Setup
Start with scope: confirm which Microsoft cloud you use (Commercial, GCC, GCC High or DoD), your licenses, and which workloads hold CUI. Then work in this order: discovery and classification, sensitivity labels and encryption, data loss prevention policies, Compliance Manager, and insider-risk governance.
For each area, keep evidence an assessor can check: the policy scope, exclusions, enforcement mode, a named owner, and a dated test. A setting that is switched on but never tested is not evidence that a requirement is met. Use the free CMMC scoping tool to define the boundary first.
Compliance score mapping
Compliance Manager gives a Microsoft compliance score based on improvement actions in its assessment templates. That is not your SPRS score. Your CMMC Level 2 score follows the CMMC Scoring Methodology (32 CFR 170.24): start at 110 and subtract 1, 3 or 5 points for each requirement that is not met.
Use Compliance Manager's mapping to NIST SP 800-171 Rev. 2 as a list of work to do, then check each assessment objective yourself. Microsoft-managed actions cover Microsoft's side of the shared responsibility; your policies, people and processes still need their own evidence.
GCC High limitations
Feature availability differs between Microsoft clouds, and GCC High can lag behind Commercial. Check Microsoft's service description for your cloud before you plan around a feature.
Some APIs are not available in national clouds. For example, Microsoft documents that the Microsoft Graph sensitivity-label list API does not support the US Government L4 (GCC High) endpoint. Tools that rely on it may not work in GCC High, so evidence may need to be exported manually.