A procurement questionnaire asks whether multi-factor authentication is enforced. An auditor asks who can access audit logs. A customer wants proof that sensitive data is retained and protected. The answer cannot be a reassuring statement or a screenshot taken six months ago. Microsoft 365 compliance evidence needs to show what is configured now, who is accountable and whether the control works as intended.
For many organisations, that proof is scattered across the Microsoft 365 admin centre, Entra ID, endpoint tools, policy documents, service desk records and spreadsheets. The problem is not always a lack of security activity. It is the gap between doing the work and being able to demonstrate it clearly.
The practical objective is simple: know where you stand, know what to fix next, and back your progress up with evidence that remains current.
What Microsoft 365 compliance evidence should prove
Evidence is not a collection of screenshots gathered when an assessment is due. It is information that supports a specific claim about a control. A useful item of evidence lets a reviewer answer four questions: what is in place, where it applies, when it was checked, and who owns it.
Take multi-factor authentication as an example. A policy document saying that MFA is required is useful, but it does not prove enforcement. A Conditional Access policy export or configuration record is stronger. A record showing the policy applies to the relevant users, excludes only approved emergency accounts and has been reviewed by a named owner is stronger still.
The same principle applies across Microsoft 365. Your evidence may need to demonstrate that only approved administrators hold privileged roles, audit logging is enabled, external sharing is controlled, managed devices meet required standards, and information retention policies are operating as intended.
What counts as sufficient proof depends on the requirement and the risk. A customer assurance request may only need a concise control statement and a current configuration record. An ISO 27001 audit, Cyber Essentials assessment or investigation may require more detail, including review records, exceptions, supporting procedures and remediation history.
Understand: map claims to real controls
Start with the outcome you need to demonstrate, rather than opening each Microsoft portal and collecting everything available. A broad requirement such as “protect access to business systems” should be translated into clear, testable control claims. For example: MFA is enforced for users, privileged access is limited, sign-in risk is reviewed, and leavers lose access promptly.
Each claim should have a control owner, a review frequency and a defined evidence source. This avoids the common situation where an IT manager is asked for proof but has to search through several systems to establish whether a setting remains active.
A practical evidence register usually records the control requirement, the Microsoft 365 or Entra ID setting that supports it, the evidence source, the person responsible and the date it was last verified. It should also identify any gaps or approved exceptions. That last point matters. An exception that is visible, risk-assessed and time-bound is far more credible than an unexplained gap discovered during a review.
For Microsoft 365, evidence commonly falls into four connected categories:
- Configuration evidence shows that a security or compliance setting is enabled, such as Conditional Access, anti-phishing policies, retention labels or external sharing restrictions.
- Operational evidence shows that the setting is reviewed and acted upon, such as access reviews, security alerts, ticket records and leaver checklists.
- Governance evidence explains the decision behind the control, including policies, approval records, assigned responsibilities and documented exceptions.
- Outcome evidence shows the control has had an effect, such as a successful restoration test, a phishing simulation result or the closure of a high-risk recommendation.
Configuration on its own is rarely the complete answer. A control can be technically enabled but poorly scoped, unreviewed or bypassed through an unmanaged exception. Combining these categories gives leadership, customers and assessors a more accurate picture.
Avoid evidence that creates more questions
Screenshots have a place, especially when a portal does not offer an accessible export. But they age quickly, can omit key settings and are difficult to compare over time. A screenshot of a policy name proves very little if the included users, exclusions and enforcement status are not visible.
Where possible, retain structured exports, system-generated reports and dated assessment results. Pair them with a short explanation in plain English. A reviewer should not need specialist product knowledge to understand why an Entra ID setting matters to the organisation’s risk.
Also avoid collecting personal or sensitive information unnecessarily. Evidence should be sufficient for the purpose, securely stored and access-controlled. A user list may be needed to validate an access review, but it should not be copied into an unrestricted spreadsheet simply because it was easy to export.
Improve: turn evidence gaps into owned actions
An evidence gap may mean a control is missing, but not always. It may mean the control exists but has no owner, the evidence is out of date, a review has not been recorded, or the setting cannot be shown to cover the required scope. Treating all four situations alike leads to unnecessary work and unclear priorities.
First, assess the risk. A missing Conditional Access policy for administrator accounts is likely to require urgent attention. A missing screenshot of a low-risk configuration may be less pressing if reliable system data is available elsewhere. Prioritisation should reflect business impact, exposure and the relevant framework requirement, not merely the number of incomplete evidence fields.
Then assign a specific action to a named person with a realistic due date. “IT team to review Microsoft 365” is not an actionable remediation item. “Security lead to review and enforce MFA for all privileged Entra ID roles, document emergency-account exclusions and attach the policy export” is.
This is where continuous improvement has an advantage over periodic compliance projects. When evidence collection, assessment findings and remediation actions sit together, teams can see whether a gap is genuinely closed. They can also demonstrate the journey: when an issue was identified, what decision was made, who completed the action and how the result was verified.
Microsoft licensing and tenant design affect what you can evidence. Advanced Microsoft Purview capabilities, identity protection features, device compliance reporting and audit-log retention vary by licence and configuration. If a feature is unavailable, do not imply that it is operating. Document the limitation, consider an alternative control and record the risk decision. Honest evidence is more useful than a polished but unsupported claim.
Prove: keep evidence current and reviewable
Compliance evidence has a shelf life. A Conditional Access rule can be changed, a new collaboration site can be created with different sharing permissions, and an administrator can receive a role outside the normal process. A once-a-year evidence pack cannot reliably reflect those changes.
Set review cycles based on risk. Privileged-role assignments and high-risk identity controls may need monthly or quarterly review. Policies and supporting procedures may be reviewed annually, or sooner after a material change. The right frequency depends on your organisation, but every record should show when it was checked and when it is due again.
Automated collection can reduce the administrative burden and improve consistency. Pulling current Microsoft 365 and Entra ID configuration data into a central workspace is generally more reliable than asking someone to recreate evidence at audit time. It also helps identify drift: the difference between the required standard and the current tenant state.
Automation does not remove judgement. A tool can identify that a policy is disabled or a role has changed. People still need to decide whether the configuration is appropriate, whether an exception is justified and which risk deserves attention first. AI can help interpret findings, explain likely impact and prepare management-ready guidance. Accountability remains with the people responsible for the control.
For organisations working across Cyber Essentials, NIS2, Cyber Fundamentals and ISO 27001, mapping one item of evidence to multiple relevant requirements can prevent duplication. A well-documented MFA control, for instance, may support several framework expectations. The mapping should make those connections visible without suggesting that one technical setting automatically satisfies every requirement.
Cyber Fundamentals AI helps bring assessments, Microsoft 365 evidence, actions, ownership and reporting into one ongoing improvement process. The value is not simply a fuller evidence folder. It is a clearer, current view of what is working, what needs attention and what can be confidently shown to others.
The strongest evidence is not assembled under pressure before an audit. It is the natural result of clear ownership, routine review and visible improvement. Build that rhythm into everyday security work, and the next request for proof becomes an opportunity to show control rather than a scramble to find it.