Microsoft 365 Privacy Features and Trust Centre

Microsoft 365 is built on a foundation of trust. Privacy features encompass the technical and organizational controls Microsoft implements to protect customer data, including encryption, data residency, data access policies, and auditing. The Trust Centre (now part of the Service Trust Portal) is a centralized resource where Microsoft publishes compliance certifications, audit reports, data protection documentation, and privacy policies. It serves as a single source of truth for customers to verify Microsoft's compliance with standards like ISO 27001, SOC 2, HIPAA, GDPR, and FedRAMP.

Organizations moving to the cloud need assurance that their data is secure, private, and handled according to legal and regulatory requirements. Microsoft's privacy features and Trust Centre provide transparency and control, enabling customers to:

Microsoft's privacy model is based on the principle that customer data belongs to the customer. Microsoft does not use customer data for its own purposes (e.g., advertising). At the technical level:

1. Data Encryption - At Rest: All data in Microsoft 365 is encrypted using BitLocker (disk-level encryption) and per-service encryption (e.g., Exchange Online uses BitLocker and service encryption with customer-managed keys via Office 365 Customer Key). - In Transit: Data is encrypted using TLS 1.2+ between client and server, and between Microsoft datacenters.

2. Data Residency - Microsoft stores customer data in specific geographic regions based on tenant location (e.g., EU data stays in EU datacenters). Customers can use Advanced Data Residency add-on to control data storage for specific workloads.

3. Access Controls - Microsoft engineers have no standing access to customer data. Access is granted via Just-In-Time (JIT) and Just-Enough-Access (JEA) principles, requiring approval and logging. All access is audited.

4. Audit Logging - The Unified Audit Log records all user and admin activities across Exchange Online, SharePoint Online, Teams, and other workloads. Logs are retained for 90 days by default (up to 1 year with add-on, or 10 years with Audit (Premium)).

5. Service Trust Portal - Provides documents such as SOC reports, ISO certifications, and Data Protection Impact Assessments (DPIAs). Customers can download these reports to demonstrate compliance to auditors.

6. Compliance Manager - A workflow-based tool that helps organizations assess their compliance posture against regulations like GDPR, HIPAA, and NIST. It provides recommendations and tracks improvement actions.

To access the Service Trust Portal: 1. Log into the Microsoft 365 admin center. 2. Navigate to Settings > Service Trust Portal or directly visit [https://servicetrust.microsoft.com](https://servicetrust.microsoft.com). 3. Download compliance reports (e.g., SOC 2 Type II report) after signing the non-disclosure agreement (NDA).

To enable Customer Lockbox:

To view audit logs:

A large hospital chain adopts Microsoft 365 for email and collaboration. To comply with HIPAA, they need to ensure that protected health information (PHI) is encrypted and that access is audited. They enable Customer Lockbox to control Microsoft engineer access to PHI. They configure DLP policies to detect PHI (e.g., medical record numbers) and prevent sharing externally. They use Compliance Manager to assess their HIPAA compliance posture and track improvement actions. They download SOC 2 Type II reports from the Service Trust Portal to provide to their auditors. The key challenge is ensuring that all users correctly classify emails and documents with sensitivity labels; misconfiguration can lead to data leaks. Performance-wise, DLP scanning may delay email delivery slightly, but this is acceptable. A common pitfall is failing to enable audit logging for all workloads, which would leave gaps in the audit trail.

A multinational company receives a data subject request (DSR) from a customer in the EU to access their personal data. The company uses Microsoft Priva (formerly part of Compliance Manager) to find all personal data across Exchange, SharePoint, and Teams. They use eDiscovery to search for the customer's data and export it. They then provide the data to the customer in a structured format (e.g., JSON). The company also uses data retention policies to automatically delete personal data after the legally required retention period ends. The challenge is that DSRs often require searching across multiple data stores; Microsoft's tools provide a unified search interface. A common mistake is forgetting that data in backups may also need to be included; backup retention policies must align. The exam tests that DSRs are handled via the compliance portal.

A bank uses Microsoft 365 for communication and needs to retain all emails for 7 years per SEC regulations. They configure a retention policy to keep all Exchange data for 7 years and then delete. They enable audit logging to track all access to sensitive financial data. They use Customer Lockbox to approve any Microsoft engineer access to their tenant. They regularly download SOC reports from the Service Trust Portal to demonstrate controls to regulators. The scale is large: 50,000 users generating millions of emails daily. Retention policies must be tested to ensure they do not accidentally delete data prematurely. A common issue is that users may try to delete emails, but retention policies preserve them in a hidden folder, which can cause confusion. The exam tests that retention policies override user deletions.