Compliance Manager for Microsoft 365

Compliance Agent is a Microsoft 365 compliance solution that deploys into your own Azure subscription as an Azure Managed Application. It gives IT administrators and compliance teams a single web portal to discover, review and safely remove non-compliant or sensitive content across Exchange Online mailboxes, OneDrive for Business and Microsoft Teams channels and chats.

• Safe Scan: read-only discovery. Matches and their metadata are stored in your own Azure Storage. Nothing is changed or deleted.

• Selective Deletion: results appear in the portal and you choose which items to remove.

• Direct Deletion: every match is removed automatically, with a full audit trail written to your storage account.

Any scan can run on a recurring schedule (CRON expressions) for continuous monitoring.

Scans every folder and subfolder of the mailboxes you select for keyword lists, regular expressions or date ranges. All three processing modes are available.

Goes beyond file names: it extracts and scans the text inside files. Supported types: PDF, Word (.docx/.doc), Excel (.xlsx/.xls), PowerPoint (.pptx/.ppt), CSV/TSV, plain text, Markdown, JSON, XML and HTML. In Direct Deletion mode, every matching file is backed up to your own Blob Storage before it is removed, so you keep a recoverable copy. All three processing modes are available.

Scans Teams channel messages and one-to-one or group chats for keyword or regex matches. Access uses delegated, per-user consent, in line with your organisation's consent policies. Safe Scan and Direct Deletion modes are available.

• Live progress while jobs run

• Audit trail: every run is logged to your own storage account

• Built-in throttling management to keep large scans within Microsoft 365 service limits

• Role-based access to control who can run which agents

• Reliable job queue with automatic retries and per-agent concurrency control

Scan results, logs, job data and configuration are stored only in resources inside your own Azure subscription. Compliance Agent uses its own app registration, created in your tenant during setup, and authenticates to Microsoft Graph with a certificate generated in your own Key Vault. Its credentials are never shared with other customers. Azure SQL is accessed with managed identity only, and all secrets are kept in your Key Vault. Inthouse has management access to the deployed resources to provide support and updates, and does not access your content.

Installs into a managed resource group in your subscription. Resources deployed: App Service (Linux container), Azure SQL Database, Azure Key Vault, Azure Storage, Application Insights and Log Analytics. After deployment, a Global Administrator completes a one-time setup step (a link is shown on the deployment output) to create Compliance Agent's app registration in your tenant.

• Pay-per-Agent: $5 per mailbox per month for each agent you enable. License only what you need.

• Complete Suite: $12 per mailbox per month for all agents, a 20% saving on individual agents.

A mailbox counts once per month when it is scanned. Azure infrastructure costs for the deployed resources are billed separately by Microsoft.