Identify whose control is evaluated
An assurance document is useful only within its scope. The Microsoft Service Trust Portal publishes external audit reports and other compliance-related information about Microsoft cloud services. That is provider evidence. A customer’s group memberships, access-review decisions and implementation records are customer operational evidence. Both can matter in an assessment, but neither should be silently substituted for the other. Write the control operator, service/environment scope and evidence period before drawing a conclusion about relevance.
Use provider material within its boundary
A Service Trust Portal report can help a reviewer understand provider controls and external assurance. Some materials require authentication, acceptance of an agreement or particular permissions. This course does not obtain restricted reports or infer permission to redistribute them. A report’s service list does not show that the customer’s own staff performed a required review. A newer version can improve currency while still leaving that customer-operated evidence gap. Scope and date are necessary questions, not substitutes for the missing implementation record.
Privacy principles frame questions
Microsoft’s current commercial privacy reference describes customer control of data, knowledge of where data is located and how it is used, protection at rest/in transit, and defending data from third-party access. Use these as high-level questions for an evidence review. Information about location and use answers a different question from how many authentication prompts a person completed. These principles do not establish an individual organization’s legal compliance or settle the meaning of a contractual term. Specific obligations require their own applicable evidence and qualified interpretation.
Worked example
Fictional teaching case: a sculpture archive has a provider audit report, but its internal review asks whether last quarter’s temporary collaboration memberships were actually reviewed by their owners. First classify the provider report as evidence about its stated provider service scope. Next identify the requested customer control: the archive’s membership review. The directly relevant next evidence is the archive’s review decisions and resulting access records for that scope. Replacing the provider report with a more recent copy does not supply those missing customer records, although currency remains useful for the separate provider assessment.
Transfer check
Try a different evidence question: a fictional governance group wants to understand how customers can know where information is located and how it is used. Would a record showing an engineer activated an administrative role directly answer it? Check basis: no. The activation record concerns privilege use. Data-location/use information is relevant to the stated privacy-transparency question. This exercise matches an evidence type to a principle-level question; it does not infer that a disclosure is complete or that the organization satisfies every privacy obligation.
Verify the conclusion
State only what the chosen evidence supports. Distinguish provider controls, customer implementation and privacy information. Missing scope, dates, access rights or implementation records remain explicit unknowns. No actual reports behind agreements, private tenant data or legal opinions are part of these fictional cases. The learner’s job is evidence relevance, not awarding an organization a compliance certificate.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
What are access reviews? - Microsoft Entra - Microsoft Entra ID Governance | Microsoft LearnPrivacy and data management overview - Microsoft Service Assurance | Microsoft LearnGet started with the Microsoft Service Trust Portal | Microsoft LearnShared responsibility in the cloud - Microsoft Azure | Microsoft Learn