DORA compliance Microsoft 365
Is Microsoft 365 in your DORA register? And the 200 apps plugged into it?
DORA (EU 2022/2554) has applied to financial entities since 17 January 2025, and its third-party pillar asks for a register of information covering every ICT arrangement that touches your data. Microsoft 365 is one of them - and so is every OAuth app consented into it and every external organisation it exchanges data with. 1Security measures DORA readiness from the tenant itself: requirement statuses per article, the register slice kept live instead of compiled annually, and a dated evidence pack for the competent authority.
The scenario
The regulator asks for the register. It was compiled last year.
DORA covers some twenty types of financial entities - banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers - and stands on five pillars: ICT risk management, incident reporting on a fixed initial, intermediate and final cadence, resilience testing, ICT third-party risk, and information sharing. Enforcement runs through national competent authorities, and the critical ICT providers it places under direct oversight can face periodic penalty payments of up to 1% of average daily worldwide turnover. The first thing a supervisor asks for is not a policy. It is the register of information, current.
Here is the part the annual-spreadsheet approach misses: most of the register is already observable. Articles 28 to 30 want every ICT arrangement listed with what it touches - and inside Microsoft 365 that answer is the app inventory and the external-domain map. Every OAuth app with its publisher, reach and the admin who consented it is an ICT service software-side; every organisation seen in guests, shared files and mail is one data-side. Across eleven regulations - DORA next to NIS2, GDPR, ISO/IEC 27001 and the EU AI Act - the obligations collapse into 15 shared requirements, 11 of them measurable directly from tenant data, so the register slice can be live rather than remembered.
The incident pillar runs on a clock: an initial notification, an intermediate report and a final report, each resting on facts most teams spend the deadline reconstructing from 90-day logs and disconnected admin centers. In 1Security the incident is one object from the moment it is detected - the episode with its severity and the other detections on the same account, the attributed activity behind it with the addresses, providers and countries that become indicators of compromise, the containment actions taken, and a History & Comments trail written as the work happens. The Incident record is generated from that same detection, so the initial notification is written from a document rather than from memory, and the intermediate and final reports start from its text.
The walkthrough
From supervisory letter to evidence pack, on screens.
Each beat is a screen with a filter and an artifact at the end, not a workshop.
- 01
Open the DORA framework view
The Compliance screen scores the tenant against DORA article by article, each article citing the shared requirements that satisfy it - measured statuses for log retention, access control, dormant accounts and the third-party inventories, attested statuses for the four documents. Where you know the whole picture differs - devices managed in another tool, say - you record your own assessment with a note, and the measured status stays visible beside it. Not evaluated is never counted as a pass, and the worklist orders every open requirement by how many articles it unlocks.
- 02
Build the register slice from what is observed
The Apps screen lists every OAuth app and integration with publisher, access channel and the admin who consented it - the software half of the register of information. The Domains screen lists every external organisation observed in guests, shared files and mail, resolved to the company behind the domain, with configured standing next to observed activity and drift flagged.
- 03
Drill the incident report before it is real
Open any detection on the Anomalies screen and read what the supervisor will ask about: the activity in the incident window attributed to actor, resource, app, device and location, the Locations verdict on whether the access was real and where it came from, the Respond actions that contained it, and every status change and comment on the History & Comments tab. Press Report and the Incident record comes out of the same drawer in PDF, PowerPoint, HTML, CSV or JSON, in seven languages - the facts, indicators, response and history that the initial, intermediate and final DORA notifications are written from. With up to three years of retained history on standard licenses, the drill takes one sitting.
- 04
Export the dated evidence
The whole status document is captured automatically every Monday and on demand, so what was our status on this date has a real answer. The per-framework evidence pack exports as a dated document and is served over the read-only REST API - the same artifact for the supervisor, the auditor and the board.
Строительные блоки
Одно подключение только для чтения. Весь стек Microsoft 365.
Каждый блок - это экран, который ваша команда открывает в первый день. Каждый отвечает на вопрос о собственном тенанте, на который сегодня ничего в центрах администрирования не отвечает.
Местоположения
Откуда на самом деле приходит каждый вход и каждое действие, на карте, по каждому тенанту. Нарушения по местоположению, невозможные перемещения, списки разрешённых по каждому человеку. Работает без премиальных журналов входа.
Местоположения
Откуда на самом деле приходит каждый вход и каждое действие, на карте, по каждому тенанту. Нарушения по местоположению, невозможные перемещения, списки разрешённых по каждому человеку. Работает без премиальных журналов входа.
Что для этого нужно
Business Premium достаточно. Без агентов, без миграции, без E5 для старта.
1Security читает тенант, в котором вы уже работаете, с вашими лицензиями и вашей моделью разрешений, по согласию только на чтение, которое занимает минуты. Нечего устанавливать и нечего мигрировать: он стоит рядом с Entra, Purview, Defender и вашим SIEM и отвечает на вопросы, которые лежат между ними.
История активности хранится до трёх лет в цене лицензии, на любом уровне, так что у расследования или аудита есть запись без дополнения для хранения.
Это ещё и более дешёвый путь. Большинство организаций покупает нужные контроли старшим уровнем Microsoft. С 1Security на стандартном уровне они приходят к тому же примерно на четверть дешевле, с большей частью выполненной работы, на лицензии, за которую уже платят.
- Business Premium достаточно
- Без требования E5
- Согласие только на чтение
- 3 года журналов в цене
- Примерно на 25% дешевле лицензионного пути
- Наше облако, ваше облако, on-premise
What makes it work
Three parts of the platform behind the DORA answer.
The same 15 requirements score NIS2, GDPR, ISO/IEC 27001 and the EU AI Act in the same pass - one fix moves every framework that cites it.
Compliance monitoring
Eleven frameworks measured continuously from tenant data, with snapshots, a worklist and a per-framework evidence pack.
Explore the feature →External domain monitoring
Every organisation the tenant exchanges data with, resolved to a real company with drift flags - the data-side half of the register.
Explore the feature →App governance
Every third-party app and consent with publisher, reach and the person who let it in - the software-side half of the register.
Explore the feature →
Microsoft Innovation Alley
Рекомендовано собственной инновационной программой Microsoft.
Microsoft Innovation Alley сотрудничает с 1Security и рекомендует его экосистеме, что отвечает на вопрос, который проект по безопасности ставит первым: можно ли доверить вендору доступ только для чтения в тенанте, где лежат ваши данные.
Возьмите это на управляющий комитет. Это отвечает на вопрос о доверии до того, как его зададут.
FAQ
Common questions.
We are a small firm. Does DORA really apply to us?
DORA scales its demands - microenterprises are carved out of much of it and some small firms get a simplified risk framework - but the scoping call belongs to your counsel. The practical point stands either way: the register, the access control and the incident evidence DORA asks for are things a financial firm wants measured regardless of where the proportionality line falls.
Does this cover our core banking or trading systems?
No. We measure the Microsoft 365 side: identities, files, mail, apps, agents and the audit trail around them. Core platforms need their own evidence sources. What the tenant holds is the collaboration half of the register of information and a large share of the incident evidence, and the evidence pack is honest about that boundary.
Is Microsoft itself a critical ICT provider under DORA?
DORA gives European supervisors an oversight framework that designates critical ICT third-party providers, and large cloud providers are the category it was written for. Designation changes the obligations of Microsoft, not yours: your register entry, contractual provisions and exit thinking for the Microsoft 365 arrangement stay your responsibility either way.
When the supervisor asks when we became aware, what do we show?
A timestamped record rather than a recollection. The notification log on the Alerting screen keeps every decision the platform made - sent, withheld with its reason, or failed - for as long as your activity history, up to three years. The detection's History & Comments tab shows every status change, severity verdict, response action and comment with who did it and when, and each generated report lands there too, with its template, stage and format. Together they answer when you knew, what you did and when the notification left.
Do we need E5 licenses for this?
No. The readiness measurement, the retained history and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
How fast do we get the first readiness picture?
The same day the tenant is connected read-only. Readiness is computed from data the platform collects on its own, with deliberately conservative statuses - not evaluated never counts as a pass - so the first picture is one you can already show internally, and weekly snapshots start accumulating from there.
Платформа 1Security
Соответствие DORA — это только начало
Соответствие DORA — один экран платформы 1Security для Microsoft 365. Локации, устройства, приложения, ИИ-агенты, журналы, разрешения, чувствительные данные, соответствие, отчёты и действия работают на том же подключении только для чтения, на лицензии, которая у вас уже есть.
- Файлы, сайты и колоночный обозревательПросматривайте тенант как файловую систему: сайт, библиотека, папка, файл, с разрешениями и уровнем чувствительности каждого уровня рядом. Проблема, решённая сама по себе.
- Пользователи, группы и жизненный циклНеактивные учётные записи, гости, которые так и не ушли, группы с тройной вложенностью, осиротевшие владельцы, администраторы без MFA. Проверка, которая везде остальном - таблица.
- Внешние доменыКаждая сторонняя организация с точкой опоры в тенанте, её доверительный статус, её дрейф и кто её пригласил.
- Почта и почтовые ящикиКто может читать чей почтовый ящик, правила пересылки, переписки с чувствительным содержимым, входящая и исходящая экспозиция.
- ЛицензииЧто назначено, что не используется и какой пакет всё ещё нужен действию или функции, чтобы апгрейд, который вы продаёте, был тем, который нужен заказчику.
- Оценка безопасностиОценка, её история, стоящие за ней контроли и ориентиры, чтобы цифра в отчёте для правления что-то значила.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- Все функцииПосмотреть всё
Meet the supervisor with the register already live.
Connect read-only and the DORA requirement statuses, the app and domain inventories and the first evidence pack land the same day - before you have remediated anything at all.
Or keep compiling the register of information once a year.