Can we cite Microsoft’s certifications in our own assessment?

Yes, for an implementation deployed on services that are in scope. Microsoft’s own wording is that you can use the relevant Azure certifications in your compliance assessment, and that “you’re responsible for engaging an assessor to evaluate your implementation for compliance and for the controls and processes within your own organization”.

Does building on Azure make our laboratory compliant?

No. Microsoft answers this question about its own certification: “Does Microsoft certification mean that if my organization uses Azure, it is HITRUST compliant? No. You’re ultimately responsible for your own HITRUST CSF compliance.” The same principle applies to our software.

Why are certificate dates and audit periods not listed here?

They are printed on the certificates and reports, and a date copied here would become outdated at the next audit. Read them from the current certificate under your own sign-in.

Microsoft platform attestations by framework

01The position

Who holds what

Microsoft was assessed for the platform attestations, and Microsoft holds the reports and certificates. Your laboratory holds its own accreditation, granted by its accreditation body, and remains responsible for its own compliance.

SynapticSci claims no ISO/IEC 17025, 21 CFR Part 11, SOC 2, HIPAA, or FedRAMP status of its own. Our products are Microsoft Dataverse solutions, designed to support the requirements those frameworks place on a laboratory. They run in your organization’s Microsoft tenant or in a tenant SynapticSci hosts for you, as Where your data lives explains.

02Shared responsibility

What each party does

Every framework below divides the work in the same way.

Microsoft · the platform

Assessed, and holds the evidence

Microsoft runs the datacenters, the platform services, and the identity system. Independent firms examine its controls, certification bodies certify its management systems, and government programs authorize its services. Microsoft’s shared responsibility matrices and the User Entity Responsibilities section of each audit report identify what the customer must do.

SynapticSci · the software

Builds and delivers the software

We install managed Dataverse solutions along a documented installation path, through development, user acceptance testing, and production environments, with release notes for every deployment. We configure the controls your assessor examines, such as audit history, role-based access, review states, and amendments linked to the original record.

Your laboratory · the accreditation

Validates the system and answers to its assessor

You determine which requirements apply to your system and its intended use, perform the qualification and validation, and engage your assessor. You also keep the records no supplier can keep for you, such as your quality manual, method validation, and competence records.

03How to read an entry

Name the assurance type before you read the claim

Each type of assurance carries different weight with your assessor, so each entry states its type first. Scope also depends on the environment. Commercial Azure, Azure Government, and Azure China are separate, and an attestation that covers one may not cover another. Where Microsoft names Power Platform as a family, its scope documents on the Service Trust Portal give the scope for each service.

Independent audit reportAn outside firm examined the controls over a stated period. Ask for the report and read its user entity responsibilities.
Published standardA certification body certified a management system. Ask for the certificate and read its scope statement.
Government authorizationA government program granted permission to operate. Ask which environment and services are in scope.
Contractual commitmentA written agreement. No one was assessed or certified. Ask for the term.
Data residency commitmentA commitment about where data is stored and processed. Ask for the exceptions.
Held by the laboratoryThe accreditation, qualification, or validation belongs to your laboratory.

04Audit reports

Independent audit reports

An outside accounting firm examined Microsoft’s controls over a stated period, for a stated list of services, and gave an opinion on them.

SOC 2 Type 2

Audit report · issued to Microsoft by an independent CPA firm

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: An examination of Microsoft’s controls for security, availability, processing integrity, and confidentiality over a twelve-month period.
What remains yours: Your system and configuration are outside its scope. Its User Entity Responsibilities section lists what you must do for the controls to remain effective. The report requires a Service Trust Portal sign-in.
Microsoft’s page: SOC 2 Type 2

SOC 1 Type 2

Audit report under SSAE 18 and ISAE 3402 · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: The same kind of examination as SOC 2, directed at the controls that matter to a customer’s financial reporting.
What remains yours: It does not address laboratory data integrity or accreditation records. Your own SOX, FFIEC, or GLBA obligations remain yours.
Microsoft’s page: SOC 1 Type 2

SOC 3

Audit report, general use · held by Microsoft · public

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: A short public summary of the Azure SOC 2 Type 2 examination.
What remains yours: It carries no control detail and no user entity responsibilities, so it cannot answer a security questionnaire on its own.
Microsoft’s page: SOC 3

05ISO and IEC standards

ISO and IEC standards

A certification body checked a Microsoft management system against a published standard. Each certificate applies only to Microsoft and that management system.

ISO/IEC 27001:2022

Certificate · issued to Microsoft by an accredited certification body

Microsoft services: Azure · Azure Government · Azure China · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Microsoft’s information security management system for the platform, including policies, access control, auditing, and corrective action.
What remains yours: You may cite the Azure certificate in your own assessment and remain responsible for engaging your own assessor (see the FAQ below). It is a different standard from ISO/IEC 17025 and says nothing about testing competence.
Microsoft’s page: ISO/IEC 27001:2022

ISO/IEC 27017:2015

Certificate, cloud code of practice · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Cloud security controls added to ISO/IEC 27001, such as separating customer environments and returning or removing customer data when a contract ends.
What remains yours: Microsoft’s certificate covers the provider’s controls. You configure, monitor, and administer your own tenant.
Microsoft’s page: ISO/IEC 27017:2015

ISO/IEC 27018:2019

Certificate, privacy code of practice · held by Microsoft

Microsoft services: Azure · Azure Government · Azure China · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: How Microsoft protects personal information it processes on a customer’s behalf.
What remains yours: Your laboratory remains the controller and determines what personal data is collected, why, for how long, and who may see it. The certificate does not certify compliance with a data protection law.
Microsoft’s page: ISO/IEC 27018:2019

ISO/IEC 27701:2019

Certificate, privacy extension to ISO/IEC 27001 · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Microsoft’s privacy information management system, with controls mapped to GDPR duties for controllers and processors.
What remains yours: Microsoft’s own documentation warns that “an ISO/IEC 27701 certification shouldn’t be taken as evidence of GDPR compliance or official GDPR certification”.
Microsoft’s page: ISO/IEC 27701:2019

ISO 9001:2015

Certificate, quality management · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Microsoft’s quality management system for the platform.
What remains yours: It does not contribute to ISO/IEC 17025 directly. Your quality manual, method validation, and competence records remain your own work.
Microsoft’s page: ISO 9001:2015

ISO 22301:2019

Certificate, business continuity · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Microsoft’s arrangements to protect the platform against disruptive incidents and to recover from them.
What remains yours: Your continuity plan, instrument downtime procedures, recovery time objectives, and the continuity obligations your accreditation body sets remain yours.
Microsoft’s page: ISO 22301:2019

ISO/IEC 20000-1:2018

Certificate, IT service management · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Microsoft’s IT service management for the platform, including incident handling, change management, and service monitoring.
What remains yours: Your laboratory’s IT operations and any application built on the platform are outside its scope.
Microsoft’s page: ISO/IEC 20000-1:2018

ISO/IEC 42001:2023

Certificate, management of machine-learning services · held by Microsoft · named services only

Microsoft services: GitHub Copilot · Microsoft 365 Copilot · Microsoft 365 Copilot Chat · Microsoft Copilot Health · Microsoft Copilot Studio · Microsoft Dragon Copilot · Microsoft Dragon Copilot (Radiologist) · Microsoft Foundry · Microsoft Security Copilot
What it covers: Microsoft’s management system for developing and operating the named machine-learning services responsibly. The audit reports are on the Service Trust Portal.
What remains yours: Dataverse, Power Apps, Power Automate, Power Pages, and the Power Platform model builder are not on the list. Microsoft Copilot Studio is the only Power Platform service that is.
Microsoft’s page: ISO/IEC 42001:2023

06Government programs

Government authorizations and programs

A government program assessed a service and granted permission to operate, with continuous monitoring. Government cloud and commercial cloud have different scopes.

FedRAMP High (Provisional Authorization to Operate)

Government authorization · P-ATO from the FedRAMP Joint Authorization Board · continuously monitored

Microsoft services: Azure · Azure Government · Dataverse · Power Apps · Power Automate · Power Pages · Power BI · Power BI Embedded · Power Platform’s model builder · Microsoft Copilot Studio · Azure Synapse Link for Dataverse
What it covers: Azure and Azure Government each hold a FedRAMP High P-ATO against the NIST SP 800-53 High control baseline. Microsoft’s audit-scope tables for Azure public and Azure Government name Dataverse and the individual Power Platform services.
What remains yours: An application built on these services does not inherit the authorization. Microsoft’s FAQ states that “you need to achieve your own authorizations for components outside these services.” Only Azure public regions in the United States are within the P-ATO scope.
Microsoft’s page: Services in FedRAMP audit scope

NIST SP 800-171

Government standard · attested by an accredited third-party assessor

Microsoft services: Azure · Azure Government
What it covers: An accredited assessor attested that Azure and Azure Government meet the NIST SP 800-171 criteria for systems that process controlled unclassified information. The requirement often reaches a laboratory through a federal contract.
What remains yours: Microsoft states: “Microsoft doesn’t inspect, approve, or monitor your Azure applications. You’re responsible for ensuring that your CUI workloads comply with NIST SP 800-171 guidelines.”
Microsoft’s page: NIST SP 800-171

StateRAMP

State and local authorization · High Impact Level · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Dynamics 365 US Government
What it covers: The state and local counterpart to FedRAMP, listed on the StateRAMP authorized product list. A state agency, including a state department of transportation, is the buyer most likely to require it.
What remains yours: Power Platform is not listed separately. The authorization can support an agency’s own authorization decision. It does not replace that decision or extend to software built on the authorized services.
Microsoft’s page: StateRAMP

CJIS Security Policy

Law enforcement requirement · attested by agreement · government cloud only

Microsoft services: Azure Government · Dynamics 365 U.S. Government · Office 365 U.S. Government · Power BI as part of an Office 365 Government Community Cloud plan
What it covers: Attestations in CJIS Management Agreements with state CJIS Systems Agencies, covering how Microsoft’s government cloud handles criminal justice information. They may matter where a laboratory performs forensic casework for a law enforcement agency.
What remains yours: Commercial Azure, Dynamics 365, Power Platform, and Dataverse are outside this scope. Microsoft notes that the FBI does not certify cloud services under the CJIS Security Policy, and that “you still need to address the CJIS Security Policy requirements regarding CJI protection”.
Microsoft’s page: CJIS

U.S. Section 508 (Accessibility Conformance Reports)

Accessibility law · conformance reports Microsoft publishes for its own products

Microsoft services: Azure and Azure Government · Azure DevOps Services · Microsoft Dynamics 365 and Dynamics 365 U.S. Government · Microsoft Intune · Office 365 (Commercial, GCC, GCC High, DoD), whose Commercial and GCC service lists include Power Apps, Power Automate, and Power BI · Windows Server 2016
What it covers: Reports on how far Microsoft’s products support the Section 508 criteria, for government buyers.
What remains yours: A report for Power Apps or Power Automate does not establish the accessibility of an application built with them, and the procurement responsibility remains with the buying agency. Trust, validation and IT links to Microsoft’s reports for our own applications.
Microsoft’s page: U.S. Section 508

07Industry frameworks

Industry frameworks

These frameworks set requirements for specific sectors. Microsoft’s coverage applies to the services named and does not extend to a customer or to software built on the platform.

HITRUST CSF certification

Healthcare certification · held by Microsoft since November 2016

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Certification against the HITRUST Common Security Framework, which combines HIPAA, HITECH, PCI DSS, ISO/IEC 27001, and other requirements for healthcare.
What remains yours: A shared responsibility matrix assigns each control to Microsoft, to the customer, or to both. A laboratory seeking its own certification requires its own assessment by an authorized external assessor.
Microsoft’s page: HITRUST

CSA STAR Attestation

Cloud Security Alliance STAR level 2 assessment · based on the Azure SOC 2 Type 2 audit

Microsoft services: Azure · Azure Government · Dynamics 365 · Power Platform · Microsoft 365 (select services), the scope of the Azure SOC 2 Type 2 attestation
What it covers: An independent CPA’s findings on Microsoft’s controls, measured against the Cloud Security Alliance Cloud Controls Matrix.
What remains yours: It carries the same user entity responsibilities as the Azure SOC 2 report. A laboratory seeking its own STAR entry completes that process separately.
Microsoft’s page: CSA STAR Attestation

CSA STAR Certification

Cloud Security Alliance STAR level 2 certificate · held by Microsoft

Microsoft services: Azure · Azure Government · Dynamics 365 · Power Platform · Microsoft 365 (select services)
What it covers: ISO/IEC 27001 plus the cloud-specific issues in the Cloud Controls Matrix, with a maturity score for each security domain.
What remains yours: The maturity scores describe how Microsoft manages its own control areas. They do not indicate how well a particular tenant is configured.
Microsoft’s page: CSA STAR Certification

PCI DSS v4.0, Service Provider Level 1

Payment card standard · validated by a Qualified Security Assessor · renewed yearly

Microsoft services: Azure · Azure Government · Dynamics 365 · Microsoft 365 (select services) · Power Platform
What it covers: Microsoft’s controls for handling cardholder data at the highest transaction-volume tier. It is relevant only if your laboratory accepts card payments for testing services.
What remains yours: Microsoft states that “Azure PCI DSS compliance status doesn’t automatically translate to PCI DSS validation for the services that you build or host on the Azure platform.” A laboratory that processes card payments obtains its own validation.
Microsoft’s page: PCI DSS

08Contracts and commitments

Contracts and commitments

These entries are contract terms, published commitments, or guidance documents. No audit or certificate exists for them.

HIPAA / HITECH Business Associate Agreement

Contractual commitment · in the Microsoft Product Terms and Data Protection Addendum by default

Microsoft services: Azure and Azure Government · Dynamics 365 and Dynamics 365 U.S. Government · Power Apps cloud service · Power Automate cloud service · Power BI cloud service · Office 365 and Office 365 U.S. Government
What it covers: Microsoft, as a business associate, commits to safeguard protected health information, report breaches, and meet the HIPAA Security Rule. The agreement applies automatically to customers who are covered entities or business associates.
What remains yours: HIPAA does not have an HHS-approved certification program, and a BAA with Microsoft does not make an organization compliant. Microsoft states: “Microsoft doesn’t inspect, approve, or monitor your applications… You’re wholly responsible for ensuring your own compliance.” The scope list does not name Dataverse, Power Pages, or Copilot Studio. A BAA with a software supplier would be a separate agreement.
Microsoft’s page: HIPAA and HITECH

EU Data Boundary

Data residency commitment · in the Microsoft Product Terms · no audit or certification

Microsoft services

Azure · Dynamics 365 · Power Platform (including Dataverse) · Microsoft 365

What it covers

Microsoft commits to store and process customer data and personal data for these services inside a defined European geography.

What remains yours

A tenant is in scope only when it is provisioned in the EU/EFTA Macro Region Geography and holds a billing address in an EU Data Boundary country. Some data crosses the boundary by design.

Azure CDN and Azure Front Door are excluded services.
Customized Dataverse table and column names may be replicated globally for support, while row content stays inside the boundary.
Copilot prompts, responses, and grounding data may be processed outside the boundary under flex routing.

Microsoft’s page

What is the EU Data Boundary?

GxP and FDA 21 CFR Part 11

Regulatory guidance · no certification exists · the qualification is the laboratory’s

Microsoft services: Azure · Azure Government · Dynamics 365 and Power Platform, covered by the separate Dynamics 365 and Power Platform GxP guidance document
What it covers: The rules for electronic records and electronic signatures in regulated work. Microsoft publishes two qualification guidance documents, an Azure GxP guideline produced by the independent firm Montrium and a GxP guideline for Dynamics 365 and Power Platform. Both set out which responsibilities are Microsoft’s and which are the customer’s.
What remains yours: Microsoft states: “There is no GxP or FDA 21 CFR Part 11 certification for cloud service providers.” You determine which GxP requirements apply to your system and run the qualification and validation. A supplier can provide evidence toward that validation, but it cannot perform the validation or claim its outcome.
Microsoft’s page: GxP (FDA 21 CFR Part 11)

09For the quality manager

What to hand an assessor, and what we can supply

Evidence about the platform comes from Microsoft. Evidence about the system your laboratory runs comes from your own records and from what SynapticSci provides about how the software was built and delivered.

Where the evidence is

Microsoft provides the reports and certificates, most of them through its Service Trust Portal, which requires a sign-in. SOC 3 is public. The Cloud Security Alliance and StateRAMP list Microsoft’s entries in their own registries. Every entry above links to Microsoft’s page for its framework.

What we can supply

The Microsoft documentation page for each framework your assessor names, narrowed to the services your tenant uses.
Your Dataverse audit history, which records who changed what, and when. It is yours and remains with the data.
The release manifest for your installation, with each security role we ship and the connectors your data loss prevention policy must allow.
The installation documentation and the release notes for every deployment.
For VetSci, a clause-by-clause mapping of features to the AAVLD requirements, reviewed with you.
Where a migration is in scope, the reconciliation reports you signed.

What only others can supply

Microsoft’s reports, which Microsoft provides under your own sign-in.
A determination of whether your accreditation body accepts a Microsoft attestation. Only your accreditation body can make it.
The validation itself, which your laboratory performs with the evidence we provide.

If SynapticSci hosts your deployment, we identify the Microsoft services that environment uses during implementation.

10FAQ

Questions we are asked

Can we cite Microsoft’s certifications in our own assessment?: Yes, for an implementation deployed on services that are in scope. Microsoft’s own wording is that you can use the relevant Azure certifications in your compliance assessment, and that “you’re responsible for engaging an assessor to evaluate your implementation for compliance and for the controls and processes within your own organization”.
Does building on Azure make our laboratory compliant?: No. Microsoft answers this question about its own certification: “Does Microsoft certification mean that if my organization uses Azure, it is HITRUST compliant? No. You’re ultimately responsible for your own HITRUST CSF compliance.” The same principle applies to our software.
Why are certificate dates and audit periods not listed here?: They are printed on the certificates and reports, and a date copied here would become outdated at the next audit. Read them from the current certificate under your own sign-in.