AZ-900 Practice Question 77: Service Trust Portal Compliance
Microsoft Azure Fundamentals (AZ-900) · Test 8 · question 7 of 10
Before signing a contract, a customer's compliance team asks for Microsoft's independently audited compliance reports and certificates, such as ISO/IEC 27001 and SOC 2, that cover the Azure services they plan to use. Where should they go to find this documentation?
Show answer and explanation
Answer:
Microsoft publishes its independently audited certificates and reports, including the Azure ISO/IEC 27001 certificate and audit report, and its SOC reports, on the Service Trust Portal. It's the documented place customers go to access this third-party audit evidence to satisfy their own compliance reviews.
Option A, Azure Advisor, produces personalized best-practice recommendations for the resources you already run; it has no connection to Microsoft's own third-party audit reports. Option B, Azure Policy's regulatory compliance dashboard, shows how your deployed resources map to a standard's controls, which is useful once you're running workloads but isn't where the underlying signed certificate itself is published. Option D, Purview Compliance Manager score, tracks and scores your organization's own compliance posture and improvement actions, the customer's compliance, not Microsoft's audited evidence for the platform.
Reference: ISO/IEC 27001 - Azure Compliance