ISO 27001:2022: the Annex A controls that rely on Microsoft 365, and the evidence auditors expect

A reminder: Annex A in the 2022 edition

The 2022 edition of the standard reorganised Annex A into 93 controls grouped under four themes: organisational, people, physical and technological. Several controls are new, including information security for the use of cloud services, configuration management and data leakage prevention. The Statement of Applicability states which controls apply and how they are implemented; for Microsoft 365, it should link each control to the actual tenant settings.

Identity and access control

This is the area where Microsoft 365 and Entra ID carry most of the implementation. Relevant controls: access control (5.15), identity management (5.16), authentication information (5.17), access rights (5.18), privileged access rights (8.2) and secure authentication (8.5). Useful evidence:

• an export of Conditional Access policies, with their state (on, report-only) and exclusions;
• the list of privileged roles and their holders, and the PIM settings;
• access review results, with the decisions taken and applied;
• the authentication methods registration report;
• traced examples of joiners and leavers, showing accounts were actually disabled.

Auditors often work by sampling: they pick a few recent leavers from the HR list and ask you to prove, for each one, when the account was disabled, that sessions were revoked and licences removed. They may also pick an administrator and ask for the history of their role activations. Be ready for these requests: being able to query Entra ID audit logs quickly and produce a readable extract avoids many minor non-conformities. Conditional Access exclusions deserve particular attention: each one must be justified, documented and reviewed, otherwise it shows up as a weakness in access control.

Logging, monitoring and incidents

The logging (8.15) and monitoring activities (8.16) controls, together with those on incident management (5.24 to 5.28), require proof that logs exist, are kept long enough and that someone actually uses them. The auditor will appreciate: the unified audit log configuration and its retention, where Entra ID logs are sent, the alert rules in place and, above all, one or two real incidents handled end to end, with their timeline.

Information protection

Classification (5.12), labelling (5.13), information transfer (5.14), information deletion (8.10) and data leakage prevention (8.12) have their counterparts in Microsoft Purview: sensitivity labels, DLP policies, retention and deletion policies, and SharePoint and OneDrive external sharing settings. The expected evidence is not just configuration: it also includes activity reports showing that labels are used and that DLP policies are triggered.

Configuration, vulnerabilities and cloud services

Configuration management (8.9) requires a documented baseline and a way to detect drift. For Microsoft 365, a regular export of key settings compared over time, or a configuration monitoring tool, meets that need. The cloud services control (5.23) asks you to define how the organisation selects, uses and exits its cloud services: the shared responsibility split with Microsoft, the provider's audit reports available on the Service Trust Portal, and contractual commitments all belong here. The controls on user endpoint devices (8.1), malware (8.7) and technical vulnerabilities (8.8) rely on Intune and Defender where they are deployed.

What an audit checks

• Consistency between the Statement of Applicability and the tenant's actual settings.
• Dated, repeated evidence for access, logging and information protection controls.
• Access review minutes and a trail of the remediation decided.
• Log retention and alerts that are actually followed up.
• The configuration baseline and the drift detection mechanism.