ConfigCheckup
Free trial

SOC 2 in Microsoft 365: the Trust Services Criteria, mapped

14 criteria can be evidenced from a Microsoft 365 tenant, by 167 checks. Each one is listed below with its checks, and so is what sits outside Microsoft 365.

Every framework mapped to Microsoft 365 · Mappings checked against the published standards in October 2026

What SOC 2 is

The AICPA Trust Services Criteria, mainly the Common Criteria for security (CC6 logical access, CC7 operations) and confidentiality.

Who asks for it: SaaS and service providers selling to US and enterprise customers.

What Microsoft 365 can show

14 criteria evidenced by 167 checks. A check maps to a criterion only where its result is genuine evidence for it, so a criterion is listed only when a tenant setting can show it.

Outside Microsoft 365

Governance, risk assessment, vendor management and change management criteria are evidenced by policies and records, not tenant configuration.

Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.

Every criterion and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

SOC 2: each of the 14 criteria and the checks that evidence it
CriterionChecks that evidence it
C1.1 Identifying and maintaining confidential information
8 more checks for C1.1
C1.2 Disposing of confidential information
CC4.1 Ongoing and separate evaluations of controls
CC6.1 Logical access security software, infrastructure and architectures
48 more checks for CC6.1
CC6.2 User registration, authorisation and removal
9 more checks for CC6.2
CC6.3 Role-based access and least privilege
13 more checks for CC6.3
CC6.6 Protection against threats from outside the system boundaries
9 more checks for CC6.6
CC6.7 Restricting the transmission, movement and removal of information
18 more checks for CC6.7
CC6.8 Preventing or detecting unauthorised or malicious software
17 more checks for CC6.8
CC7.1 Detecting configuration changes and vulnerabilities
CC7.2 Monitoring system components for anomalies
10 more checks for CC7.2
CC7.3 Evaluating security events
CC7.4 Responding to security incidents
CC9.2 Assessing and managing risks from vendors and business partners
  • NIST SP 800-171: Protecting controlled unclassified information in the US defence supply chain.
  • CMMC Level 2: The NIST SP 800-171 practices, as US defence contractors are assessed on them.
  • CISA SCuBA Microsoft 365 baselines: CISA’s secure configuration baselines for Microsoft 365.
  • NIST CSF 2.0: The NIST Cybersecurity Framework: govern, identify, protect, detect, respond and recover.

Run the SOC 2 report on every tenant.

ConfigCheckup checks each tenant you connect against SOC 2: each criterion met, partly met or not met, and what Microsoft 365 cannot show.

Start free trialTake the 2-minute tour

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. See the price per tenant