Question

A financial services company runs workloads across 40 subscriptions organized under several management groups. Their compliance team must continuously assess the environment against both PCI DSS and ISO 27001, generate downloadable compliance reports for auditors, and receive alerts when the compliance posture degrades. They want a native Azure solution that requires minimal custom development. What should you recommend?

Accepted Answer

Enable Microsoft Defender for Cloud, add the PCI DSS and ISO 27001 standards to the regulatory compliance dashboard, and configure continuous export to Log Analytics with alert rules.

Answer

Create custom Azure Policy initiatives that mirror each control and review the Azure Policy compliance blade manually each month.

Answer

Deploy Azure Monitor workbooks that query Azure Resource Graph and build custom compliance scoring dashboards.

Answer

Use Azure Purview to scan resources and produce compliance classifications mapped to PCI DSS and ISO 27001.