The Service Trust Portal and privacy principles

With the security solutions covered, the security hours turned to compliance, the part of SC-900 where Ama Boateng had scored lowest. Sunil Rao invited Carmen Ortiz, the privacy officer, to lead the first compliance session, and she opened with a real request. Harrow & Finch's card payment processor had sent its annual questionnaire, and this year it asked how the company assured itself that its cloud providers protected cardholder data. The year before, the answer had been the server room at head office and a binder of procedures. Now part of the answer was Microsoft. "We can't audit Microsoft's data centers ourselves," Carmen said, "so we rely on people who have. The question is where to find their reports, and what Microsoft promises about our data."

This lesson covers the two objectives at the start of the compliance section of the SC-900 outline: the Service Trust Portal and the privacy principles of Microsoft. They connect to MSAZ-102, which introduced the Service Trust Portal from the governance side, and to MSAZ-130, which explained the shared responsibility model and compliance concepts.

Why customers need provider evidence

Every organization that uses cloud services inherits part of its compliance from the provider. A retailer that must protect card data, a clinic that must protect health records and a public body that must keep records for years all depend on controls they cannot see directly: who can enter the data center, how disks are destroyed, how staff access is reviewed, how the network is monitored. Customers cannot each send auditors to inspect Microsoft. Instead, independent auditors assess Microsoft's services against recognized standards, and Microsoft publishes the results for customers to use in their own risk and compliance work.

Carmen stressed that provider evidence covers only the provider's part. A clean audit report for Microsoft's data centers says nothing about whether Harrow & Finch's own network security groups, access reviews or retention settings are correct. That is the customer's share, and lessons 8 to 12 cover the tools for it.

The Service Trust Portal

The Service Trust Portal is Microsoft's site for publishing compliance and security information about its cloud services, including Azure, Microsoft 365 and Dynamics 365. Some content is public. Much of it, including the detailed audit reports, requires signing in with a work account from an organization that uses Microsoft cloud services, and some documents ask the reader to accept terms before downloading.

The portal is not the only place Microsoft publishes compliance information. The Microsoft Trust Center is a public site that explains Microsoft's approach to security, privacy and compliance in general terms and links to the detailed evidence. Within Azure, the compliance documentation describes which compliance offerings cover which services. Carmen found that the Trust Center was the right place to start when explaining Microsoft's commitments to the board, and the Service Trust Portal was the right place for the documents an auditor would actually read.

# Which Service Trust Portal sections answer the payment processor's questionnaire?
questions = {
    "Independent audit of cloud facilities": "Certifications, reports and attestations",
    "Results of independent security testing": "Penetration test and security assessment summaries",
    "How the provider supports payment card rules": "Compliance guides and white papers",
    "Our own firewall and access controls": None,   # the customer's share, not the provider's
}
for q, section in questions.items():
    print(f"{q:45s} -> {section or 'answer from Harrow & Finch evidence'}")

Independent audit of cloud facilities         -> Certifications, reports and attestations
Results of independent security testing       -> Penetration test and security assessment summaries
How the provider supports payment card rules  -> Compliance guides and white papers
Our own firewall and access controls          -> answer from Harrow & Finch evidence

Microsoft's privacy principles

Security protects data from people who should not have it. Privacy is about how the people who do have it use it, and what control the individuals concerned keep. Microsoft states a set of privacy principles that guide how it handles customer data across its products. The SC-900 outline asks candidates to describe them. Microsoft has presented them as six commitments:

Carmen pointed out that principles are statements of intent; contracts are where they become obligations. Microsoft's product terms and data protection addendum set out what Microsoft commits to do with customer data, and the Service Trust Portal and Trust Center explain how those commitments are met. For the questionnaire, she quoted the contractual commitments, not the principles.

Privacy law and the customer's duties

Microsoft's commitments do not remove the customer's own legal duties. In the United States, there is no single general federal privacy law for retailers. Card data is governed by the Payment Card Industry Data Security Standard through the card networks' contracts, and a growing number of states have consumer privacy laws, including Iowa's Consumer Data Protection Act, in force from 2025. Harrow & Finch keeps customer and employee personal information in US Azure regions as a matter of company policy. In either country, the company decides what personal information it collects, why, who can see it, how long it is kept and how people can ask for their own records.

Microsoft offers tools to help with those duties. Microsoft Priva is a family of privacy solutions that can help an organization find personal data it stores in Microsoft 365, identify privacy risks such as data kept too long or shared too widely, and manage subject rights requests, in which an individual asks to see or delete the personal information an organization holds about them. Priva is not named in the SC-900 outline, but it builds directly on the privacy ideas there, and Carmen was evaluating it for 2027.

Answering the questionnaire

By the end of the session, Ama had drafted the response. For the provider's share, it cited the current independent audit reports and certificates for the Azure and Microsoft 365 services in use, downloaded from the Service Trust Portal and saved to My Library, with their dates and the scope each covered. For the shared parts, it referred to the responsibility matrix in the relevant compliance guide. For Harrow & Finch's own share, it pointed to the network design from lesson 2, the Defender for Cloud posture reports from lesson 3 and the Purview controls that lessons 8 to 12 would put in place. Carmen added one sentence she insists on in every such answer: the company had reviewed the reports, noted any exceptions the auditors raised, and decided how they affected its own risk.

Reading an audit report

Ama had never read an independent audit report before, so Carmen walked her through the structure of a typical service organization controls report. It begins with the auditor's opinion, which says whether the controls were suitably designed and, for the more detailed type of report, whether they operated effectively over a period, often six or twelve months. Then comes the provider's description of its system and the scope: which services, which locations and which period are covered. The core of the report lists each control, the auditor's test of it and the result. Near the end, many reports include complementary user entity controls, a list of things the customer is expected to do for the provider's controls to achieve their purpose, such as managing its own user accounts and reviewing access.

Carmen's checklist for each report was short. Is the report current, and does its period cover the time the questionnaire asks about? Are the services Harrow & Finch uses inside the scope? Did the auditor note any exceptions, and if so, do they matter to us? And which customer controls does the report expect, and can we show we do them? That last question links the Service Trust Portal straight to Compliance Manager in lesson 8, where those customer controls become improvement actions with owners.

She also kept a simple register of the reports the company relies on, with the date each was downloaded and when the next version is expected. My Library sends notifications when documents are updated, and the register records who reviewed each new version and what they concluded. When the payment processor's questionnaire arrives next year, the answer will be an update rather than a fresh search.

Ama asked whether the Service Trust Portal would help with privacy questions from customers as well as security questions from auditors. Partly, Carmen said. It holds Microsoft's privacy documentation and data protection resources, which explain how Microsoft handles customer data as a processor. But when a Finch Rewards member asks what Harrow & Finch knows about them, the answer comes from the company's own records and processes, not from Microsoft. The two kinds of evidence answer different questions, and confusing them is the most common mistake she sees in vendor questionnaires.