The Service Trust Portal and compliance offerings

Harrow & Finch takes payment cards in every store and online, so it is assessed every year against the Payment Card Industry Data Security Standard. Its board also has an audit committee that asks hard questions about any new supplier of critical services. On November 6, 2026, Sunil Rao had two requests on his desk. The audit committee wanted evidence that Microsoft's data centers and cloud services are independently audited before more of StockLine moved to Azure. The company's payment card assessor wanted to know which parts of the card environment Microsoft is responsible for and which remain with Harrow & Finch. Sunil did not need to email Microsoft or wait for a salesperson. He signed in to the Service Trust Portal and downloaded what he needed in about twenty minutes.

Trust, and why customers need evidence

When an organization moves workloads to a cloud provider, it hands over part of its security and compliance to that provider. The physical security of the data center, the hardware, the hypervisor and much of the network are now Microsoft's responsibility, as MSAZ-101's shared responsibility model explained. But regulators, auditors and boards still hold the customer accountable for its data. The customer therefore needs evidence that the provider's part is done properly, and it needs to understand exactly where the provider's responsibility ends and its own begins.

Cloud providers cannot let every customer send its own auditors into their data centers. Instead, they hire independent audit firms to assess their services against widely recognized standards, and publish the resulting reports and certificates for customers to use in their own audits. Microsoft publishes these through the Service Trust Portal and describes its approach through the Microsoft Trust Center.

The Microsoft Trust Center

The Microsoft Trust Center is a public website that explains how Microsoft approaches security, privacy, compliance and transparency across its cloud services. It describes the company's principles, how it handles customer data, how it responds to requests from governments, and which compliance standards and regulations its services support. It is written for decision-makers and is a good starting point for anyone who needs to understand Microsoft's commitments before reading detailed audit reports. The legal commitments themselves are in Microsoft's contractual documents, such as the product terms and the data protection addendum that form part of a customer's agreement.

The Service Trust Portal

The Service Trust Portal is Microsoft's site for publishing the detailed documents behind those commitments. Its main contents are audit reports from independent auditors, certificates, assessment summaries and other compliance documents for Microsoft's cloud services, including Azure, Microsoft 365 and Dynamics 365. Much of the material can be read only after signing in with a work account from an organization that uses Microsoft cloud services, because audit reports often contain details that are not published openly. Some documents are available to anyone.

Documents in the portal are organized by service and by standard, and many are grouped by industry and region, so a user can find, for example, the reports relevant to financial services or to a particular country. Users can save documents to a personal library and be notified when a new version is published, which matters because audit reports are renewed every year or so. Sunil saved the reports his auditors need so that he would be told when the next versions arrive.

The current AZ-900 skills outline no longer names the Service Trust Portal as a separate skill, though older versions did and many study guides still cover it. It remains a practical tool that cloud administrators and security teams use, and knowing what it holds saves a great deal of time when an audit arrives.

Common compliance offerings

Microsoft describes the standards and regulations its services support as compliance offerings. They fall into several groups: global standards that apply in any country, offerings for particular governments and regions, and offerings for particular industries. Which offerings cover which services, and in which regions, changes over time, so the Service Trust Portal and Microsoft's compliance documentation are the places to check current scope.

A SOC 2 Type 2 report is often the most useful single document for a security review. It describes the provider's controls for security and related principles such as availability and confidentiality, and the auditor's tests of whether those controls operated effectively over a period of time, usually several months. A Type 1 report only describes the controls at a point in time. Sunil gave the audit committee the latest SOC 2 Type 2 report for Azure and the ISO 27001 certificate, together with a one-page summary in plain language.

Compliance is shared

A compliance offering covers Microsoft's part of the responsibility, not the customer's. Azure being assessed against PCI DSS means that the Azure infrastructure and services in scope meet the standard's requirements for the parts Microsoft controls. It does not mean that StockLine, running in Azure, is PCI DSS compliant. Harrow & Finch must still configure its own systems correctly: segment the card environment, control access, encrypt data, keep systems patched, log activity and train staff. The payment card assessor will check those things, using Microsoft's documents as evidence only for the layers Microsoft manages.

For that reason, Microsoft publishes responsibility matrices for several standards, showing which requirements are met by Microsoft, which by the customer, and which are shared. Sunil's second task on November 6 was to download the PCI DSS responsibility guidance and annotate it for Harrow & Finch's design. That annotated document became part of the evidence package for the next assessment, planned for the spring.

Tools that connect offerings to your own configuration

Two tools from earlier lessons help bridge the gap between Microsoft's compliance and the customer's. In Azure, Microsoft Defender for Cloud includes a regulatory compliance dashboard that uses Azure Policy initiatives, such as the ones lesson 5 described, to show which technical settings in your subscriptions support or break the controls of a chosen standard. In Microsoft Purview, Compliance Manager, from lesson 4, tracks assessments against regulations, lists improvement actions and keeps evidence. Neither tool makes an organization compliant on its own, but both turn a long standard into a list of concrete settings and tasks.

Privacy obligations deserve a separate mention. In the United States there is no general federal law requiring data to stay in the country, but sector laws such as HIPAA and state privacy laws, including Iowa's consumer data protection law, place duties on businesses that handle personal information and on their service providers. Contracts with Microsoft, including the data protection addendum, describe how Microsoft handles customer data on the business's behalf. Microsoft publishes information on where data is stored for each service and region, which helps answer residency questions.

Theo wrote a short script to summarize the simplified responsibility table for the audit committee, counting which side owns each area.

areas = {
    "Physical security": "Microsoft",
    "Host hardware and hypervisor": "Microsoft",
    "Network segmentation": "Shared",
    "Guest OS patching": "Customer",
    "Access control": "Shared",
    "Application logging": "Shared",
    "Staff training": "Customer",
}
from collections import Counter
counts = Counter(areas.values())
for owner in ("Microsoft", "Shared", "Customer"):
    names = [a for a, o in areas.items() if o == owner]
    print(f"{owner:9s} {counts[owner]}: {', '.join(names)}")

Microsoft 2: Physical security, Host hardware and hypervisor
Shared    3: Network segmentation, Access control, Application logging
Customer  2: Guest OS patching, Staff training

Building an evidence package

Sunil built the evidence package for the audit committee in layers, a practice worth copying. The first layer is the provider's assurance: the current SOC 2 Type 2 report, the ISO 27001 certificate, the payment card attestation for the services in scope and a short note on the dates they cover. The second layer is the shared responsibility statement: the annotated responsibility matrix showing what Microsoft does and what Harrow & Finch does for each requirement. The third layer is the company's own controls: the Azure Policy compliance results, the Defender for Cloud recommendations, the access reviews and the incident records, showing that Harrow & Finch is doing its part.

Each layer answers a different question. The first says the platform is trustworthy; the second says who is responsible for what; the third says the company is meeting its responsibilities. Auditors tend to spend the most time on the third layer, because it is where most problems are found. Sunil set a calendar reminder to refresh the first layer every year, when new reports appear in the Service Trust Portal, and the third every quarter.

He also kept a short glossary at the front of the package for board members who are not security specialists, explaining terms such as attestation, certification and shared responsibility in a sentence each. The audit committee chair said afterwards that it was the first cloud security briefing she had understood without asking for a second meeting.

Finally, Sunil checked the scope section of each report before using it. Audit reports list exactly which services and which regions were tested, and a service that was released recently may not yet appear. Using a report for a service outside its scope is a common mistake that auditors notice quickly, so the evidence package lists, next to each report, the Azure services Harrow & Finch uses that the report covers.