Find it, review it, remove only what you choose
Compliance Manager for Microsoft 365 is a personal-data discovery and clean-up tool. It finds IBANs from any country, payment card numbers, passport numbers and email addresses in mailboxes, OneDrive files and Teams one-to-one chats, for employees who have opted in. It removes what you no longer need under safeguards you control.
Unlike broad, age-based retention rules, it works on what the content actually contains, lets a person review before anything is deleted, and keeps a tamper-evident record of what was done. Scan results, logs and configuration stay in your own Azure storage.
| Rule | How it matches |
|---|---|
| IBAN from any country | Checksum validated |
| Payment card number | Checksum validated |
| Passport number | Pattern only, marked “approximate” in the product |
| Email address | Pattern only |
You can add your own keywords and patterns for local identifiers; whether they are appropriate is your own evaluation and responsibility. The product also includes three rules written for Türkiye, which stay off unless you switch them on.
Keep only what is necessary, and be able to show it
Three GDPR principles are the headings here, not advice:
- Art. 5(1)(c): data minimisation.
- Art. 5(1)(e): storage limitation.
- Art. 5(2): accountability.
In February 2026 the European Data Protection Board published the results of its 2025 coordinated enforcement action on the right to erasure. Thirty-two authorities looked at 764 controllers. They found that controllers struggle to set retention periods and to delete personal data from back-ups, and that many lack internal procedures for erasure.
So the question regulators are asking is not whether you have a policy. It is whether deletion actually happens. Our before-you-scan checklist sets out what your organisation should have in place before it scans employee mail.
Four reasons it works
- Find it. Ready-made rules for IBAN (any country), card, passport and email. IBAN and card numbers are checked by checksum. No regex skills needed.
- Clean up under control. Safe Scan deletes nothing, deletion stays off until an administrator enables it, and a hard limit stops oversized runs.
- Show what you did. Every administrative action goes into a tamper-evident audit log.
- Your data stays in your Azure. Scan results, logs and configuration stay in your own Azure storage.
Key capabilities
- Ready-made rules, plus your own patterns for local identifiers
- Test the rules on sample text before you scan
- Externally shared OneDrive files flagged next to the findings
- Review before you delete, within a limit that has no override button
- OneDrive files backed up to your own Azure storage before deletion
- Verify integrity, CSV export, and Admin, Security Manager and Reporter roles
See how it works for the three scan modes, or the FAQ for the questions compliance teams ask first.
Built for
Financial services and insurance · Healthcare · Hospitality and travel · Public sector and education
How to buy
On Azure Marketplace, as either Compliance Manager Suite or Pay-per-Agent. Per seat, billed by Microsoft through your Azure billing account; Azure resources are billed separately by Microsoft. It deploys in about 10 minutes, followed by a one-time Global Administrator setup step. How the model works.