SOC 2 Microsoft 365 Readiness Checklist
Prepare your Microsoft 365 environment for SOC 2 Type II audit. This checklist covers identity and access management controls required for SOC 2 compliance.
Prerequisites
- •Understanding of SOC 2 Trust Service Criteria
- •Admin access to Microsoft 365
- •Existing SOC 2 policy documentation
CC6.1 - Logical Access Security
Controls for user authentication and access.
Provide evidence of MFA policy and enforcement.
Related: CA-01Show password complexity and banned password settings.
Related: ID-02Provide Conditional Access policy blocking legacy auth.
Related: CA-09CC6.2 - Access Authorization
Controls for access provisioning and authorization.
Evidence of approval workflow for privileged roles.
Related: PA-04Show users have minimum required access.
CC6.3 - Access Removal
Controls for timely access removal.
Show process for identifying and disabling inactive accounts.
CC6.6 - Access Reviews
Controls for periodic access review.
Show recurring access review configuration and completion.
Related: GOV-03Show how access review findings are addressed.
CC7.2 - Security Monitoring
Controls for monitoring and detecting anomalies.
Show unified audit log configuration and retention.
Related: LOG-01Show alert policies for security events.
Provide incident response procedures and evidence of testing.
Automate this checklist with TrueConfig
TrueConfig automatically monitors your Microsoft 365 configuration against these best practices and alerts you when settings drift.