Blog
A cloud governance framework for Microsoft 365 that survives a growing estate
Build a cloud governance framework for Microsoft 365 that enforces baselines, detects drift and produces audit-ready evidence as you scale.
Table of Contents
- How a cloud governance framework differs from security and compliance
- Where the pillars land on a Microsoft 365 and cloud desktop estate
- The scale limits Microsoft documents in its own guidance
- Configuration drift compounds first as an estate grows
- Map regulatory requirements to controls before the auditor does
- Four moves that turn manual governance into structural enforcement
- Where Nerdio Manager applies and monitors controls on both desktop paths
- A framework that survives when the estate doubles
- Frequently asked questions about cloud governance framework
Your auditor asks for twelve months of sign-in history, and your tenant retains a fraction of that. Your estate grew from 800 seats to 4,000, and nobody can say which Conditional Access exclusions are still intentional.
A policy-only framework does not enforce controls at that scale. What survives growth is enforcement built into the system, which means baselines applied by default, drift checked on a schedule, and every regulatory obligation mapped to a setting and an owner. This guide is for enterprise IT and compliance leaders governing a growing Microsoft 365 and cloud desktop estate.
How a cloud governance framework differs from security and compliance
A cloud governance framework consists of the policies, procedures, and tools an organization uses to control cloud use by establishing guardrails. Microsoft's Cloud Adoption Framework defines cloud governance as "how an organization controls its use of cloud services by establishing guardrails," and it is explicit that governance is "not a one-time project, but a continuous process."
Security and compliance are two parts of governance. A mature framework covers the following six domains:
- Cost governance: controlling spend and attributing it to the units that generate it
- Security governance: enforcing configuration baselines across every endpoint and workload
- Compliance governance: mapping regulatory requirements to specific cloud controls
- Operational governance: reliability, monitoring, and observability
- Data governance: classification, residency, and retention
- Access governance: controlling who can provision and modify resources
Each pillar produces its own evidence. Cost governance can produce spend-attribution records, data governance can produce retention and residency evidence, and operational governance can produce monitoring alerts and drift-check results.
These pillars are deliberately generic so they apply across any cloud environment. Turning them into working controls means deciding where each one lands on a Microsoft 365 tenant with cloud desktops attached, because that is where the settings, owners, and evidence paths actually live.
Where the pillars land on a Microsoft 365 and cloud desktop estate
This guide uses Windows Cloud as the umbrella term for Microsoft's combined Windows 365 and Azure Virtual Desktop portfolio, and the governance surface differs by path:
- With Windows 365, Microsoft runs the Cloud PC infrastructure, but every Cloud PC still requires Microsoft Intune-based endpoint management for policies and application deployment.
- On Azure Virtual Desktop, Microsoft manages the connection broker and gateway, while you own the session hosts, the golden images, and the governance policies applied to them. Azure Virtual Desktop can be managed through the Azure Portal, PowerShell, and Microsoft Intune.
Many enterprises run both, so a workable framework spans both paths under one rulebook.
Access governance shows how quickly the control surface changes between editions. Both editions provision the user as a standard account, and the mechanism for granting local admin differs across them. On Windows 365 Business, an admin changes the account type on an individual Cloud PC. On Windows 365 Enterprise, local admin comes from a user settings policy scoped to assigned groups. Running both editions means auditing two different places for the same question.
The native toolchain covers several of these pillars through distinct tools. Azure Policy enforces resource configuration at the management group level. Microsoft Purview Audit handles audit logging, and Microsoft Purview Compliance Manager handles compliance assessment. Entra ID Governance runs access reviews and privileged identity management, and Intune security baselines deliver security baselines to endpoints.
These tools are capable at the sizes Microsoft designed them for, and their published limits are where a growing estate first feels friction.
The scale limits Microsoft documents in its own guidance
Microsoft documents the constraints directly:
- Conditional Access has a limit of 240 policies per tenant, counting policies in any state including report-only, on, or off, and Microsoft warns that "Creating a policy for each app isn't efficient and makes managing policies difficult."
- Intune scope tags do not currently support Windows Autopilot devices, Corp Device Identifiers, or device compliance locations.
- Administrative units cannot be nested, and adding a group to an administrative unit does not bring that group's members into scope.
- Audit (Standard) retains unified audit logs for 180 days. Audit (Premium) extends Exchange Online, SharePoint, OneDrive, and Entra records to one year, with a 10-year add-on available. Entra ID sign-in logs persist seven days on the free tier and 30 days with P1 or P2.
- Day-to-day administration spans separate admin centers for Exchange, Teams, SharePoint, and Microsoft Entra.
These limits turn growth into an operating problem where more policies, delegated scopes, retention requirements, and admin surfaces must stay aligned.
One licensing change works in your favor. Endpoint Privilege Management supports Windows 365 Cloud PCs and, since January 2026, Azure Virtual Desktop single-session VMs. As of July 2026, Microsoft includes it in Microsoft 365 E5 along with Cloud PKI and Enterprise App Management, while E3 picks up Remote Help, Advanced Analytics, and Intune Plan 2 capabilities.
In the scenario described here, governance works within these limits at 800 seats. At 4,000 seats, the limits compound, and the compounding shows up first as configuration drift.
Configuration drift compounds first as an estate grows
Drift is where a working framework starts to fail. Microsoft's change management documentation states that "any configuration drift from the initial posture can introduce vulnerabilities, break functionality, or disrupt availability." Verizon's 2025 Data Breach Investigations Report put human involvement in breaches at 60%.
The financial exposure is real. IBM's 2025 breach report put the global average breach at $4.44 million, and healthcare averaged $7.42 million, the highest of any industry for the 14th consecutive year.
Drift has predictable sources across Intune and Azure Virtual Desktop, and each source needs its own detection path.
Where Intune drift comes from
When two admin teams set different values for the same Intune setting, Intune can fail to apply the setting and flag it as conflicted, and resolution is manual. A setting reports as conflicted, and nobody can say which team intended which value. Removing a setting from a security baseline is quieter. Per Microsoft, "the setting on the device remains set to its last configuration until some other process manages the setting to change it." Orphaned settings persist silently.
Where Azure Virtual Desktop drift comes from
On Azure Virtual Desktop, drift accumulates in session hosts. Microsoft's Cloud Adoption Framework recommends a patch management strategy for session hosts and patching base images at least once every 30 days. Patching a host directly, or skipping an image cycle, means the fleet diverges from the image of record.
Conditional Access exceptions accumulate the same way, and Microsoft's own guidance is to use exclusions sparingly and add users back to the policy as soon as possible.
Scheduled drift checks close the gap
Scheduled drift checks detect covered configuration changes between audits. An open-source tenant configuration project led by Microsoft engineers and maintained by the community, checks tenant configuration for drift every 15 minutes by default and can automatically correct deviations.
On the native side, Microsoft Entra Tenant Governance compares tenant resources against a JSON configuration baseline and lists the drifts it finds, with monitors that currently run at six-hour intervals. Management platforms extend enforcement further, and Nerdio Manager, for example, provides policy automation and feature rollback.
Drift you catch is an operational fix. Drift an auditor catches is a finding. Catching drift before it reaches an auditor depends on knowing which settings map to which regulatory obligations.
Map regulatory requirements to controls before the auditor does
Compliance frameworks tell you what to prove. Governance produces the proof. A working control map connects each regulatory obligation to a specific technical setting and a named evidence owner, so an auditor's question has an answer that lives in the platform rather than in someone's memory.
The obligations that most often land on a Microsoft 365 estate map to concrete Microsoft and CIS controls:
- HIPAA audit controls (§164.312(b)): The HIPAA Security Rule requires recording and examining activity in systems containing ePHI. Purview Audit logging and Entra sign-in log retention supply the evidence, with Microsoft Purview Audit (Premium) extending records to a year.
- HIPAA unique user identification (§164.312(a)(2)(i)): Every user needs a unique identifier, which supports a defensible audit trail and removes any temptation to share admin accounts. Entra ID accounts with Privileged Identity Management enforce this at the identity layer.
- HHS OCR system hardening guidance: HHS OCR's January 2026 Cybersecurity Newsletter names system hardening and security baselines as a step regulated entities can take to protect ePHI, and it explicitly references Microsoft's security baseline packages. Intune security baselines and CIS Hardened Images deliver that hardening to endpoints.
- GDPR Article 32: GDPR Article 32 requires technical and organisational measures appropriate to the risk. Encryption, RBAC, audit logging, and data residency controls in Microsoft 365 and Azure map to those measures.
- NIS 2 Article 21: Article 21 of the NIS 2 Directive includes access control policies and, where appropriate, multi-factor authentication or continuous authentication solutions for covered entities. Purview Compliance Manager includes an NIS2 regulatory template, and Azure Policy carries a built-in NIS2 initiative that covers a large portion of the assessable controls.
- Configuration standards: The CIS Microsoft 365 Foundations Benchmark, currently at version 7.0.0, provides an assessable baseline, and CIS-CAT Pro Assessor can test a tenant against it automatically and generate audit-ready reports.
These mappings turn broad regulatory language into operational settings and assessments that produce evidence teams can hand to an auditor without a scramble.
Your organization retains responsibility for actually running those controls. Per Microsoft's HITRUST guidance: "your organization needs to implement and maintain its own data protection controls" to meet framework requirements. Meeting those requirements with a lean team is an operating-model problem, which the next section addresses.
Four moves that turn manual governance into structural enforcement
Each move shifts a manual control toward structural enforcement. If you cannot name the owner of every Conditional Access exclusion in your tenant right now, start with the first two.
- Scope every role: Microsoft Entra administrative units restrict a role assignment to a defined subset of users or devices, so a Helpdesk Administrator manages only the region they support. Intune's guidance pairs the same idea with visibility: "Pair RBAC with scope tags to narrow what an admin can see, not just what they can do."
- Remove standing privilege: Privileged Identity Management makes admins eligible for roles they activate for a limited window and removes access automatically when the window expires. Microsoft's published best practices include limiting Global Administrators to fewer than five.
- Standardize on baselines: Microsoft's Intune scale guidance recommends using the Settings Catalog and security baselines "to the maximum possible extent"; one-off configuration profiles multiply conflicts as teams grow.
- Treat policy as code: Microsoft recommends managing Conditional Access policies programmatically through the Microsoft Graph API and adopting a policy-as-code workflow with source control, so changes are reviewable, testable, and reversible. Keep drift detection running alongside it to catch changes made outside that workflow.
Who runs each move matters as much as the move itself. Microsoft's Cloud Adoption Framework tells organizations to assign governance enforcement to teams within their scope, and adds that "The cloud governance team shouldn't be responsible for applying enforcement controls." Platform engineering deploys the controls, security owns the policy logic, and compliance owns the regulatory mapping.
All four moves run on native tooling plus scripts, and keeping them running every day across two desktop paths and one Intune estate is the work a management layer automates.
Where Nerdio Manager applies and monitors controls on both desktop paths
Nerdio Manager deploys into your Azure environment and manages Windows 365, Microsoft Intune, and Azure Virtual Desktop from a single console, replacing the day-to-day console-hopping that the earlier scale limits create. It applies and monitors the framework you define across both desktop paths, while the risk decisions and regulatory mapping stay with your team.
Intune policy backup and governance
Managing Windows 365 means managing Intune, and Nerdio Manager extends the native toolset for policy management. It can create, back up, and restore Intune policies; native Intune cannot back up or restore deleted policies. Nerdio Manager also provides policy automation, audit logging, and feature rollback.
For Windows 365, unified application management centralizes application deployment, updates, and maintenance. Nerdio Advisor provides Cloud PC right-sizing, license reclamation alerts for underutilized licenses, and Flex (formerly called Windows 365 Frontline) conversion recommendations.
CIS hardened images and audited change on Azure Virtual Desktop
Azure Virtual Desktop governance runs through the image and the audit trail. You can select a CIS Hardened Image directly in the console when deploying Azure Virtual Desktop machines, and Nerdio's Modern Work CIS Policy Baselines are CIS-certified Intune policies for applying standardized settings across physical and virtual endpoints.
Desktop orchestration centralizes golden image creation, versioning, and distribution, which is what a 30-day image management cadence depends on. The platform provides audit logging for administrative activity.
Scoped RBAC and one console across both paths
Custom roles in Nerdio Manager define scope and access through granular module permissions, so a Level 1 technician gets only a restricted console. The City of Corona manages both cloud desktop paths and its physical endpoints. Systems Administrator Brad Ransbury put it this way: "We no longer have to dig through multiple screens in Azure or Intune. The information is just there, ready to act on."
A framework that survives when the estate doubles
The twelve-month audit request and the accumulating Conditional Access exclusions this article opened with have defined answers when enforcement is structural.
A twelve-month audit request follows a retention path you architected before it arrived, using Audit (Premium) for supported Microsoft 365 and Entra records and Log Analytics routing for Entra sign-in logs beyond the native window. Unowned Conditional Access exclusions stop accumulating when policy lives in code and every exception carries an owner and a review date. Drift checks run on a schedule rather than the week before an audit.
Structural enforcement is what makes seat 4,001 inherit the same baselines as seat 800.
If you're building that kind of enforcement across Windows 365, Microsoft Intune, and Azure Virtual Desktop, you can get a demo to see how Nerdio Manager works across your Windows 365 and Azure Virtual Desktop environment, or try it free in your Azure tenant.
Frequently asked questions about cloud governance framework
Resources
Learn more about Nerdio Manager
