Use SOC2 as proof for a client

Yiz Segall, you’re correct, the SOC 2 and ISO audit reports you download from the Microsoft Service Trust Portal are marked Microsoft Confidential, which means they can’t be redistributed. This restriction is part of Microsoft’s non-disclosure agreement (NDA) terms for accessing those documents.

However, there are a couple of fully supported ways you can still prove compliance to your own client:

Have your client access the reports directly

• If they have a Microsoft account (any Azure, Microsoft 365, or free personal account works), they can sign in to the Service Trust Portal themselves and download the same SOC 2 and ISO audit reports you see.
• This way, you are not redistributing confidential files, you are simply guiding them to the official source.

Use Microsoft’s publicly shareable compliance summaries

• Microsoft publishes public overview pages for SOC 2 and ISO certifications that can be freely shared. These pages confirm Azure App Service is in-scope and that Microsoft holds valid, current certifications. SOC 2: https://learn.microsoft.com/azure/compliance/offerings/offering-soc-2 ISO/IEC 27001:2022: https://learn.microsoft.com/azure/compliance/offerings/offering-iso-27001
• You can explain that your app inherits the same security and compliance controls as the Azure platform it runs on, and point to the public Microsoft documentation as verification.