DORA compliance Microsoft 365
Is Microsoft 365 in your DORA register? And the 200 apps plugged into it?
DORA (EU 2022/2554) has applied to financial entities since 17 January 2025, and its third-party pillar asks for a register of information covering every ICT arrangement that touches your data. Microsoft 365 is one of them - and so is every OAuth app consented into it and every external organisation it exchanges data with. 1Security measures DORA readiness from the tenant itself: requirement statuses per article, the register slice kept live instead of compiled annually, and a dated evidence pack for the competent authority.
The scenario
The regulator asks for the register. It was compiled last year.
DORA covers some twenty types of financial entities - banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers - and stands on five pillars: ICT risk management, incident reporting on a fixed initial, intermediate and final cadence, resilience testing, ICT third-party risk, and information sharing. Enforcement runs through national competent authorities, and the critical ICT providers it places under direct oversight can face periodic penalty payments of up to 1% of average daily worldwide turnover. The first thing a supervisor asks for is not a policy. It is the register of information, current.
Here is the part the annual-spreadsheet approach misses: most of the register is already observable. Articles 28 to 30 want every ICT arrangement listed with what it touches - and inside Microsoft 365 that answer is the app inventory and the external-domain map. Every OAuth app with its publisher, reach and the admin who consented it is an ICT service software-side; every organisation seen in guests, shared files and mail is one data-side. Across eleven regulations - DORA next to NIS2, GDPR, ISO/IEC 27001 and the EU AI Act - the obligations collapse into 15 shared requirements, 11 of them measurable directly from tenant data, so the register slice can be live rather than remembered.
The incident pillar runs on a clock: an initial notification, an intermediate report and a final report, each resting on facts most teams spend the deadline reconstructing from 90-day logs and disconnected admin centers. In 1Security the incident is one object from the moment it is detected - the episode with its severity and the other detections on the same account, the attributed activity behind it with the addresses, providers and countries that become indicators of compromise, the containment actions taken, and a History & Comments trail written as the work happens. The Incident record is generated from that same detection, so the initial notification is written from a document rather than from memory, and the intermediate and final reports start from its text.
The walkthrough
From supervisory letter to evidence pack, on screens.
Each beat is a screen with a filter and an artifact at the end, not a workshop.
- 01
Open the DORA framework view
The Compliance screen scores the tenant against DORA article by article, each article citing the shared requirements that satisfy it - measured statuses for log retention, access control, dormant accounts and the third-party inventories, attested statuses for the four documents. Where you know the whole picture differs - devices managed in another tool, say - you record your own assessment with a note, and the measured status stays visible beside it. Not evaluated is never counted as a pass, and the worklist orders every open requirement by how many articles it unlocks.
- 02
Build the register slice from what is observed
The Apps screen lists every OAuth app and integration with publisher, access channel and the admin who consented it - the software half of the register of information. The Domains screen lists every external organisation observed in guests, shared files and mail, resolved to the company behind the domain, with configured standing next to observed activity and drift flagged.
- 03
Drill the incident report before it is real
Open any detection on the Anomalies screen and read what the supervisor will ask about: the activity in the incident window attributed to actor, resource, app, device and location, the Locations verdict on whether the access was real and where it came from, the Respond actions that contained it, and every status change and comment on the History & Comments tab. Press Report and the Incident record comes out of the same drawer in PDF, PowerPoint, HTML, CSV or JSON, in seven languages - the facts, indicators, response and history that the initial, intermediate and final DORA notifications are written from. With up to three years of retained history on standard licenses, the drill takes one sitting.
- 04
Export the dated evidence
The whole status document is captured automatically every Monday and on demand, so what was our status on this date has a real answer. The per-framework evidence pack exports as a dated document and is served over the read-only REST API - the same artifact for the supervisor, the auditor and the board.
The building blocks
One read-only connection. The whole Microsoft 365 stack.
Every block is a screen your team opens on the first day. Each one answers a question about your own tenant that nothing in the admin centres answers today.
Locations
Where every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
Locations
Where every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
What it takes
Business Premium is enough. No agents, no migration, no E5 to start.
1Security reads the tenant you already run, with your own licences and your own permission model, through a read-only consent that takes minutes. There is nothing to install and nothing to migrate: it sits beside Entra, Purview, Defender and your SIEM and answers the questions that sit between them.
Activity history is kept for up to three years in the licence price, on any tier, so an investigation or an audit has the record behind it without a retention add-on.
It is also the cheaper route. Most organisations buy their way to the controls they need with the top Microsoft tier. With 1Security on the standard tier they get there for about a quarter less, with more of the work done, on a licence they already pay for.
- Business Premium is enough
- No E5 requirement
- Read-only consent
- 3 years of logs in the price
- About 25% less than the licence route
- Our cloud, your cloud, on premise
What makes it work
Three parts of the platform behind the DORA answer.
The same 15 requirements score NIS2, GDPR, ISO/IEC 27001 and the EU AI Act in the same pass - one fix moves every framework that cites it.
Compliance monitoring
Eleven frameworks measured continuously from tenant data, with snapshots, a worklist and a per-framework evidence pack.
Explore the feature →External domain monitoring
Every organisation the tenant exchanges data with, resolved to a real company with drift flags - the data-side half of the register.
Explore the feature →App governance
Every third-party app and consent with publisher, reach and the person who let it in - the software-side half of the register.
Explore the feature →
Microsoft Innovation Alley
Recommended by Microsoft’s own innovation programme.
Microsoft’s Innovation Alley partners with 1Security and recommends it to the ecosystem, which answers the question a security project raises first: whether a vendor can be trusted read-only inside the tenant that holds your data.
Bring it to the steering meeting. It answers the trust question before it is asked.
FAQ
Common questions.
We are a small firm. Does DORA really apply to us?
DORA scales its demands - microenterprises are carved out of much of it and some small firms get a simplified risk framework - but the scoping call belongs to your counsel. The practical point stands either way: the register, the access control and the incident evidence DORA asks for are things a financial firm wants measured regardless of where the proportionality line falls.
Does this cover our core banking or trading systems?
No. We measure the Microsoft 365 side: identities, files, mail, apps, agents and the audit trail around them. Core platforms need their own evidence sources. What the tenant holds is the collaboration half of the register of information and a large share of the incident evidence, and the evidence pack is honest about that boundary.
Is Microsoft itself a critical ICT provider under DORA?
DORA gives European supervisors an oversight framework that designates critical ICT third-party providers, and large cloud providers are the category it was written for. Designation changes the obligations of Microsoft, not yours: your register entry, contractual provisions and exit thinking for the Microsoft 365 arrangement stay your responsibility either way.
When the supervisor asks when we became aware, what do we show?
A timestamped record rather than a recollection. The notification log on the Alerting screen keeps every decision the platform made - sent, withheld with its reason, or failed - for as long as your activity history, up to three years. The detection's History & Comments tab shows every status change, severity verdict, response action and comment with who did it and when, and each generated report lands there too, with its template, stage and format. Together they answer when you knew, what you did and when the notification left.
Do we need E5 licenses for this?
No. The readiness measurement, the retained history and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
How fast do we get the first readiness picture?
The same day the tenant is connected read-only. Readiness is computed from data the platform collects on its own, with deliberately conservative statuses - not evaluated never counts as a pass - so the first picture is one you can already show internally, and weekly snapshots start accumulating from there.
The 1Security platform
DORA Compliance is just the beginning
DORA Compliance is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Meet the supervisor with the register already live.
Connect read-only and the DORA requirement statuses, the app and domain inventories and the first evidence pack land the same day - before you have remediated anything at all.
Or keep compiling the register of information once a year.