Azure Compliance Frameworks

Moving workloads to Azure does not eliminate compliance obligations — it changes how they are met. Organisations must still comply with industry regulations, government laws, and contractual obligations even when their infrastructure is in the cloud. Understanding which compliance frameworks apply to your workload, and how Azure helps you meet them, is a key topic in the AZ-900 exam and in real enterprise Azure deployments.

Compliance in the cloud is governed by the shared responsibility model. Microsoft is responsible for the security and compliance of the cloud infrastructure (physical data centres, networking hardware, host OS). Customers are responsible for the security and compliance of what runs in the cloud (their applications, data, identities, and configurations). The boundary shifts depending on whether you use IaaS, PaaS, or SaaS.

Microsoft maintains compliance certifications for Azure across more than 100 regulatory standards and frameworks. These cover regions, industries, and security disciplines, including:

• International — ISO 27001, ISO 27018, SOC 1/2/3
• EU/Regional — GDPR, ENS, UK Cyber Essentials
• Industry — HIPAA (healthcare), PCI DSS (payments), FedRAMP (US government)

ISO 27001 is an international standard for information security management systems (ISMS). Microsoft has achieved ISO 27001 certification for Azure, meaning the infrastructure and operational processes have been audited by an independent third party. However, customers must separately certify their own applications and data management practices — Microsoft's certification does not extend automatically to customer workloads.

PCI DSS (Payment Card Industry Data Security Standard) applies to organisations that store, process, or transmit cardholder data. Azure is a PCI DSS Level 1 certified service provider, the highest certification level. Customers running payment workloads on Azure can build on this foundation, but must implement additional controls in their application layer (tokenisation, encryption, access logging) to meet their own PCI DSS obligations.

HIPAA (Health Insurance Portability and Accountability Act) governs the protection of Protected Health Information (PHI) in the United States. Microsoft offers a HIPAA Business Associate Agreement (BAA) for Azure services, confirming that Microsoft will safeguard PHI it processes on your behalf. Healthcare customers must sign the BAA and configure their Azure workloads to comply with HIPAA technical safeguards.

SOC (System and Organisation Controls) reports are independent auditor assessments of Azure's controls:

• SOC 1 — financial reporting controls (relevant for SaaS products that affect customer financial statements)
• SOC 2 — security, availability, processing integrity, confidentiality, and privacy controls
• SOC 3 — a public summary of SOC 2 findings, available to anyone

SOC 2 reports are available to Azure customers under NDA via the Service Trust Portal.

FedRAMP (Federal Risk and Authorization Management Program) is a US government framework for cloud service authorisation. Azure has FedRAMP High authorisation for government regions (USGov and USDoD). US federal agencies must use FedRAMP-authorised cloud services. Commercial Azure regions have FedRAMP Moderate authorisation, which covers a large proportion of government workloads.

The Microsoft Service Trust Portal (STP) at servicetrust.microsoft.com is a one-stop shop for compliance documentation, audit reports, and certification information about Microsoft cloud services. From the STP you can download ISO 27001 certificates, SOC 2 reports, penetration test results, and data protection impact assessments. Access to some documents requires an Azure or Microsoft 365 account and NDA acceptance.

Data residency requirements mandate that certain data must be stored and processed within a specific geographic boundary. Azure addresses this through region selection — you choose which region to deploy resources in, and your data stays in that region by default. Azure also offers sovereign cloud instances (Azure Government, Azure China 21Vianet, Azure Germany) that are operated independently to meet specific national data sovereignty requirements.

Achieving compliance is not a one-time event — it requires ongoing monitoring and evidence collection. Microsoft Compliance Manager within the Microsoft Purview compliance portal helps organisations track their compliance posture continuously, map controls to regulations, and generate evidence for auditors. Regular internal audits, automated policy checks via Azure Policy, and centralised log collection are all part of a mature compliance programme.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Azure holds certifications for over 100 compliance frameworks including ISO 27001, PCI DSS, HIPAA, and FedRAMP; the shared responsibility model divides compliance obligations between Microsoft and the customer; and the Service Trust Portal is the source for audit reports and certification documents. Next up we explore Microsoft Purview for data governance and classification.