Skip to main content

SOC Reports on Azure, Azure DevOps and O365

By

 Let's talk today about SOC reports that are available for Azure and other Microsoft services that are used nowadays. 

What is a SOC Report?

It is an audit report that it is verifiable and performed by a CPA (Certified Public Accountant). The main purpose is to do a systematic control in a service organization and provide insights related to financial audit and how they perform. We could say that it is a collection of safeguards that are checked and validated.

SOC Types

There are 3 types of SOC reports used in a different context and covers different areas of business and finances. You can see the main characteristics below.


What does Microsoft is offering to us?

Microsoft is offering on the Compliance Report portal all the SOC reports that are available. They are publicly available and can be used by Microsoft customers, at the moment in time when an audit is done.

Depending on the type of organization that you are part of, you might be required to have these reports or bridge letter updated one time per year or 2-4 types. This is when the bridge letter becomes very important. 

If we take the example of Office 365, we will see that the last SOC report was published in September 2019. From that one, we had each quarter a new bride letter (e.g. Q4 2020). 

For Office 365 we are covered on each quarter with SOC reports and bridge letters. Things are not the same for other services like Azure, Dynamic 365 where we have SOC reports available one time per year, but without any bride letters available. It means that if you are required to provide SOC reports two of four times per year for services that you are using inside the organization, this would not be possible using the SOC reports that are publicly available. 

Final thoughts 

Things are a little crazy at the moment in time when you need to provide SOC evidence for Microsoft services more often than one time per year. If you are in a context where you don't find the reports that you are looking for you shall contact the Microsoft team to require the needed reports. In most of the cases, they are available, but not published on the public portal. 

Comments

Post a Comment

Popular posts from this blog

Windows Docker Containers can make WIN32 API calls, use COM and ASP.NET WebForms

By
After the last post , I received two interesting questions related to Docker and Windows. People were interested if we do Win32 API calls from a Docker container and if there is support for COM. WIN32 Support To test calls to WIN32 API, let’s try to populate SYSTEM_INFO class. [StructLayout(LayoutKind.Sequential)] public struct SYSTEM_INFO { public uint dwOemId; public uint dwPageSize; public uint lpMinimumApplicationAddress; public uint lpMaximumApplicationAddress; public uint dwActiveProcessorMask; public uint dwNumberOfProcessors; public uint dwProcessorType; public uint dwAllocationGranularity; public uint dwProcessorLevel; public uint dwProcessorRevision; } ... [DllImport("kernel32")] static extern void GetSystemInfo(ref SYSTEM_INFO pSI); ... SYSTEM_INFO pSI = new SYSTEM_INFO(
Post a Comment
Read more

Azure AD and AWS Cognito side-by-side

By
In the last few weeks, I was involved in multiple opportunities on Microsoft Azure and Amazon, where we had to analyse AWS Cognito, Azure AD and other solutions that are available on the market. I decided to consolidate in one post all features and differences that I identified for both of them that we should need to take into account. Take into account that Azure AD is an identity and access management services well integrated with Microsoft stack. In comparison, AWS Cognito is just a user sign-up, sign-in and access control and nothing more. The focus is not on the main features, is more on small things that can make a difference when you want to decide where we want to store and manage our users.  This information might be useful in the future when we need to decide where we want to keep and manage our users.  Feature Azure AD (B2C, B2C) AWS Cognito Access token lifetime Default 1h – the value is configurable 1h – cannot be modified
Post a Comment
Read more

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

By
Today blog post will be started with the following error when running DB tests on the CI machine: threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See http://go.microsoft.com/fwlink/?LinkId=260882 for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration: TeamCity .NET 4.51 EF 6.0.2 VS2013 It see
8 comments
Read more