Purview Insider Risk Management in GCC High: Sign-Off
As of September 2026, turn on Microsoft Purview Insider Risk Management only as a scoped pilot that information technology, compliance, privacy, security, human resources and legal have agreed, which is the stakeholder list Microsoft itself gives in Plan for Insider Risk Management, and in GCC High confirm availability in your...
Microsoft Foundry: How Do You Govern Custom AI With Native Controls?
As of September 2026, govern AI built in Microsoft Foundry with Entra ID sign-in and Foundry roles, an assigned guardrail with Prompt Shields, Purview with user-context tokens, Defender for Cloud AI threat protection and Azure Policy, in that order. Per Microsoft, “Agent guardrails are in preview”.
Microsoft 365 Copilot Prompts: How Long Are They Kept and Searchable?
Microsoft 365 Copilot prompts and responses are kept or deleted by whatever Purview retention policy applies to them, a hold suspends their permanent deletion, and eDiscovery searches them until they are permanently deleted, because Microsoft stores them in a hidden mailbox folder. Counsel and records management decide how long.
How Long Does Entra Keep Sign-In and Audit Logs for SOX, CMMC or HIPAA?
As of September 2026, according to Microsoft, Entra ID keeps audit and sign-in logs seven days on Free and 30 days on P1 or P2, and an upgrade recovers nothing expired. Older records survive only where something was already archiving them, such as diagnostic settings or, for audit records, Purview...
SharePoint Intranet for a Regulated Enterprise: What to Decide First?
As of September 2026, SharePoint is a sound base for a regulated enterprise intranet when you treat the intranet as part of the SharePoint estate you already secure: Microsoft Learn says the SharePoint app in Teams, formerly Viva Connections, “is built on the SharePoint home site technology”, so the intranet...
SharePoint 5,000-Item Limit: How Do You Get Past It?
The SharePoint 5000 item list view threshold throttles how many items a single view or query can touch, not how many the library can hold. Microsoft’s documented ceiling for one list or library is 30 million items, so a library that trips the threshold has not run out of room;...
How to Structure a SharePoint Online Migration SOW
A SharePoint Online migration statement of work is structured as five phases, discovery and assessment, migration execution, validation, cutover, and post-migration support, and each phase ends on a named artifact that a named person on the buyer’s side accepts. The acceptance criterion that decides the document is the one a...
Do We Still Need Microsoft Purview If We Are Not Deploying Copilot?
Yes, you still need Microsoft Purview without Copilot, because Purview is where Microsoft runs data loss prevention, sensitivity labels, audit, retention and eDiscovery, and a regulated enterprise owes the controls behind them to its regulators and auditors either way. The real question is which of them your obligations require first.
Where Should a Partner Build Our Copilot Agent? A Dev-to-Production Tenant Guide
As of September 2026, the build belongs in your tenant. A partner works in a Power Platform Developer environment inside your own tenant, and the finished agent reaches production as a managed solution through Power Platform pipelines. Microsoft’s own pipelines documentation states plainly: “Can pipelines deploy to a different tenant?...
Microsoft Teams Governance Readiness Checklist for IT
Score your Teams estate against six controls: team creation, naming, guest access, lifecycle and expiry, retention, and sensitivity labels. A control is READY only when a named owner can show its current setting and its evidence today; a control that exists as intent, a policy document nobody can point a...
Entra Connect Sync or Cloud Sync: Which Fits a Regulated Enterprise?
As of October 2026, choose Entra Cloud Sync unless your estate needs a line that Microsoft Learn gives only to Entra Connect Sync, such as more than 150,000 objects in a domain, groups above 50,000 members, advanced sync rules, full attribute filtering or cross-forest object references. Microsoft calls Cloud Sync...
Technology Modernization Fund: How Do You Size a Microsoft Project?
As of September 2026, a Microsoft-stack modernization fits the Technology Modernization Fund (TMF) when it addresses a legacy federal system, and the proposal is sized to transfers released only as milestones are completed and to a repayment the agency funds from its own budget, ideally the full amount, since TMF’s...
Secure Development Requirements for a Custom Application Contract
As of September 2026, a secure-development requirement belongs in a custom application development contract only if it names a practice, an artifact that evidences the practice, and a person on your side who receives that artifact. Three published sources supply the practice vocabulary so a buyer does not have to...
FINRA and SEC Recordkeeping in Microsoft 365: An IT Guide
As of September 2026, FINRA and SEC recordkeeping and supervision in Microsoft 365 is framed by three rules, each linked here to its official text and read at source on September 21, 2026. FINRA Rule 4511 requires books and records to be preserved “in a format and media that complies...
NYDFS Part 500 on Microsoft 365 and Entra ID: A Checklist of What the Tenant Carries and What You Still Evidence
As of September 2026, every phased date in the Second Amendment to Part 500 has passed, and a Microsoft 365 and Entra ID tenant can carry the sections on multi-factor authentication (section 500.12), access privileges (section 500.7), encryption (section 500.15) and much of monitoring (section 500.14) once they are configured,...
Azure API for FHIR Retirement: How Do You Move to the FHIR Service?
Microsoft set September 30, 2026 as the retirement date for Azure API for FHIR, so workloads must move to the Azure Health Data Services FHIR service. The move covers the data and the applications; those relying on the SMART on FHIR proxy report errors after September 21, 2026.
Do You Handle Microsoft System Integration for Organizations Subject to CMMC, ITAR and DFARS?
Yes, and the honest form of that answer is a composition rather than a slogan. CMMC and DFARS are one problem seen twice: DFARS 252.204-7012 imposes the control baseline and DFARS 252.204-7021 verifies it. ITAR is a genuinely separate axis about export-controlled technical data and who may see it. Section...
CMMC, FedRAMP, ITAR or GCC High: Which Applies to You?
As of September 2026, sort by what triggers each rule rather than by what each one requires: CMMC is triggered by a contract clause and by federal contract information or controlled unclassified information landing on your own unclassified system, ITAR is triggered by the data itself being technical data directly...
Jira and CUI: Which Atlassian Environment Is FedRAMP Authorized?
Jira FedRAMP authorization belongs to one environment: Atlassian Government Cloud, which holds FedRAMP Certification Class C, formerly Moderate, for Jira, Confluence, and Jira Service Management. A commercial Atlassian Cloud tenant is not FedRAMP Moderate compliant, per Atlassian, and reaching Class C means migrating the data into Atlassian Government Cloud.
