SOC 2 compliance for Microsoft 365

SOC 2 is an independent attestation about how you protect customer data, and a large part of it is technical. In a Microsoft 365 shop that technical layer lives in your tenant: access and MFA, privileged roles, logging, change control, and vulnerability management. Siemserva by Senserva finds and fixes those gaps and produces the evidence, so the security controls behind your SOC 2 are in shape before the auditor arrives. See compliance mapping.

Siemserva does not issue the SOC 2 report. SOC 2 is an attestation performed by an independent, licensed CPA firm. Senserva gets your Microsoft 365 technical controls right and gives you the evidence behind them.

What SOC 2 actually is

SOC 2 (System and Organization Controls 2) is an AICPA framework. Reports are issued by independent CPA firms against the Trust Services Criteria: Security, which every SOC 2 covers, plus optionally Availability, Processing Integrity, Confidentiality, and Privacy. The Security category is built on the Common Criteria, CC1 through CC9, and a large share of those criteria are technical controls you configure in Microsoft 365, Intune, and Entra ID.

Who needs SOC 2

SOC 2 is voluntary, but it is usually buyer-driven: your customers ask for it before they will trust you with their data.

SaaS and cloud software

Companies that store or process customer data in the cloud, where a SOC 2 report is table stakes to close enterprise deals.

MSPs, MSSPs, and IT providers

Service providers with access to many client tenants, who are themselves a high-value target and a vendor-risk question for every client.

Vendors selling to enterprises

Any supplier whose prospects run vendor security reviews or send a security questionnaire before signing.

Stalled sales cycles

If deals slow down on a request for a SOC 2 report, you need one. It is increasingly a precondition, not a nice to have.

Data-heavy and regulated business

Healthcare, fintech, and similar fields where customer trust is the product and scrutiny is high.

SOC 2 Type I and Type II

SOC 2 comes in two report types. Buyers increasingly want Type II, because it proves the controls actually held up.

Type I: design at a point in time

The auditor confirms your controls are designed appropriately on a specific date. It is the faster first step. Siemserva helps you get the Microsoft 365 technical controls configured correctly and documented now. Run a full scan.

Type II: operating effectiveness over time

The auditor tests that your controls actually operated, typically across a 3 to 12 month window. This is where most of the work, and most of the risk, lives. Siemserva's continuous scanning and configuration drift detection show the controls stayed in place across the whole period, with audit-ready evidence on every scan. Continuous drift detection.

How Siemserva supports the SOC 2 technical controls

The Security category's Common Criteria map closely to Microsoft 365 configuration. Siemserva by Senserva assesses these controls, ranks the gaps, fixes them with validated remediation, and produces the evidence. Each area links to where it is covered.

Logical and privileged access (CC6)

MFA, Conditional Access, eligible versus active PIM, least privilege, break-glass accounts, and app and service principal credentials. Identity controls.

Monitoring and operations (CC7)

Unified audit log health, sign-in and directory logs, security alerts, and CVE and patch exposure. CVE and vulnerability management.

Change management (CC8)

Continuous detection of configuration drift from your secure baseline across the tenant. Configuration drift management.

Risk identification (CC3)

Every finding ranked by Severity and mapped to the controls auditors ask about. Compliance mapping.

Evidence on demand

Audit-ready reports on the first scan and every scan after, for your auditor and your customers. AI security reports.

SOC 2 covers people, process, and technology. Siemserva addresses the Microsoft 365 technical and configuration controls and the evidence for them. It does not write your policies, run your HR, or perform the audit.

Working with a partner that does not have SOC 2

A vendor or partner without a SOC 2 report is not automatically a dealbreaker, but their risk becomes your risk. You can still work with them safely, and you can document it for your own SOC 2.

Assess them directly

Scope exactly what data and systems they touch, send a security questionnaire, and ask for whatever evidence they do have, even without a formal report.

Limit what you grant

Apply least privilege, Conditional Access, and scoped app permissions so the partner can only reach what they must, then verify those controls in your own tenant. Check your access controls.

Monitor continuously

Watch the access and configuration around that partner so over-permissioning or drift is caught early. Continuous monitoring.

Document the gap

Record the missing report and your compensating controls, so your own auditor sees a managed risk, not an ignored one. Evidence and mapping.

For MSPs

Standardize a baseline across every client tenant and produce evidence even for clients without their own SOC 2 program. Microsoft 365 security for MSPs.

Frequently asked

Does Siemserva make me SOC 2 compliant?

No. SOC 2 is an attestation issued by an independent, licensed CPA firm. Siemserva by Senserva gets the Microsoft 365 technical security controls in shape and produces the evidence behind them, which is a large part of the SOC 2 Security criteria.

What is the difference between SOC 2 Type I and Type II?

Type I checks that controls are designed appropriately at a point in time. Type II tests that they operated effectively over a period, typically 3 to 12 months. Most buyers want a Type II report.

Who needs SOC 2?

SaaS and cloud vendors, MSPs and MSSPs, and any company whose customers run vendor security reviews or ask for a SOC 2 report before trusting them with data.

How do I work with a partner that does not have SOC 2?

Assess the partner directly, limit the data and access you grant them, apply and verify compensating controls in your own Microsoft 365 tenant, monitor continuously, and document the gap and your mitigations for your own auditor.

Does Siemserva help with SOC 2 Type II evidence over time?

Yes. Continuous scanning and configuration drift detection show your Microsoft 365 controls stayed in place across the audit period, with audit-ready evidence on every scan.

Helpful links

Authoritative references on SOC 2. Each opens in a new tab.

AICPA SOC 2

The AICPA overview of SOC 2 reporting for service organizations.

AICPA SOC suite of services

The full SOC family and the Trust Services Criteria behind SOC 2.

Microsoft Service Trust Portal

Microsoft's own SOC reports, audit documents, and compliance offerings.

Get your SOC 2 technical controls in shape

Scan your Microsoft 365 tenant, fix the gaps behind the Security criteria, and produce audit-ready evidence, in minutes. 501(c)(3) nonprofits get the full version free.

Get a key and get going