates

Premium templates are tied to your Microsoft 365 licensing. Microsoft states that the Microsoft Data Protection Baseline is included for all organizations. At the A5, E5 and G5 subscription levels, organizations can choose up to three premium regulations to use for free, depending on the licensing agreement.

So do not start with: “Which template looks interesting?” Start with: “Which frameworks matter most to our organization?” For a European organization running both a security and an AI governance program, NIS2 and the EU AI Act may be obvious candidates. The next choice depends on your reality: ISO 27001, a sector regulation, a customer requirement, or something else entirely. You can check the current status of your assessments on the Assessments page in Compliance Manager:

Figure 2: Example of premium template usage in Compliance Manager. The exact number of available templates depends on your licensing agreement.

In this example, some premium template capacity has already been used and at least one slot remains. Do you notice something else in the screenshot? Every assessment sits in the Default Group. That is what happens when nobody decides the structure, and it is the situation this article is about.

Does your tenant offer a premium assessments trial? If it does, use it before you buy more licenses. Microsoft describes this as a one-time trial for eligible commercial tenants, where you can use 25 premium regulatory templates of your choice for 90 days. Take advantage of this before you open your wallet!

Putting the structure to work

Once the structure works for your organization, the next steps are simple:

1. Start with the technical actions. They improve every assessment automatically, so the fastest early progress comes from closing the configuration gaps.
2. Write each policy once. One incident response procedure, one AI policy, one training record, applied against every assessment in the group that needs it.
3. Execute the actions with the highest points first. Points reflect contribution, so the highest-value actions in a shared group improve several scores at the same time.
4. Export per assessment. Each auditor or regulator gets their own view of the same underlying work.

You can see this for yourself. Just open the improvement actions page in Compliance Manager and look at the Regulations column:

Figure 3: One action, several regulations. The count in front of each row tells you how much work you are not repeating.

The improvement action “Manage contact information” counts toward three regulations at once. So does the insider risk action below it. That is the shared work the earlier table described, and it is why the structure you choose matters more than the number of assessments you create.

Handling updates across groups

Compliance keeps moving. Regulations change. Microsoft products change. Control mappings change. Microsoft regularly provides updates for controls or improvement actions, and Compliance Manager shows these pending updates. Treat those updates as governance decisions: review the impact before you accept them!

When you run several frameworks, review updates in the context of each assessment group. That is useful rather than annoying, because one group may be ready to update while another still needs to finish its current evidence round.

You definitely need to expect movement here. NIS2 implementation depends on national transposition and guidance, and EU AI Act obligations phase in over time. The templates behind them are going to continue to change.

Where the combined picture misleads you

The grouping approach we discussed so far can save real work. But combining frameworks also creates a specific risk, and it is worth a closer look.

More green does not mean more coverage

Four assessments in one group can produce four scores, four progress bars and a lot of reassuring green. Nice to look at, but it does not automatically mean your organization is compliant. Microsoft is clear about this: the compliance score measures progress in completing recommended actions. It is not a guarantee of compliance.

The scope limitation multiplies

Every assessment you create is scoped to the services you selected for that assessment. If your assessment covers Microsoft 365, it gives you a useful view of Microsoft 365. It does not suddenly cover everything else in your organization.

That matters more for some frameworks than for others. Your EU AI Act scope may include AI systems or agents that your colleagues built outside Microsoft 365. Your NIS2 scope may include operational technology, supplier portals or other business-critical systems. Those systems will not appear in a Microsoft 365-only assessment, no matter how many templates you add.

Same work, different rules

The frameworks overlap, but they are not interchangeable. NIS2, ISO 27001 and the EU AI Act each have their own requirements, wording and scope. An ISO 27001 certificate can be useful evidence for part of the story. It is not the whole story.

Be aware: shared improvement actions reduce duplicate work. They do not remove the need to explain which control supports which obligation, and why. That connection still needs to be clear.

Ownership and adoption

Running several Compliance Manager assessments separately is a quick way to annoy people. Legal, HR, security and business owners may receive what looks like the same request again and again, just with a different regulation name on top. Believe us, that is not a great adoption strategy. Quite the contrary.

A better approach is to walk through the assessments in the same group once and clearly show where one policy, procedure or training record supports several frameworks. That turns repeated compliance questions into one shared piece of work. It also helps to assign one clear owner per group, instead of scattering ownership across every single assessment.

A note from Rencore

Grouping solves the duplication problem for the evidence you already know about. It does not tell you what exists in the tenant to begin with. NIS2 Article 21 starts with a risk analysis, and the EU AI Act assumes an inventory of AI systems. Both questions start in the same place: which sites, Teams, apps, flows and agents do we have, who owns each one, and is it still in use?

Compliance Manager does not keep that register, and it was never meant to. This is where Rencore sits next to Purview rather than in front of it. Rencore builds and keeps current the inventory across Microsoft 365, including Copilot Studio and other AI agents, with a named owner and lifecycle status for each object. Sharing and access configurations are checked against the policies you switch on, so oversharing and orphaned workspaces surface before an auditor finds them. For the full picture, see our comparison of Rencore and Microsoft Purview.

That inventory also helps with the ownership point above. When every object already has an owner, assigning one clear owner per assessment group becomes a matter of reading the register, not chasing people across departments.

Conclusion

The value of Compliance Manager is not that it makes several regulations disappear into one awesome score. Its real value is that it helps your organization with the work behind those regulations. When you group assessments around shared controls, you reduce duplicate evidence, make ownership clearer and turn repeated compliance requests into one manageable program.

This only works when you design the structure deliberately:

• Group by the type of work, not by the name of the regulator.
• Keep different scopes and owners apart where needed.
• Spend premium templates on the frameworks that matter most to your organization.
• Then write each policy, procedure and training record once and let it support every assessment where it genuinely applies.

That balance is important. Shared improvement actions save time and make the work easier to manage, but they still need a clear link to the obligations behind each framework. A green assessment is a useful signal, not the finish line. You still have work to do! Keep checking that the work is implemented in practice, that the scope is clear and that anything outside Microsoft 365 is handled elsewhere.

Last updated 10 September 2026