Vendor Due Diligence on Microsoft 365: What Goes in the File

Every vendor management program has one relationship it quietly works around. The core processor gets a full assessment. The item processor returns a completed questionnaire. The loan origination system vendor sits for a call and answers every question in writing. Then someone opens the file for Microsoft, the vendor that holds the email, the documents, the identities and most of the working day, and finds a printout of a certification page and a note that says Microsoft is Microsoft.

That file is thin for a structural reason. A vendor management program is built around a request: you send a questionnaire, the vendor answers it, you read the answers, you file them. Microsoft does not participate in that exchange the way a fifty-person fintech does. It publishes instead, on its own schedule, in its own format, through a channel most vendor management officers have never opened.

That gap is where examiners look, because the concentration of risk in the relationship is obvious to everyone in the room. The part most institutions have never been told is that the agencies addressed this situation directly. It runs to about one paragraph, it has been sitting in the 2023 interagency guidance since June of that year, and although the guidance sets out principles to tailor rather than a procedure to follow, those principles map onto Microsoft 365 more cleanly than almost anyone expects.

Set that against the shape of most vendor programs, where the file for the largest third party of all is routinely the thinnest one on the shelf.

The Questionnaire That Comes Back Empty

Start with what is actually true about the evidence, because the common framing is wrong in a way that makes the problem look unsolvable.

Microsoft publishes a great deal about how it runs its cloud services. It publishes external audit reports from independent firms. It publishes the control frameworks those audits test against. It publishes narrative documentation on how it does audit logging, incident response, governance and risk management, and it publishes that particular tier openly, with no sign-in and no agreement to accept. All of which is the mirror image of assessing a vendor who does answer you, which we cover in our guide to fintech vendor technology due diligence.

Microsoft's evidence arrives in a different shape from the one your process expects. Your process expects a document you sent to come back with answers in the boxes you drew. Microsoft's arrives as a library you go and read. That is a format mismatch, and format mismatches are solvable once you stop trying to make one side behave like the other.

This matters because the two failure modes it produces look completely different to an examiner. An institution that documents the mismatch, retrieves the published evidence and records what it concluded has a defensible file. An institution that sends a questionnaire, gets nothing back, and quietly moves on has a gap it cannot explain. The facts about Microsoft are identical in both cases. What differs is the work, and the record it leaves behind.

The Passage That Answers This

On June 6, 2023, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corporation jointly issued the Interagency Guidance on Third-Party Relationships: Risk Management. It replaced OCC Bulletin 2013-29 and OCC Bulletin 2020-10, consolidating three separate agency approaches into one document.

Most coverage of that guidance concentrated on what it expects institutions to do. Considerably less attention went to a passage in the due diligence section that anticipates the exact situation described above and says what to do about it.

Read that slowly, because it does more work than its length suggests. It concedes that some vendors will not give you what you asked for. It names on-site visits specifically. It then names three examples of what an institution may do, and the third of them, considering a different third party, is genuinely on the list and genuinely meant.

For an institution that intends to keep running Microsoft 365, that leaves three things to do: the instruction the guidance treats as important, plus the two examples that apply when you are staying. Identify and document the limitation. Obtain alternative information. Implement additional controls on or monitoring of the third party. Those three are the structure of the rest of this article, in the order the guidance gives them.

Step One: Document the Limitation

The first step is the cheapest and the one most often skipped: identify and document any limitations of your due diligence, and understand the risks that come from those limitations.

In practice this is a short, dated memorandum that says what you asked for, what form the answer took, what you therefore could not assess directly, and what you concluded about the risk of not being able to assess it. It is a page. Institutions skip it because it feels like documenting a failure, and it reads to a first-time author like an admission that the program did not work.

It is the opposite. A documented limitation is evidence that the institution understood its own position. An undocumented one is indistinguishable from an institution that never looked. When an examiner asks how you assessed Microsoft and the answer is a memo describing exactly what could and could not be assessed and why that was acceptable, the conversation is short. When the answer is a shrug, it is not.

There is a second reason to write it down, and it is the one that catches experienced programs. The same guidance is explicit that history is not a substitute for assessment.

Relying solely on experience with or prior knowledge of a third party is not an adequate proxy for performing appropriate due diligence, as due diligence should be tailored to the specific activity to be performed by the third party.

Fifteen years of uneventful service is a comfortable answer, and the guidance is explicit that it cannot carry the assessment on its own. It is also, in fairness, the honest reason many Microsoft files are thin: nothing has ever gone wrong, so nobody has ever had to explain the file. For Microsoft 365 that specific activity is email, documents, identity and increasingly the institution's own generative AI surface.

Step Two: Obtain Alternative Information

The second step is to obtain alternative information to assess the third party. For Microsoft this is concrete, and it is more substantial than most institutions realize, because it sits behind a door nobody told them to open.

The Microsoft Service Trust Portal is described by Microsoft as its public site for publishing audit reports and other compliance-related information about its cloud services. It carries the independent audit reports themselves, organized by framework: ISO/IEC standards, SOC 1, SOC 2 and SOC 3, FedRAMP, PCI DSS, CSA STAR, GDPR material, and regional schemes. It also carries a Financial Services section of regulatory-compliance material organized by country and region.

Access has two requirements worth knowing before you send someone to fetch a report. You sign in with a Microsoft Entra organization account, meaning a work account in your own tenant rather than a personal one. You then review and accept Microsoft's non-disclosure agreement for compliance materials, which is why these reports are not simply linked from a public web page and why the copy you retrieve is a confidential document to be handled as one.

A subset of documents is restricted further. Microsoft's documentation names four roles that can view those, in its own words: Tenant Admin, Compliance Administrator, Security Administrator or Security Reader. Treat those as the portal's own labels rather than as Microsoft Entra ID built-in role names, because they are not the same vocabulary, and confirm with whoever administers your tenant which assignment actually satisfies each one. Security Reader is the one worth asking for, because it is read-only and a vendor management officer or internal auditor can hold it without acquiring any ability to change the environment.

The three-part answer the guidance sets out when a vendor cannot supply what you asked for, mapped onto a Microsoft 365 tenant.

Two operational details about that portal decide whether your file survives an examination two years from now, and neither is obvious from using it.

The second detail is quieter and more useful. The portal keeps a download history, viewable and exportable to a CSV file, covering the last 18 months. That export is contemporaneous evidence that your institution actually retrieved a specific document on a specific date, generated by Microsoft rather than asserted by you. Very little else in a vendor file has that property. It costs one click to export and it belongs in the file next to the reports themselves.

Which reports to hold depends on what you run. Microsoft publishes a most recent report date for each service and framework, and those dates do not move together. A file that says "we hold Microsoft's SOC 2" without naming the service, the report and the date has not really said anything.

There is also a public tier that costs nothing and requires no agreement. Microsoft publishes service assurance documentation on Microsoft Learn covering how its online services handle audit logging and monitoring, governance, risk and compliance, and related topics, readable without signing in. It is narrative rather than attested, so it supports a file rather than carrying one, and it is genuinely useful for answering the board question that begins "but how do they actually...".

Step Three: Additional Controls and Monitoring

The third step is to implement additional controls on, or monitoring of, the third party to address the information limitation. This is where a Microsoft 365 vendor file stops looking like paperwork and starts looking like your actual security program, and it is the step where institutions get the most value for the least argument.

Two mechanisms are worth building in.

The first is the monitoring the portal will do for you. Its notification feature emails a nominated address whenever Microsoft updates a document you have saved to your library. Save the reports that matter, point the notification at the person who owns the vendor file, and the recurring review is triggered by the vendor's own publication rather than by someone remembering. That is a real, free, ongoing monitoring control, and it is the cheapest half of this step. It handles the vendor's paperwork. Your examiner opens a laptop on the other half.

The second is larger, and it is the part of the relationship you own outright. It is also the part that does not stay done. A tenant configured correctly in March is a different tenant in September, because an exclusion gets added to a Conditional Access policy for a project that ends, a retention setting is loosened for a migration, an admin role is granted for a weekend and never removed. What an examiner asks to see is not the configuration you deployed. It is the configuration you are running today, plus the record that somebody has been comparing the two.

That comparison is what M365 Guardian does. It is the configuration and monitoring layer ABT wraps around a financial institution's Microsoft 365 tenant: a documented policy baseline built for banks, credit unions and mortgage companies, deployed into the tenant, then monitored continuously for drift against that baseline and against Microsoft Secure Score controls. Guardian configures Microsoft Entra ID, Microsoft Purview and Microsoft Defender for the regulated case and watches what happens to that configuration afterwards, which is how drift shows up in a report rather than in an examination. Whether an institution runs that itself or has a provider run it, this step is a standing operation rather than a project, and that is the honest reason it is the one most files are missing.

The Line Your Examiner Actually Tests

Microsoft publishes a shared responsibility model describing which security responsibilities belong to Microsoft and which belong to the customer, and it varies by deployment type. Microsoft 365 is software as a service, so the SaaS column is the one that governs.

Microsoft's own summary of the model is one sentence: for all cloud deployment types, you own your data and identities. The same page lists four responsibilities the customer retains regardless of deployment model, which are data, endpoints, accounts and access management. Microsoft also notes on that page that it uses "responsibility" in a governance sense, as illustrative guidance about who is expected to configure, operate and monitor each control, rather than as a statement of legal conclusions or a modification of the agreement between you and Microsoft. Your contract is your contract. The table is about who does the work.

Now put the two halves together, because this is the point of the whole exercise.

Microsoft's own published control mapping points at this directly. In the control tables Microsoft publishes alongside its Microsoft 365 service assurance documentation, two of the items referenced against the SOC 3 report are labeled CUEC-08, reporting incidents, and CUEC-10, service contracts. CUEC is the standard abbreviation for a complementary user entity control, which in SOC reporting describes a control the report expects the user entity, meaning the customer, to operate in order for the system to work as described.

The authoritative list lives in the report itself rather than in a summary table, which is a good reason to read the copy you retrieve instead of filing it unopened. Find the complementary user entity controls, extract each one, give it a named owner inside your institution, and record the evidence that it operates. An institution that does that has closed the loop the report opens.

That is also where the practical work lands: Conditional Access policies and the exclusions that accumulate inside them, access reviews that actually run, audit log retention configured for the period your regulator expects rather than the default, and an incident response plan written against the tenant you actually operate. Each of those is a customer-side control. Each of them produces evidence. None of them appear in anything Microsoft's auditors signed.

If You Are a Credit Union or a Mortgage Company

Everything above describes guidance issued by the three federal banking agencies. Two large parts of the industry sit outside it, and the difference is worth stating plainly rather than assuming the same rules travel.

Credit unions. The National Credit Union Administration was not one of the issuing agencies in June 2023, and the 2023 interagency guidance is not addressed to federally insured credit unions. The standing NCUA guidance on the subject is Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships, issued in December 2007 and still active. The way Microsoft 365 is delivered, licensed and administered has moved a long way underneath it since.

There is a second structural difference, and the NCUA is the party making the point. In its own March 2022 paper on third-party vendor authority, the agency describes its lack of authority over third-party vendors serving federally insured credit unions as a growing regulatory blind spot, and states that to date it cannot directly enforce access or initiate corrective action. It has asked Congress to reinstate the authority it briefly held under the Examination Parity and Year 2000 Readiness for Financial Institutions Act, which would give it powers similar to those the federal banking regulators hold under the Bank Service Company Act. Congress has not done so.

The scale of the exposure is not theoretical either. In its Cybersecurity and Credit Union System Resilience Annual Report to Congress of June 2024, covering September 1, 2023 through May 1, 2024, the NCUA recorded 892 reported cyber incidents and stated that approximately 73 percent of all reported incidents were related to the use or involvement of a third party. Its more recent report, covering May 2024 through April 2025, records 539 incidents without publishing a comparable percentage. Either way, third parties are where credit union incidents come from, and the tenant evidence is the part of that record a credit union controls outright. Our guide to what NCUA and FFIEC examiners expect in credit union board IT reporting covers how this reaches the board packet.

Independent mortgage companies. Neither regime is addressed to you. An independent mortgage bank that is not a depository is outside both the interagency guidance and NCUA supervision, which sometimes gets read as having no obligation at all. The obligation arrives through different doors instead: investor and agency requirements, the information-security expectations attached to selling and servicing, state licensing regimes, and the Federal Trade Commission's Safeguards Rule, which carries its own service-provider oversight requirement. We cover that path in our guide to the FTC Safeguards Rule and Microsoft 365. The file you build looks much the same. What differs is who asks to see it and under which authority.

What Goes in the File

Pulling the three steps together, here is the assembled file. Every item below exists because one of the three steps calls for it. Most are a retrieval job for someone with the right role in your tenant and an afternoon. Item five is the exception, and it is the one an examiner leans on hardest.

The eight items that make up a defensible Microsoft 365 vendor due diligence file.

The relationship still carries risk, and the guidance says so plainly: considering a different third party is genuinely on the list, and for some activities at some institutions that is the right call. For everyone else, what the file does is let the institution show that it chose, deliberately, on evidence, with the limitations of that evidence written down. That is the substance of what the guidance asks for, and the work splits unevenly. Steps one and two are an afternoon. Step three is a record that has to already exist, because nobody retrofits twelve months of configuration evidence in the four weeks before an examination.

Frequently Asked Questions