How-To8 May 2026 12 min read

SOC 2 Azure AD Controls: Conditional Access and PIM

SOC 2 Azure Active Directory controls covering Conditional Access policies, Privileged Identity Management, MFA enforcement, and audit log evidence for CC6 criteria.

Key Takeaways

Conditional Access policies in Entra ID enforce MFA, device compliance, and location-based controls.
Privileged Identity Management (PIM) provides just-in-time privileged access with approval workflows.
Azure AD Identity Protection detects risky sign-ins and automates CC7.2 threat monitoring evidence.
Access Reviews in Entra ID Governance automate quarterly access certification for CC6.3 compliance.
Sign-in logs and audit logs export via Microsoft Graph API for automated evidence collection.
Security Defaults or named Conditional Access policies must be explicitly enabled — Azure AD is not secure by default.

In this guide

Azure AD in SOC 2 Scope
Conditional Access Policies (CC6.1, CC6.6)
Privileged Identity Management (CC6.2)
Identity Protection (CC7.2)
Access Reviews (CC6.3)
MFA Methods and SSPR
Audit Log Export and Evidence

Azure AD in SOC 2 Scope

Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management foundation for Microsoft 365, Azure resources, and thousands of SAML/OIDC-integrated applications. If your company uses Microsoft 365, Azure, or any Microsoft application, Entra ID is in scope for your SOC 2 audit.

Microsoft publishes SOC 2 Type II reports for Azure services via the Microsoft Service Trust Portal (servicetrust.microsoft.com). Download the Azure and Microsoft 365 SOC 2 report to reference in your audit package. Your responsibility includes the Conditional Access policies you configure, how you manage privileged roles, and whether you have enabled the security controls available in your Entra ID tier.

Conditional Access Policies (CC6.1, CC6.6)

Conditional Access is the primary access control mechanism in Entra ID. Navigate to Entra ID → Protection → Conditional Access → Policies. Create the following named policies: (1) "Require MFA for all users" — Assignments: All users, All cloud apps. Access controls: Grant → Require multifactor authentication. This baseline policy ensures no user can access any application without MFA, regardless of location.

(2) "Require compliant device for privileged access" — Assignments: Users in "Azure AD Admins" group, All cloud apps. Conditions: device platform (Windows, macOS, iOS, Android). Access controls: Grant → Require device to be marked as compliant. This ensures admin access only occurs from Intune-managed, policy-compliant devices, satisfying CC6.6 boundary protection. (3) "Block legacy authentication" — Conditions: Client apps → Legacy authentication clients. Access controls: Block. Legacy auth bypasses MFA and is a common attack vector.

(4) "Require MFA for Azure management" — Assignments: All users, Azure Management app. Access controls: Grant → Require MFA. This specifically targets Azure portal, PowerShell, CLI, and ARM access, ensuring cloud console access is always protected by MFA. Enable named Conditional Access policies by disabling Security Defaults in Entra ID → Properties → Manage security defaults — Security Defaults and Conditional Access are mutually exclusive.

Privileged Identity Management (CC6.2)

Azure AD Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access. Instead of permanently assigning Global Administrator or Subscription Owner roles, PIM makes these roles "eligible" — users can activate the role for a limited time (typically 1–4 hours) with MFA re-authentication and optional manager approval. Navigate to Entra ID → Identity Governance → Privileged Identity Management.

Configure PIM settings for critical roles: Global Administrator — require approval (designated approvers list), require MFA on activation, set maximum activation duration to 2 hours, require justification. Go to PIM → Azure AD roles → Settings → [role] and configure activation settings. For Azure subscription Owner and Contributor roles, configure the same settings under PIM → Azure resources.

Use the PIM audit log as evidence for CC6.2 (access provisioning) and CC6.3 (access review). PIM logs every role activation with timestamp, user, duration, and justification. Export PIM audit logs monthly via PIM → Azure AD roles → Audit log → Export. This provides auditors with a complete record of who had privileged access, when, and why — exactly the evidence they need for least-privilege access controls.

Identity Protection (CC7.2)

Microsoft Entra ID Protection (available in Entra ID P2) continuously analyzes sign-ins using ML models trained on Microsoft threat intelligence. It generates risk signals: user risk (credential compromise indicators) and sign-in risk (anomalous sign-in patterns). Navigate to Entra ID → Protection → Identity Protection.

Configure two Conditional Access policies based on risk: "MFA required for medium/high sign-in risk" — Conditions: Sign-in risk level → Medium and above. Access controls: Grant → Require MFA. "Block access for high user risk" — Conditions: User risk level → High. Access controls: Block or require password change. These policies provide automated response to detected threats, satisfying CC7.3 (response to identified threats).

Review Identity Protection reports weekly: Risky users, Risky sign-ins, and Risk detections. Investigate and dismiss false positives, and confirm true positives (compromised credentials) by checking for unauthorized access in the audit log. Document your investigation process — this process evidence plus the Identity Protection report exports constitute strong CC7.2 and CC7.3 audit evidence.

Access Reviews (CC6.3)

Entra ID Governance Access Reviews (requires P2 or Governance license) automate the quarterly access certification process required for CC6.3. Navigate to Entra ID → Identity Governance → Access reviews → New access review. Create reviews for: (1) Group membership reviews — select a security group, set reviewers to group owners or managers, set frequency to quarterly, set "Upon completion" to automatically remove access for non-responses and denied access. (2) Azure AD role reviews — review Global Administrator and other critical role assignments quarterly.

For each completed access review, export the results: Access reviews → [completed review] → Results → Export. This CSV file shows each user, the reviewer, and the decision (approved/denied). Compile quarterly exports as CC6.3 access review evidence. If you implement automated removal on denial, also export the Entra ID audit log showing the resulting group membership changes as corroborating evidence.

MFA Methods and SSPR

Navigate to Entra ID → Protection → Authentication methods → Policies. Enable Microsoft Authenticator with "Require number matching" and "Show additional context in notifications" to prevent MFA fatigue attacks (where an attacker sends repeated push notifications until the user accidentally approves). Disable SMS for privileged accounts — go to the SMS policy and exclude your Admins group.

For all accounts, set Authentication methods to require at least Microsoft Authenticator or FIDO2. Disable voice call and simple "approve/deny" notifications without number matching. Under Entra ID → Protection → Authentication methods → Settings → Number matching, set to "Enabled" for all users. Under "Additional context", enable for all users as well. These settings reduce the success rate of real-time phishing attacks dramatically.

Self-Service Password Reset (SSPR) should require two authentication methods (e.g., Authenticator app + email) to prevent account takeover via password reset. Navigate to Entra ID → Protection → Password reset → Properties → Enable SSPR for "All" users. Under Authentication methods, require "2 methods required to reset". Under Registration, require users to register when they sign in. Document SSPR configuration in your password management policy.

Audit Log Export and Evidence

Entra ID provides two key logs: Audit logs (administrative actions: user creation, group changes, role assignments, policy changes) and Sign-in logs (every authentication event with risk score, MFA result, Conditional Access policy result). Access them under Entra ID → Monitoring → Audit logs and Sign-in logs.

Export to Azure Monitor Log Analytics and then archive to Azure Storage for long-term retention. Navigate to Entra ID → Monitoring → Diagnostic settings → Add diagnostic setting. Select "Audit Logs", "SignInLogs", "RiskyUsers", and "RiskDetections". Route to Log Analytics workspace and to a Storage account. Set retention to 90 days in Log Analytics and 365 days in Storage. This automated export provides continuous evidence for your entire audit period.

For auditor-facing evidence, use the Microsoft Graph API (`GET /auditLogs/signIns`, `GET /auditLogs/directoryAudits`) to export specific date ranges to CSV. Include sign-in logs showing MFA success rates, Conditional Access policy evaluation results, and PIM activation records in your audit package. Auditors reviewing an Entra ID environment that has all of these configured will have a positive impression of your identity program maturity.

Frequently Asked Questions

Do we need Entra ID P2 for SOC 2 compliance?

Entra ID P2 is required for Privileged Identity Management, Identity Protection, and Access Reviews — three of the most valuable SOC 2 controls. P1 covers Conditional Access, which is also essential. Most companies going through SOC 2 benefit from P2 — the audit time savings from automated access reviews alone typically exceed the license cost.

What is the difference between Security Defaults and Conditional Access for SOC 2?

Security Defaults is a free baseline that enforces MFA for all users using the Microsoft Authenticator app. Conditional Access provides granular policy control: per-app rules, risk-based policies, device compliance requirements, and named policy documentation. For SOC 2, Conditional Access is strongly preferred because auditors want to see specifically documented policies, not a generic baseline.

How do we satisfy CC6.3 without Entra ID Governance Access Reviews?

Without automated Access Reviews, you need to conduct quarterly manual reviews by exporting group membership reports from Entra ID, sending them to managers for review, collecting approval signatures, and logging any access changes made as a result. This works but is significantly more time-consuming. Document the process in a policy and maintain the review evidence (emails, spreadsheets, approval records) for auditors.

Does PIM satisfy the least-privilege requirement for SOC 2?

Yes. PIM is one of the strongest implementations of least-privilege access in the industry. By making privileged roles eligible rather than permanent, you ensure that no user has standing admin access. The activation audit log proves that privileged access was time-bound and justified. This is compelling evidence for CC6.2 and earns positive commentary in audit reports.

How do we handle service principals for SOC 2 access control?

Service principals (used by applications and automation) should be assigned roles with least-privilege using custom roles where possible. Audit service principal permissions quarterly. Use Managed Identities for Azure resources to eliminate credential management entirely. Review and remove service principal permissions that are unused — Entra ID Workload Identities provides risk detection for service principals in P2.