Microsoft has been busy reshaping how organizations manage data governance, security, and regulatory risk inside Microsoft 365. Over the past several months, the company rolled out a series of updates to Microsoft Purview, the platform that houses what was formerly known as the Microsoft 365 compliance center.
This blog will review the changes and updates Phoenix businesses should be aware of, as they juggle state notification laws, industry regulations, and a workforce that increasingly relies on AI tools.
If your IT team hasn't logged into the admin portal in a while, the layout will look unfamiliar. Microsoft folded data security, data governance, and regulatory compliance into a single Purview portal, retiring the older, siloed compliance center experience. Inside that portal, Compliance Manager remains the tool most business owners actually interact with, since it translates regulatory language into specific, trackable actions.
Microsoft refreshed the official guidance for Compliance Manager assessments on July 1, 2026, and the update is worth a look even though it doesn't force any migration deadline. The guidance walks administrators through how assessments get scoped, licensed, and delegated across Microsoft 365, Azure, and connected AI tools like Copilot. Ready-made templates now cover more than 360 regulatory frameworks, so a Phoenix healthcare clinic tracking HIPAA or a defense contractor working toward CMMC can start from a template instead of building a control list from scratch.
That template library matters because assessments split each framework into Microsoft-managed and customer-managed controls. Microsoft handles the platform-level pieces. Your business still owns the configuration and documentation on your end, and the Compliance Manager scores your progress against both.
A second theme running through this year's updates involves how Purview governs AI. In June 2026, Microsoft brought data security and compliance protections for Microsoft 365 Copilot Cowork to general availability, extending the same DLP and sensitivity-label controls that already cover email and files. A related preview lets DLP policies block Copilot Chat from pulling in external email as grounding data, which closes off a prompt-injection path that security teams had flagged.
Microsoft has taken this further at the network layer. Purview DLP now integrates with Microsoft Entra Global Secure Access. Once enabled, this lets a company inspect text and AI prompts at the network layer, catching sensitive data before it reaches an untrusted app, browser extension, or outside AI platform. For a Phoenix accounting firm or law office where staff might paste client data into a chatbot without thinking twice, this kind of network-level check offers a backstop that policy documents alone can't provide.
Microsoft also continues to push data governance roles toward least-privilege access, encouraging organizations to move away from broad, standing admin access and toward narrower, task-specific roles. Smaller IT teams sometimes lump all compliance responsibilities into a single admin account for convenience. Microsoft's own guidance now treats that as a liability rather than a shortcut, since it makes access reviews harder to perform and accountability harder to trace.
Arizona has its own data breach notification law (A.R.S. ยง 18-552), and it applies to any business that owns, maintains, or licenses unencrypted personal information belonging to Arizona residents. The statute requires notice to affected individuals without unreasonable delay, generally within 45 days of confirming a breach. If more than 1,000 residents are affected, businesses must also notify the Arizona Attorney General's office, the Director of the Arizona Department of Homeland Security, and the three largest nationwide credit reporting agencies.
The law doesn't spell out exactly which technical safeguards a business must use. It simply requires "reasonable security procedures and practices appropriate to the nature of the information" a company handles. That vague standard is where Purview's tools become genuinely useful for a Phoenix business. Sensitivity labels, DLP policies, and audit logging provide a business with documented evidence of what reasonable security looked like on the day a breach occurred, which matters both to the Attorney General's office and to any litigation that follows.
Microsoft plans to add configurable retention periods to Communication Compliance policies, with preview access in December 2026 and general availability targeted for January 2027. Right now, Communication Compliance captures and reviews employee messages without a built-in way to age out that captured data on a schedule. The new setting separates the decision to keep a supervision policy running from the decision about how long the captured messages themselves should be retained.
For a Phoenix employer in a regulated industry, or any business that has settled into a habit of leaving monitoring policies switched on indefinitely, this is a good moment to sit down with HR and legal counsel to decide in advance how long employee communications data should actually live in Microsoft 365.
None of these updates requires an emergency response, but they do call for a deliberate review.
Start by opening Compliance Manager and checking which regulatory templates apply to your business, then compare your current score with the platform's recommendations. Walk through your admin role assignments and look for anyone holding broader access than their job actually requires. If your staff uses Copilot or another AI assistant, confirm that your DLP policies specifically extend to those tools, not just to email and SharePoint. And if you experience a breach, know the Arizona notification law timeline: identify affected residents, notify them promptly, and loop in the Attorney General's office and the Department of Homeland Security if the count exceeds 1,000.
Microsoft's compliance tooling keeps expanding, and much of it pays off once configured correctly. Having access to these tools is not the same as using them well, and that gap is where most Phoenix businesses get exposed.
At PK Tech, we have over 16 years of experience supporting businesses like yours navigate the changes of Microsoft 365 and beyond. We maintain AICPA's SOC 2 Type II attestation, verified through an independent third-party audit of our security and privacy controls. If you want help navigating or deploying Microsoft compliance updates, we can help. Schedule a call with our team here.