Azure Ad Trust Center

generated: '2026-09-06'
method: searched
source: https://www.microsoft.com/en-us/trust-center (probed 200), https://servicetrust.microsoft.com/ (probed 200), https://learn.microsoft.com/en-us/entra/standards/standards-overview, https://learn.microsoft.com/en-us/azure/compliance/
provider: Azure Active Directory (Microsoft Entra ID)
providerId: azure-ad
trust_center:
  url: https://www.microsoft.com/en-us/trust-center
  http_status: 200
  probed: '2026-09-06'
audit_portal:
  name: Microsoft Service Trust Portal
  url: https://servicetrust.microsoft.com/
  http_status: 200
  probed: '2026-09-06'
  note: Where the actual audit reports (SOC 1/2/3, ISO certificates, FedRAMP packages, penetration-test summaries) are downloaded. Access to the reports requires sign-in with a Microsoft account; the portal
    itself is public.
compliance_catalog:
  url: https://learn.microsoft.com/en-us/azure/compliance/offerings/
  claim: '"There are 90 Azure compliance certifications ... Azure has 35 compliance offerings for key industries" — quoted from https://learn.microsoft.com/en-us/entra/standards/standards-overview'
  industries_named:
  - Health
  - Government
  - Finance
  - Education
  - Manufacturing
  - Media
certifications:
- FedRAMP
- NIST SP 800-53
- HIPAA / HITECH
- SOX
certifications_note: Only the frameworks Microsoft's own Entra standards page names directly are listed above with evidence URLs. Microsoft's wider catalogue (ISO/IEC 27001, 27017, 27018, 27701, SOC 1/2/3,
  PCI DSS, CSA STAR and the rest of the 90) is published per-offering under https://learn.microsoft.com/en-us/azure/compliance/offerings/ and is downloadable from the Service Trust Portal; it is not restated
  here because it was not read item by item during this pass.
shared_responsibility:
  note: 'Microsoft states plainly that compliance is shared: Azure certification is a starting point, and the customer must still configure Microsoft Entra ID to meet the identity standard they are held
    to. Entra publishes per-standard configuration guidance (for example NIST authenticator assurance levels and FedRAMP High) under https://learn.microsoft.com/en-us/entra/standards/.'
privacy:
  privacy_statement: https://www.microsoft.com/en-us/privacy/privacystatement
  gdpr: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr
  data_residency: https://learn.microsoft.com/en-us/entra/identity/data-residency-and-customer-data
sovereign_clouds:
- name: Microsoft Azure Government (US Gov L4 / L5 DoD)
- name: Microsoft Azure operated by 21Vianet (China)
sovereign_clouds_note: "Relevant to agent surfaces: the Microsoft MCP Server for Enterprise is global\n  service only and is NOT available in US Gov L4, US Gov L5 (DOD) or 21Vianet —\n  see mcp/azure-ad-mcp.yml\
  \ availability."
certifications_detail:
- name: FedRAMP
  scope: US Federal Risk and Authorization Management Program
  evidence: https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-fedramp
- name: NIST SP 800-53
  scope: US federal information systems control catalog
  evidence: https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-nist-800-53
- name: HIPAA / HITECH
  scope: US healthcare
  evidence: https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us
- name: SOX
  scope: Sarbanes-Oxley Act of 2002
  evidence: https://learn.microsoft.com/en-us/compliance/regulatory/offering-sox
url: https://www.microsoft.com/en-us/trust-center