Microsoft Azure
Total Page:16
File Type:pdf, Size:1020Kb
Microsoft Corporation - Microsoft Azure (Azure & Azure Government) SOC 3 Report April 1, 2017 - March 31, 2018 Table of contents Section I: Independent Service Auditors’ Report 2 Section II: Management’s Assertion 4 Section III: Description of Microsoft Azure System 6 Section I: Independent Service Auditors’ Report 1 Deloitte & Touche LLP 925 Fourth Avenue, Suite 3300, Seattle, WA 98104-1126 Tel: +1 206 716 7000 Section I: Independent Service Auditors’ Report Microsoft Corporation One Microsoft Way Redmond, WA, 98052-6399 We have examined the effectiveness of Microsoft Azure and Microsoft datacenters (the “Service Organization” or “Azure”) controls related to Azure’s in-scope services, for Azure and Azure Government cloud environments, to meet the criteria for the security, availability, processing integrity, and confidentiality principles (“applicable 1 2 trust services criteria”) , during the period April 1 2017 to March 31, 2018 , based on the American Institute of Certified Public Accountants’ (AICPA) 2016 edition of TSP section 100A, Trust Services Principles and Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. Azure’s management is responsible for maintaining the effectiveness of these controls. Our responsibility is to express an opinion based on our examination. Our examination was conducted in accordance with attestation standards established by the AICPA, and accordingly, included (1) obtaining an understanding of the controls related to Azure’s in-scope services, for Azure and Azure Government cloud environments, to meet the applicable trust services criteria (2) testing and evaluating the operating effectiveness of the Service Organization’s controls, and (3) performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion. Because of the nature and inherent limitations of controls, the Service Organization’s ability to meet the aforementioned criteria may be affected. For example, controls may not prevent or detect and correct error or fraud, unauthorized access to systems and information, and failure to comply with internal and external policies or requirements. Also, the projection of any conclusions based on our findings to future periods is subject to the risk that changes may alter the validity of such conclusions. In our opinion, the Service Organization maintained, in all material respects, effective controls to meet the applicable trust services criteria during the period April 1, 2017 to March 31, 2018 to provide reasonable assurance that: • the system was protected against unauthorized access, use or modification, • the system was available for operation and use as committed or agreed, • information within the system, designated as “confidential”, was protected as committed or agreed, and • the system processing was complete, valid, accurate, timely, and authorized based on the AICPA’s trust services principles and criteria for security, availability, processing integrity, and confidentiality. April 30, 2018 1 Applicable Trust Services Principles for Microsoft datacenters are Security and Availability. 2 In-scope services and coverage periods are defined in the Azure and Azure Government Report Scope Boundary and Azure Supporting Infrastructure Services subsections in Section III of this SOC 3 report. Applicability of the Processing Integrity Trust Services Principle is defined in the Azure and Azure Government Report Scope Boundary subsection. In-scope datacenters and coverage periods are defined in the Locations Covered by this Report subsection in Section III of this SOC 3 report. 2 Section II: Management’s Assertion 3 Section II: Management’s Assertion Microsoft Azure and Microsoft datacenters (“Azure”) maintained effective controls over the security, availability, 3 processing integrity, and confidentiality (“applicable trust services criteria”) of the system relating to Azure’s in-scope services, for Azure and Azure Government cloud environments, throughout the period April 1, 2017 to 4 March 31, 2018 , to provide reasonable assurance that: • the system was protected against unauthorized access, use or modification, • the system was available for operation and use as committed or agreed, • information within the system, designated as “confidential”, was protected as committed or agreed, and • the system processing was complete, valid, accurate, timely, and authorized based on the 2016 edition of TSP section 100A, Trust Services Principles and Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Principles and Criteria) for security, availability, processing integrity and confidentiality. The following description of the system identifies the aspects of the Azure’s in-scope services covered by this assertion. Microsoft Azure 3 Applicable trust services criteria for Microsoft datacenters are Security and Availability. 4 In-scope services and coverage periods are defined in the Azure and Azure Government Report Scope Boundary and Azure Supporting Infrastructure Services subsections in Section III of this SOC 3 report. Applicability of the Processing Integrity Trust Services Principle is defined in the Azure and Azure Government Report Scope Boundary subsection. In-scope datacenters and coverage periods are defined in the Locations Covered by this Report subsection in Section III of this SOC 3 report. 4 Section III: Description of the Microsoft Azure System 5 Section III: Description of Microsoft Azure System Overview of Operations Business Description Microsoft Azure is a cloud computing platform for building, deploying and managing applications through a global network of Microsoft and third-party managed datacenters. It supports both Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) cloud service models, and enables hybrid solutions that integrate cloud services with customers’ on-premises resources. Microsoft Azure supports many customers, partners, and government organizations that span across a broad range of products and services, geographies, and industries. Microsoft Azure is designed to meet their security, confidentiality, and compliance requirements. Microsoft datacenters support Microsoft Azure and many other Microsoft Online Services (“Online Services”). Online Services such as Intune, Power BI, and others are Software as a Service (SaaS) services that leverage the underlying Microsoft Azure platform and datacenter infrastructure. See section titled Azure and Azure Government Report Scope Boundary for the Microsoft Azure services and Online Services that are in scope for this report. “Azure”, when referenced in this report, comprises of “Microsoft Azure”, “Online Services”, and the supporting datacenters listed in this report. Azure and Azure Government Report Scope Boundary Azure is a global multi-tenant cloud platform that provides a public cloud deployment model. Azure Government is a US Government Community Cloud (GCC) that is physically separated from the Azure cloud. The following Azure and Azure Government services are in scope for this report: Cloud Environment Examination Period Product Scope 5 Offering / Service Scope Category Azure Azure Q2 Q3 Q4 Q1 Government 2017 2017 2017 2018 Microsoft Datacenters Microsoft Datacenter and Operations Service ✓ ✓ ✓ ✓ ✓ ✓ 5 Examination Period scope Q2 2017 extends from April 1, 2017 to June 30, 2017. Examination Period scope Q3 2017 extends from July 1, 2017 to September 30, 2017. Examination Period scope Q4 2017 extends from October 1, 2017 to December 31, 2017. Examination Period scope Q1 2018 extends from January 1, 2018 to March 31, 2018. 6 Cloud Environment Examination Period Product Scope 5 Offering / Service Scope Category Azure Azure Q2 Q3 Q4 Q1 Government 2017 2017 2017 2018 Azure Compute Batch ✓ ✓ ✓ ✓ ✓ ✓ Cloud Services ✓ ✓ ✓ ✓ ✓ ✓ Functions6 ✓ ✓ ✓ ✓ ✓ ✓ Service Fabric ✓ ✓ ✓ ✓ ✓ ✓ SQL Server on Virtual Machines ✓ ✓ ✓ ✓ ✓ ✓ Virtual Machines ✓ ✓ ✓ ✓ ✓ ✓ Azure Reserved Virtual Machine ✓ - - - ✓ ✓ Instances Virtual Machines Scale Sets ✓ ✓ ✓ ✓ ✓ ✓ Networking Application Gateway ✓ ✓ ✓ ✓ ✓ ✓ Azure DNS6 ✓ ✓ ✓ ✓ ✓ ✓ Content Delivery Network ✓ - - - - ✓ ExpressRoute ✓ ✓ ✓ ✓ ✓ ✓ Load Balancer ✓ ✓ ✓ ✓ ✓ ✓ Network Watcher6 ✓ ✓ - ✓ ✓ ✓ Traffic Manager ✓ ✓ ✓ ✓ ✓ ✓ Virtual Network ✓ ✓ ✓ ✓ ✓ ✓ VPN Gateway ✓ ✓ ✓ ✓ ✓ ✓ Storage Backup ✓ ✓ ✓ ✓ ✓ ✓ Data Lake Store ✓ - ✓ ✓ ✓ ✓ Import / Export ✓ ✓ ✓ ✓ ✓ ✓ Site Recovery ✓ ✓ ✓ ✓ ✓ ✓ Storage (Blobs, Disks, Files, Queues, ✓ ✓ ✓ ✓ ✓ ✓ Tables) including Cool and Premium 6 Examination Period for this service for Azure Government is from January 1, 2018 to March 31, 2018. 7 Cloud Environment Examination Period Product Scope 5 Offering / Service Scope Category Azure Azure Q2 Q3 Q4 Q1 Government 2017 2017 2017 2018 StorSimple ✓ ✓ ✓ ✓ ✓ ✓ Web + Mobile App Service ✓ ✓ ✓ ✓ ✓ ✓ App Service: API Apps ✓ ✓ ✓ ✓ ✓ ✓ App Service: Mobile Apps ✓ ✓ ✓ ✓ ✓ ✓ App Service: Web Apps ✓ ✓ ✓ ✓ ✓ ✓ Azure Search ✓ - - ✓ ✓ ✓ Media Services ✓ ✓ ✓ ✓ ✓ ✓ Containers Container Registry ✓ - ✓ ✓ ✓ ✓ Azure Container Service (ACS) ✓ - ✓ ✓ ✓ ✓ Azure Kubernetes Service (AKS) ✓ - - - - ✓ Databases Azure Cosmos DB6 ✓ ✓ ✓ ✓ ✓ ✓ Azure Database for MySQL ✓ - ✓ ✓ ✓ ✓ Azure Database for PostgreSQL ✓ - ✓ ✓ ✓ ✓ Redis Cache ✓ ✓ ✓ ✓ ✓ ✓ SQL Database ✓ ✓ ✓ ✓ ✓ ✓ SQL Data Warehouse ✓ ✓ ✓ ✓ ✓ ✓ SQL Server Stretch Database ✓ ✓ ✓ ✓ ✓ ✓ Analytics Azure Analysis Services6 ✓ ✓ ✓ ✓ ✓ ✓ Data Lake Analytics ✓ - ✓ ✓ ✓ ✓ HDInsight ✓ ✓ ✓ ✓ ✓ ✓ Stream Analytics