When a hosting provider says it inherits Azure’s SOC 2, it means the data centers and cloud platform under your software fall inside Microsoft’s independently audited controls. It does not mean your application, your user accounts, or your data practices sit inside that audit too. Azure SOC 2 hosting shared responsibility splits the work across three parties, and six common myths blur where the lines fall.
THE SHORT VERSION
SOC 2 is an auditor’s report on controls, not a badge. Microsoft holds the reports for Azure. A provider building on Azure inherits coverage for the layers Microsoft runs, then configures everything above them. You keep responsibility for your accounts and your data decisions.
Six Myths About Azure SOC 2 Hosting Shared Responsibility
MYTH 1
“Our hosting provider runs on Azure, so it’s SOC 2 certified.”
FACT
SOC 2 is a report an independent auditor writes after testing an organization’s controls. Microsoft holds those reports for Azure. A provider that builds on Azure inherits coverage for the layers Microsoft operates. At CloudTop SaaS we describe it in exactly those terms: inherited from Azure, configured for line-of-business workloads. The attestations belong to Microsoft, and we don’t present them as our own certification.
MYTH 2
“If Azure is covered, my whole hosted setup is covered.”
FACT
Azure SOC 2 hosting shared responsibility runs across three layers. Microsoft runs the data centers, the hardware, and the cloud platform. Your hosting provider configures the tenant, enforces MFA, sets encryption, runs backups, and monitors the environment. You decide who gets an account, how your team handles data, and which software vendor’s code runs in the environment. Each layer answers for its own piece.
MYTH 3
“SOC 2 means somebody passed a test.”
FACT
A SOC 2 report records the auditor’s opinion on a set of controls. A Type 1 report looks at how the controls are designed on a single date. A Type 2 report tests whether they operated over a stretch of time. Either type can note exceptions, so the details inside the report carry more information than the label on the cover.
MYTH 4
“Any provider on Azure is equally secure.”
FACT
Azure hands every tenant the same building blocks, and the provider’s configuration decides what you end up with. Ours: MFA enforced on every user at every login, TLS 1.2 or higher in transit, managed-disk encryption at rest, automated daily backups with tested point-in-time restore, and U.S. regions by default (East US and Central US). Ask any provider you’re considering for the same list in writing.
MYTH 5
“Inherited SOC 2 means we’re covered for HIPAA or PCI.”
FACT
HIPAA and PCI-DSS are separate frameworks with their own requirements. We don’t claim HIPAA or PCI-DSS certification on our own behalf. For workloads that fall under them, we architect against the relevant controls and walk through the shared-responsibility model with you. Your compliance obligations stay with you and your advisers.
MYTH 6
“You can’t check any of this yourself.”
FACT
You can. Microsoft publishes its audit reports through the
Microsoft Service Trust Portal, and a provider that stands behind its setup will put the configuration in writing. If a provider can’t or won’t, treat that as information.
Where Inheriting Azure’s Attestations Falls Short
Inherited coverage has a ceiling. If your contract, your insurer, or your regulator requires the hosting provider itself to hold an audit report, Azure’s attestations will not satisfy that requirement. Ask before you sign anything. We will tell you plainly on the discovery call which of those situations you’re in, even when the answer points you elsewhere.
CloudTop SaaS is a CloudTop Office company. We’ve hosted Windows business software since 2000 through the parent brand, we’re a Microsoft Hosting Provider Program partner, and U.S.-based engineers answer every ticket.
FAQ
Is inheriting Azure’s attestations the same as holding your own?
No. Inherited coverage applies to the infrastructure layer Microsoft operates. A provider’s own audit would cover its own processes and people. We describe our position as inherited from Azure and configured for line-of-business workloads.
What does a SOC 2 report actually cover?
It covers controls tied to the trust services criteria: security, availability, processing integrity, confidentiality, and privacy. A given report can cover one criterion or several, so check the scope before relying on it.
Where can I read Microsoft’s SOC reports for Azure?
Microsoft publishes them through the Microsoft Service Trust Portal at servicetrust.microsoft.com. Access may require signing in with a Microsoft account.
Do I still have security responsibilities with a hosted setup?
Yes. You decide who gets an account, who keeps access after leaving the company, and how your staff handle the data they export or print. The hosting provider secures the environment. You control who walks into it.
Want the configuration in writing before you decide?
A 15-minute call covers how your environment would be set up and which responsibilities stay with you.
Book a 15-min consult
