Microsoft's Security and Compliance tools had grown organically over years, resulting in 8+ separate admin portals, inconsistent design systems, and confused customers. The fundamental question: should they remain combined, or would customers be better served by separate, focused experiences?
I led a small design team through the research and vision work that would ultimately answer that question—and reshape how Microsoft delivers security and compliance products.
Security work is reactive and daily. Compliance work is proactive and periodic. Cramming both into one experience served neither well.
The Challenge
When I joined, the Security & Compliance space was fragmented. Products were scattered across multiple portals with different visual languages and interaction patterns. Customers didn't know where to go to accomplish their tasks.
The landscape we inherited:
- 8+ separate admin portals
- Multiple conflicting design systems
- Features duplicated across portals
- Customers frustrated by inconsistency
Products spanning both domains:
- Microsoft Information Protection
- Data Loss Prevention
- Insider Risk Management
- eDiscovery & Audit
- Secure Score & Threat Protection
Growing and Organizing the Team
I grew my team from 2 to 10 designers, then helped scale the broader organization to about 50—bringing in senior design leaders to expand our impact across the suite. But headcount alone doesn't solve problems. I organized the team around the domains that mattered.
Compliance
Security Admin
Information Worker
Each area had dedicated design leads embedded with product teams, building deep expertise rather than spreading thin. Two design leads worked directly with the Security and Compliance VPs—design became integral to planning and strategy.
Research to Understand the Problem
We ran extensive research to understand how customers actually worked—not how we assumed they worked.
Research methods:
- Jobs-to-Be-Done studies with Security and Compliance professionals
- Customer interviews across small business to enterprise
- Competitive analysis to understand market expectations
- Usage data funnels to see where customers struggled
Key personas:
- Security Admins—monitor, triage, respond
- Security Analysts—investigate, hunt, remediate
- Compliance Officers—plan, configure, audit
- Data Admins—classify, protect, govern
- Legal Admins—discover, hold, produce
The research revealed a critical insight: Security and Compliance professionals have fundamentally different jobs, different rhythms of work, and different mental models.
Security work is reactive and daily
Compliance work is proactive and periodic
Validating the Separation Strategy
We tested our hypothesis directly with customers: which approach would serve them better—a single combined portal or two focused portals?
The results were decisive. Customers overwhelmingly preferred separate experiences.
"Companies typically think of security & compliance as separate areas. Tasks and areas can intermingle, but customers need their own place to work."
Research findings:
- Different usage patterns: Security is daily, Compliance is monthly
- Different org structures: Security in IT, Compliance often in Legal
- Roles rarely overlap: The same person doesn't do both jobs
- Customization is key: Each domain needs to optimize for its users
Raising the Bar While Scaling
With the separation strategy validated, we needed to raise the quality bar across the entire suite—while simultaneously scaling the team. This meant building systems and processes that could scale with us.
Prioritizing High-Value Tools
Cross-Org Design System Collaboration
Jobs-to-Be-Done for Information Architecture
Extensive Usability Studies
The result was a virtuous cycle: better research led to better designs, which validated our approach and earned us more resources to scale the team further. By the time I left, the organization had grown from my initial team of 2 to nearly 50 designers across the Security and Compliance space.
The Outcome
The separation strategy became reality. Microsoft shipped two focused admin centers: security.microsoft.com and compliance.microsoft.com.
What the research told us—validated in market:
"Compliance Score had more active users in its first 2 months than its predecessor did in 2 years."
— Internal metrics
"MDATP grew from 8,294 to 13.5 million monthly active devices—a 1,631x increase."
— Product telemetry, 2017–2020