SOC Reports on Azure, Azure DevOps and O365
Let’s talk today about SOC reports that are available for Azure and other Microsoft services that are used nowadays.
What is a SOC Report?
It is an audit report that it is verifiable and performed by a CPA (Certified Public Accountant). The main purpose is to do a systematic control in a service organization and provide insights related to financial audit and how they perform. We could say that it is a collection of safeguards that are checked and validated.
SOC Types
There are 3 types of SOC reports used in a different context and covers different areas of business and finances. You can see the main characteristics below.
What does Microsoft is offering to us?
Microsoft is offering on the Compliance Report portal all the SOC reports that are available. They are publicly available and can be used by Microsoft customers, at the moment in time when an audit is done.
Depending on the type of organization that you are part of, you might be required to have these reports or bridge letter updated one time per year or 2–4 types. This is when the bridge letter becomes very important.
If we take the example of Office 365, we will see that the last SOC report was published in September 2019. From that one, we had each quarter a new bride letter (e.g. Q4 2020).
For Office 365 we are covered on each quarter with SOC reports and bridge letters. Things are not the same for other services like Azure, Dynamic 365 where we have SOC reports available one time per year, but without any bride letters available. It means that if you are required to provide SOC reports two of four times per year for services that you are using inside the organization, this would not be possible using the SOC reports that are publicly available.
Final thoughts
Things are a little crazy at the moment in time when you need to provide SOC evidence for Microsoft services more often than one time per year. If you are in a context where you don’t find the reports that you are looking for you shall contact the Microsoft team to require the needed reports. In most of the cases, they are available, but not published on the public portal.
