SOC 2 Compliance certificate for my app built in Azure/Microsoft

Question

Hello,

We are a microsoft enterprise account and we've just recently been onboarded on the Microsoft Foundry program. Considering we are building everything within Azure through foundry, how do we get our soc 2 compliance certificate for the app we are building within foundry?

Answer 1

SOC 2 compliance is not issued as a certificate for an individual application hosted on Azure. Instead, Microsoft provides SOC 2 Type 2 attestation reports for the underlying cloud services (Azure, Dynamics 365, Microsoft 365, Power Platform). Your organization then uses these reports as evidence when undergoing its own SOC 2 examination for the app and overall service.

To support SOC 2 for an app built on Azure/Foundry:

1. Use Microsoft’s SOC 2 reports as inherited controls evidence
   • Azure, Dynamics 365, Power Platform, and select Microsoft 365 services undergo independent SOC 2 Type 2 audits.
   • These reports cover trust services criteria for security, availability, processing integrity, and confidentiality, and include mapping to the CSA Cloud Controls Matrix (CCM) v4.
   • Download the Azure SOC 2 Type 2 attestation report and any needed bridge letters from the Service Trust Portal (STP) SOC reports section: Service Trust Portal SOC attestation reports.
2. Confirm the Azure services used by the app are in scope
   • The Azure SOC 2 Type 2 report and the “Cloud services in audit scope” list identify which Azure, Dynamics 365, Microsoft 365, and Power Platform services are covered.
   • For Azure DevOps, use the standalone Azure DevOps SOC 2 Type 2 attestation report from the same STP SOC reports section.
3. Obtain Office 365/Microsoft 365 SOC 2 reports if applicable
   • If the solution also relies on Microsoft 365/Office 365 services (for example, Teams, SharePoint Online, OneDrive, Power BI), download the Office 365/Microsoft 365 SOC 2 reports from the SOC section of the Service Trust Portal.
   • An active subscription or trial is required to access SOC 1 and SOC 2 reports and bridge letters.
4. Use Compliance Manager to structure your own SOC 2 assessment
   • Microsoft Purview Compliance Manager provides a premium template for SOC 2 that helps assess the organization’s posture and map responsibilities between Microsoft (cloud provider) and the customer (your app and processes).
   • Build an assessment in Compliance Manager using the SOC 2 template and attach relevant Azure and Microsoft 365 SOC reports as evidence for inherited controls.
5. Undergo an independent SOC 2 audit for the app/organization
   • To obtain a SOC 2 report for the app itself, engage an independent CPA firm. That auditor will:
     • Rely on Microsoft’s SOC 2 reports for platform-level controls.
     • Test the organization’s own controls (application security, SDLC, access management, incident response, etc.).
   • The result is a SOC 2 Type 2 report for the service the organization provides; Microsoft does not issue this report for customer-built apps.
6. Use bridge letters and report cadence for continuous coverage
   • Azure SOC 2 reports are issued semi-annually on a rolling 12‑month period, with bridge letters issued quarterly to cover gaps between report periods.
   • Use these bridge letters with the latest SOC 2 report to demonstrate continuous coverage for the underlying Azure services.

In summary, the path is:

• Download Azure/Microsoft 365 SOC 2 reports and bridge letters from the Service Trust Portal.
• Use Compliance Manager’s SOC 2 template to organize inherited vs. customer controls.
• Engage an external auditor to obtain a SOC 2 report for the app/organization; Microsoft does not provide a SOC 2 certificate for individual customer applications built on Azure.

---

References:

• System and Organization Controls (SOC) 2 Type 2
• System and Organization Controls (SOC) 1 Type 2
• System and Organization Controls (SOC) 3