Compliance Certifications and Microsoft 365: A Complete Guide

A Microsoft SOC 2 report says an independent auditor tested the controls Microsoft operates for its cloud services over a stated period. It says nothing about whether your tenant enforces multifactor authentication, whether your laptops are encrypted, or whether a departing employee's access was removed. Those are your controls, and every framework in this guide asks you to prove them.

The five steps below produce the right-hand column. None of this is legal advice; the interpretation of a regulation belongs with your counsel or assessor.

The Service Trust Portal is where Microsoft publishes its audit evidence: ISO/IEC certificates and the SOC 1, SOC 2 and SOC 3 reports, among others. The SOC 3 report is public; the SOC 1 and SOC 2 reports sit behind a sign-in and acceptance of Microsoft's terms.

1. Sign in with a work account and accept the terms once.
2. Save the current SOC 2 Type 2 report and ISO/IEC 27001 certificate for Microsoft 365, and for Azure if you run workloads there, into your evidence library with the download date.
3. Record the audit period each report covers, and download the next one when Microsoft publishes it; auditors reject reports whose period has lapsed.

This takes an hour and answers the vendor-management question for Microsoft. It answers no question about your tenant.

Every framework asks for the same Microsoft 365 evidence in different words. Map once, then reuse.

The decision rule: build the evidence set for the one framework your customers or regulator actually ask for, then let the others reuse it. Two frameworks built separately produce two sets of screenshots of the same Conditional Access policy.

Microsoft Purview Compliance Manager is the tracking tool, and most tenants already own part of it.

• Included by default: the Microsoft Data Protection Baseline assessment, drawn mainly from NIST CSF and ISO with elements of FedRAMP and GDPR. It produces your initial compliance score.
• Included with E5: Microsoft's Compliance Manager FAQ states that organizations on Microsoft 365 E5, A5 or G5 can choose up to three premium regulatory templates at no additional charge.
• Paid: further premium templates through the Compliance Manager Premium Assessment Add-On, $6,000 per year (Microsoft list price, October 2026 price list). The four AI templates (EU AI Act, ISO/IEC 23894:2023, ISO/IEC 42001:2023 and NIST AI RMF 1.0) count as premium.
• The score: points attach to improvement actions. Microsoft actions are controls Microsoft operates and documents; your actions are settings, policies, procedures and evidence you provide. A higher score means more recommended actions are complete. It is not a certification, and no auditor accepts it as one.

The method that produces evidence rather than a number: create one assessment for the framework from step 2; assign an owner to every improvement action within 30 days; for each action set the implementation status and the test status and attach the evidence (a policy export, a dated screenshot, a ticket number); export the assessment every quarter; review open actions monthly. The score trend is a management signal; the open-action list is the work.

The most common Microsoft 365 audit finding we see is not a missing control; it is a log that no longer exists.

Two details from Microsoft's documentation catch people out: records from service principals, system events and applications keep a fixed one-year period that custom policies do not change, and a 10-year policy is not retroactive, so it protects only records generated after it exists.

The decision rule: if your framework asks for 12 months of access logs, as SOC 2 and most cyber-insurance questionnaires do, 180 days is a finding. Move the in-scope users to Audit (Premium) before the audit period starts, not during it. What evidence you would have after a breach walks through the same gap from the incident side.

Each row is a dated export in a folder, not a screenshot taken the week before the audit. If the DLP row is empty today, the first five policies for a 50-user firm is the starting point, and DLP policy configuration is $8,000 per project.

Per user per year on an annual commitment, Microsoft list price, October 2026 price list, billed to you by Microsoft.

Three decision rules. The three Purview add-ons bought separately cost $228 against $144 for the suite, so the suite wins once you need two of them. E3 plus the Purview Suite at $612 is $108 under E5 but leaves out Entra ID P2 and the Defender plans, which most SOC 2 and HIPAA evidence sets end up needing; the E3-plus-add-ons math works the comparison. And license the users in scope, not the whole company: a 120-person firm with 15 people handling regulated data often runs Business Premium for all and the add-ons for the 15.

Audit readiness is a schedule, not a project.

• Monthly: export Intune compliance, DLP matches, Defender incidents and Secure Score; review open Compliance Manager actions; confirm audit logging is still on.
• Quarterly: export Conditional Access and privileged roles; run and record access reviews for admins and guests; export the Compliance Manager assessment; check the Service Trust Portal for a newer SOC 2 report.
• Twice a year: restore test with a written result; review retention policies against the records schedule.
• Annually: refresh the framework mapping and re-check licensing against who actually handles regulated data.

Do this and the audit becomes a folder review. Skip it and the audit becomes a six-week reconstruction of what the tenant looked like nine months ago.

Is Microsoft 365 HIPAA compliant?

Microsoft 365 can hold protected health information under Microsoft's Business Associate Agreement, which is part of the Product Terms and Data Protection Addendum rather than a separate contract. Compliance depends on how you configure identity, devices, data protection, logging and procedures.

Where do I get Microsoft's SOC 2 report?

From the Service Trust Portal: sign in with a work account, accept the terms, and download the current SOC 2 Type 2 report for Microsoft 365. The SOC 3 report is public and needs no sign-in.

Does a high Compliance Manager score mean we are compliant?

No. The score counts completed improvement actions, Microsoft's and yours, against the assessments you selected. An auditor wants the evidence attached to the actions, not the number.

How long does Microsoft 365 keep audit logs?

180 days by default with Audit (Standard). Audit (Premium), in Microsoft 365 E5 or the E5 eDiscovery and Audit add-on at $72 per user per year, keeps Entra ID, Exchange, OneDrive and SharePoint records for one year. Ten-year retention needs a separate per-user add-on and a policy created before the records you want to keep.

Do we need Microsoft 365 E5 for SOC 2 or ISO 27001?

Not for every user. Business Premium or E3 covers identity, device and basic data controls; the usual additions are Audit (Premium), Entra ID P2 and Entra ID Governance for the users in scope. Full E5 at $720 per user per year makes sense when a user needs most of that list.

Can we run access reviews without Entra ID P2?

Microsoft's access reviews documentation requires Microsoft Entra ID Governance or Microsoft Entra Suite, and notes that some capabilities operate with Entra ID P2. Business Premium and E3 include only P1, so access review evidence means an added license for the reviewed population.

• Get started with Microsoft Service Trust Portal — Microsoft Learn, checked 2026-10-11
• Compliance Manager FAQ: licensing requirements — Microsoft Learn, checked 2026-10-11
• Build and manage assessments in Compliance Manager — Microsoft Learn, checked 2026-10-11
• Compliance score calculation — Microsoft Learn, checked 2026-10-11
• Microsoft Purview Audit (Premium) — Microsoft Learn, checked 2026-10-11
• What are access reviews? — Microsoft Learn, checked 2026-10-11
• HIPAA and the HITECH Act — Microsoft Learn, checked 2026-10-11
• Microsoft Copilot plans and pricing — Microsoft, for the 300-user cap on Business plans, checked 2026-10-11