Microsoft Security

    Entra ID audit evidence for ISO 27001 and SOC 2

    Which Microsoft Entra ID settings and reports auditors ask for, and how to collect them so access-control evidence is ready before the audit.

    Why Entra ID matters in an audit

    For most Microsoft 365 organisations, Entra ID (formerly Azure AD) is where access control actually happens. ISO 27001 Annex A access controls and SOC 2 logical access criteria (CC6) are largely evidenced from it.

    Evidence auditors commonly request

    • MFA coverage — registration and enforcement for all users, especially admins
    • Conditional Access policies — exported configuration plus proof they are enabled
    • Privileged role assignments — who holds Global Administrator and other high roles, and PIM settings
    • Access reviews — completed reviews for groups, apps and privileged roles
    • Joiner/mover/leaver — samples showing accounts disabled promptly on departure
    • Sign-in and audit logs — retention period and examples of monitoring
    • Guest and external access settings

    How to collect it

    Use the Entra admin center exports, Microsoft Graph PowerShell or the Graph API to pull configurations and reports. Date-stamp each export, store it with the control it supports, and repeat on a schedule so evidence covers the full audit period — not just the week before the audit.

    How muVerity helps

    We review Entra ID against ISO 27001 and SOC 2 requirements, fix gaps, and set up repeatable evidence collection. Download our Entra evidence pack from the resources page.

    Back to Knowledge CenterBook a consultation