DLP in Purview vs Macie: Compliance When Your Product Isn't in Microsoft 365
7/28/2026 · Compliance365
Almost every piece of compliance guidance out there — ours included, most of the time — quietly assumes one thing: that your organisation's data protection controls live in Microsoft 365. Purview DLP, Conditional Access, Defender. Tidy, tool-native, easy to point an auditor at.
Real SaaS and technology companies are rarely that tidy. Staff use Microsoft 365 for email, identity and collaboration — but the product, the thing that actually generates revenue and holds customer data, runs in AWS, or GCP, or a mix. When that's the case, "just check Purview" stops being an answer.
This is the exact situation we work through with clients regularly, and the fix isn't a different framework or a bigger platform — it's understanding what your Statement of Applicability is actually for.
1 A control asks "what", never "which vendor"
Take a typical ISO 27001 Annex A control: data loss prevention exists to stop sensitive data leaving the organisation without authorisation. Nowhere does the control — or the auditor assessing it — say that has to be Microsoft Purview. It's a requirement, not a product name. Any organisation still describing its whole control environment in Microsoft-specific tool names is really describing whichever tenant its compliance advisor happened to be most familiar with, not what the standard actually asks for.
Once you separate the requirement from the tool, the fix for a hybrid environment stops being complicated: the requirement stays exactly the same, and you simply record which tool satisfies it for that part of the business.
2 The worked example: DLP in two clouds at once
| Layer | Where it runs | DLP tool | Evidence source |
|---|---|---|---|
| Corporate IT | Staff email, SharePoint, endpoints | Microsoft Purview DLP | Automated — read directly via Graph API |
| Product infrastructure | Customer data, S3, application workloads | AWS Macie | Manual — findings export, sensitive-data discovery job config |
Same control. Same Statement of Applicability line. Two tools, because two different parts of the business run on two different platforms — and that's the normal, expected shape of a real SaaS company, not an exception to explain away.
3 Three things to actually do about it
- Say it out loud in the Justification field. Don't leave an auditor to guess why a "Microsoft-flavoured" control reads oddly for an AWS-hosted product. One sentence — "DLP implemented via AWS Macie for the product's data workloads; Purview covers corporate IT" — closes the question before it's asked.
- Accept that product-infrastructure controls will mostly be manual, and that's fine. An automated posture scan against Microsoft Graph can't see into an AWS account it was never designed to read — that's expected, not a gap. The correct state for that control is "Manual, evidence attached", not a red fail and not a fabricated automated pass.
- Attach the evidence the tool actually produces. A Macie findings export, an IAM access review, a CloudTrail/GuardDuty summary — whatever the AWS-native equivalent is, it satisfies the control exactly as well as a Purview screenshot would. An auditor cares that the control operates and is evidenced, not which vendor's logo is on the screenshot.
Why this matters beyond the audit
- Board and customer confidence: shows security governance actually reflects how the business runs, not a simplified fiction.
- Faster certification: nothing stalls an audit like a control that doesn't match reality — this heads it off entirely.
- No lock-in pressure: your compliance posture never becomes a reason you can't run infrastructure where it makes the most technical or commercial sense.
Next steps
If your organisation runs Microsoft 365 for the business and something else — AWS, GCP, or both — for the product, and you want a Statement of Applicability that actually reflects that:
- Explore our ISO 27001 services
- Read Inside the Statement of Applicability for how SoA mapping works in general
- Book a 15-minute intro call to talk through your specific environment
Found this useful? Get the ISO/Privacy/AI readiness checklists.
Browse resources
