Microsoft Entra evidence
The Microsoft Entra exports your SOC 2 auditor will ask for
Where each artifact lives, how to pull it, and what separates a passing export from a failing one.
- Five exports, with the navigation path for each
- What the auditor is testing, and how often to re-pull
- Which SOC 2 criteria and ISO 27001:2022 Annex A controls each one supports
Written by the muVerity practitioners who do this work. It sets out what the instruments require and what we have seen hold up in practice — it is not legal advice, and it does not make an organisation compliant.
Who it is for
Teams doing this without a dedicated compliance function
Most of the organisations we work with have a deadline, a small team, and no one whose only job is this. The document is written for that situation: specific enough to act on, short enough to finish.
If you would rather talk
Book time with a practitioner
A working session on scope, gaps and sequencing — with the person who would do the work, not a sales call.