Skip to main content

SOC Reports on Azure, Azure DevOps and O365

By

 Let's talk today about SOC reports that are available for Azure and other Microsoft services that are used nowadays. 

What is a SOC Report?

It is an audit report that it is verifiable and performed by a CPA (Certified Public Accountant). The main purpose is to do a systematic control in a service organization and provide insights related to financial audit and how they perform. We could say that it is a collection of safeguards that are checked and validated.

SOC Types

There are 3 types of SOC reports used in a different context and covers different areas of business and finances. You can see the main characteristics below.


What does Microsoft is offering to us?

Microsoft is offering on the Compliance Report portal all the SOC reports that are available. They are publicly available and can be used by Microsoft customers, at the moment in time when an audit is done.

Depending on the type of organization that you are part of, you might be required to have these reports or bridge letter updated one time per year or 2-4 types. This is when the bridge letter becomes very important. 

If we take the example of Office 365, we will see that the last SOC report was published in September 2019. From that one, we had each quarter a new bride letter (e.g. Q4 2020). 

For Office 365 we are covered on each quarter with SOC reports and bridge letters. Things are not the same for other services like Azure, Dynamic 365 where we have SOC reports available one time per year, but without any bride letters available. It means that if you are required to provide SOC reports two of four times per year for services that you are using inside the organization, this would not be possible using the SOC reports that are publicly available. 

Final thoughts 

Things are a little crazy at the moment in time when you need to provide SOC evidence for Microsoft services more often than one time per year. If you are in a context where you don't find the reports that you are looking for you shall contact the Microsoft team to require the needed reports. In most of the cases, they are available, but not published on the public portal. 

Comments

Post a Comment

Popular posts from this blog

Windows Docker Containers can make WIN32 API calls, use COM and ASP.NET WebForms

By
After the last post , I received two interesting questions related to Docker and Windows. People were interested if we do Win32 API calls from a Docker container and if there is support for COM. WIN32 Support To test calls to WIN32 API, let’s try to populate SYSTEM_INFO class. [StructLayout(LayoutKind.Sequential)] public struct SYSTEM_INFO { public uint dwOemId; public uint dwPageSize; public uint lpMinimumApplicationAddress; public uint lpMaximumApplicationAddress; public uint dwActiveProcessorMask; public uint dwNumberOfProcessors; public uint dwProcessorType; public uint dwAllocationGranularity; public uint dwProcessorLevel; public uint dwProcessorRevision; } ... [DllImport("kernel32")] static extern void GetSystemInfo(ref SYSTEM_INFO pSI); ... SYSTEM_INFO pSI = new SYSTEM_INFO(
Post a Comment
Read more

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

By
Today blog post will be started with the following error when running DB tests on the CI machine: threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See http://go.microsoft.com/fwlink/?LinkId=260882 for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration: TeamCity .NET 4.51 EF 6.0.2 VS2013 It see
8 comments
Read more

Navigating Cloud Strategy after Azure Central US Region Outage

By
 Looking back, July 19, 2024, was challenging for customers using Microsoft Azure or Windows machines. Two major outages affected customers using CrowdStrike Falcon or Microsoft Azure computation resources in the Central US. These two outages affected many people and put many businesses on pause for a few hours or even days. The overlap of these two issues was a nightmare for travellers. In addition to blue screens in the airport terminals, they could not get additional information from the airport website, airline personnel, or the support line because they were affected by the outage in the Central US region or the CrowdStrike outage.   But what happened in reality? A faulty CrowdStrike update affected Windows computers globally, from airports and healthcare to small businesses, affecting over 8.5m computers. Even if the Falson Sensor software defect was identified and a fix deployed shortly after, the recovery took longer. In parallel with CrowdStrike, Microsoft provided a too
Post a Comment
Read more