DORA compliance Microsoft 365
Is Microsoft 365 in your DORA register? And the 200 apps plugged into it?
DORA (EU 2022/2554) has applied to financial entities since 17 January 2025, and its third-party pillar asks for a register of information covering every ICT arrangement that touches your data. Microsoft 365 is one of them - and so is every OAuth app consented into it and every external organisation it exchanges data with. 1Security measures DORA readiness from the tenant itself: requirement statuses per article, the register slice kept live instead of compiled annually, and a dated evidence pack for the competent authority.
The scenario
The regulator asks for the register. It was compiled last year.
DORA covers some twenty types of financial entities - banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers - and stands on five pillars: ICT risk management, incident reporting on a fixed initial, intermediate and final cadence, resilience testing, ICT third-party risk, and information sharing. Enforcement runs through national competent authorities, and the critical ICT providers it places under direct oversight can face periodic penalty payments of up to 1% of average daily worldwide turnover. The first thing a supervisor asks for is not a policy. It is the register of information, current.
Here is the part the annual-spreadsheet approach misses: most of the register is already observable. Articles 28 to 30 want every ICT arrangement listed with what it touches - and inside Microsoft 365 that answer is the app inventory and the external-domain map. Every OAuth app with its publisher, reach and the admin who consented it is an ICT service software-side; every organisation seen in guests, shared files and mail is one data-side. Across eleven regulations - DORA next to NIS2, GDPR, ISO/IEC 27001 and the EU AI Act - the obligations collapse into 15 shared requirements, 11 of them measurable directly from tenant data, so the register slice can be live rather than remembered.
The incident pillar runs on a clock: an initial notification, an intermediate report and a final report, each resting on facts most teams spend the deadline reconstructing from 90-day logs and disconnected admin centers. In 1Security the incident is one object from the moment it is detected - the episode with its severity and the other detections on the same account, the attributed activity behind it with the addresses, providers and countries that become indicators of compromise, the containment actions taken, and a History & Comments trail written as the work happens. The Incident record is generated from that same detection, so the initial notification is written from a document rather than from memory, and the intermediate and final reports start from its text.
The walkthrough
From supervisory letter to evidence pack, on screens.
Each beat is a screen with a filter and an artifact at the end, not a workshop.
- 01
Open the DORA framework view
The Compliance screen scores the tenant against DORA article by article, each article citing the shared requirements that satisfy it - measured statuses for log retention, access control, dormant accounts and the third-party inventories, attested statuses for the four documents. Where you know the whole picture differs - devices managed in another tool, say - you record your own assessment with a note, and the measured status stays visible beside it. Not evaluated is never counted as a pass, and the worklist orders every open requirement by how many articles it unlocks.
- 02
Build the register slice from what is observed
The Apps screen lists every OAuth app and integration with publisher, access channel and the admin who consented it - the software half of the register of information. The Domains screen lists every external organisation observed in guests, shared files and mail, resolved to the company behind the domain, with configured standing next to observed activity and drift flagged.
- 03
Drill the incident report before it is real
Open any detection on the Anomalies screen and read what the supervisor will ask about: the activity in the incident window attributed to actor, resource, app, device and location, the Locations verdict on whether the access was real and where it came from, the Respond actions that contained it, and every status change and comment on the History & Comments tab. Press Report and the Incident record comes out of the same drawer in PDF, PowerPoint, HTML, CSV or JSON, in seven languages - the facts, indicators, response and history that the initial, intermediate and final DORA notifications are written from. With up to three years of retained history on standard licenses, the drill takes one sitting.
- 04
Export the dated evidence
The whole status document is captured automatically every Monday and on demand, so what was our status on this date has a real answer. The per-framework evidence pack exports as a dated document and is served over the read-only REST API - the same artifact for the supervisor, the auditor and the board.
Будівельні блоки
Одне підключення лише для читання. Увесь стек Microsoft 365.
Кожен блок - це екран, який ваша команда відкриває в перший день. Кожен відповідає на запитання про власний тенант, на яке сьогодні ніщо в центрах адміністрування не відповідає.
Місцеположення
Звідки насправді надходить кожен вхід і кожна дія, на карті, по кожному тенанту. Порушення за місцеположенням, неможливі переміщення, списки дозволених по кожній людині. Працює без преміальних журналів входу.
Місцеположення
Звідки насправді надходить кожен вхід і кожна дія, на карті, по кожному тенанту. Порушення за місцеположенням, неможливі переміщення, списки дозволених по кожній людині. Працює без преміальних журналів входу.
Що для цього потрібно
Business Premium достатньо. Без агентів, без міграції, без E5 для старту.
1Security читає тенант, у якому ви вже працюєте, з вашими ліцензіями та вашою моделлю дозволів, за згодою лише на читання, яка займає хвилини. Нічого встановлювати і нічого мігрувати: він стоїть поруч із Entra, Purview, Defender та вашим SIEM і відповідає на запитання, які лежать між ними.
Історія активності зберігається до трьох років у ціні ліцензії, на будь-якому рівні, тож розслідування чи аудит мають запис без доповнення для зберігання.
Це ще й дешевший шлях. Більшість організацій купує потрібні контролі старшим рівнем Microsoft. З 1Security на стандартному рівні вони доходять туди приблизно на чверть дешевше, з більшою частиною виконаної роботи, на ліцензії, за яку вже платять.
- Business Premium достатньо
- Без вимоги E5
- Згода лише на читання
- 3 роки журналів у ціні
- Приблизно на 25% дешевше за ліцензійний шлях
- Наша хмара, ваша хмара, on-premise
What makes it work
Three parts of the platform behind the DORA answer.
The same 15 requirements score NIS2, GDPR, ISO/IEC 27001 and the EU AI Act in the same pass - one fix moves every framework that cites it.
Compliance monitoring
Eleven frameworks measured continuously from tenant data, with snapshots, a worklist and a per-framework evidence pack.
Explore the feature →External domain monitoring
Every organisation the tenant exchanges data with, resolved to a real company with drift flags - the data-side half of the register.
Explore the feature →App governance
Every third-party app and consent with publisher, reach and the person who let it in - the software-side half of the register.
Explore the feature →
Microsoft Innovation Alley
Рекомендовано власною інноваційною програмою Microsoft.
Microsoft Innovation Alley співпрацює з 1Security і рекомендує його екосистемі, що відповідає на питання, яке проєкт з безпеки ставить першим: чи можна довірити вендору доступ лише для читання в тенанті, де лежать ваші дані.
Візьміть це на керівний комітет. Це відповідає на питання про довіру до того, як його поставлять.
FAQ
Common questions.
We are a small firm. Does DORA really apply to us?
DORA scales its demands - microenterprises are carved out of much of it and some small firms get a simplified risk framework - but the scoping call belongs to your counsel. The practical point stands either way: the register, the access control and the incident evidence DORA asks for are things a financial firm wants measured regardless of where the proportionality line falls.
Does this cover our core banking or trading systems?
No. We measure the Microsoft 365 side: identities, files, mail, apps, agents and the audit trail around them. Core platforms need their own evidence sources. What the tenant holds is the collaboration half of the register of information and a large share of the incident evidence, and the evidence pack is honest about that boundary.
Is Microsoft itself a critical ICT provider under DORA?
DORA gives European supervisors an oversight framework that designates critical ICT third-party providers, and large cloud providers are the category it was written for. Designation changes the obligations of Microsoft, not yours: your register entry, contractual provisions and exit thinking for the Microsoft 365 arrangement stay your responsibility either way.
When the supervisor asks when we became aware, what do we show?
A timestamped record rather than a recollection. The notification log on the Alerting screen keeps every decision the platform made - sent, withheld with its reason, or failed - for as long as your activity history, up to three years. The detection's History & Comments tab shows every status change, severity verdict, response action and comment with who did it and when, and each generated report lands there too, with its template, stage and format. Together they answer when you knew, what you did and when the notification left.
Do we need E5 licenses for this?
No. The readiness measurement, the retained history and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
How fast do we get the first readiness picture?
The same day the tenant is connected read-only. Readiness is computed from data the platform collects on its own, with deliberately conservative statuses - not evaluated never counts as a pass - so the first picture is one you can already show internally, and weekly snapshots start accumulating from there.
Платформа 1Security
Відповідність DORA — це лише початок
Відповідність DORA — один екран платформи 1Security для Microsoft 365. Локації, пристрої, застосунки, ШІ-агенти, журнали, дозволи, чутливі дані, відповідність, звіти та дії працюють на тому самому підключенні лише для читання, на ліцензії, яку ви вже маєте.
- Файли, сайти та колонковий оглядачПереглядайте тенант як файлову систему: сайт, бібліотека, папка, файл, з дозволами та рівнем чутливості кожного рівня поруч. Проблема, розв'язана сама по собі.
- Користувачі, групи та життєвий циклНеактивні облікові записи, гості, які так і не пішли, групи з потрійною вкладеністю, осиротілі власники, адміністратори без MFA. Перевірка, яка всюди інде - таблиця.
- Зовнішні домениКожна стороння організація з точкою опори в тенанті, її довірчий статус, її дрейф і хто її запросив.
- Пошта та поштові скринькиХто може читати чию поштову скриньку, правила пересилання, листування з чутливим вмістом, вхідна та вихідна експозиція.
- ЛіцензіїЩо призначено, що не використовується і який пакет ще потрібен дії чи функції, щоб апгрейд, який ви продаєте, був тим, що потрібен замовнику.
- Оцінка безпекиОцінка, її історія, контролі за нею та орієнтири, щоб цифра у звіті для правління щось означала.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- Усі функціїПереглянути все
Meet the supervisor with the register already live.
Connect read-only and the DORA requirement statuses, the app and domain inventories and the first evidence pack land the same day - before you have remediated anything at all.
Or keep compiling the register of information once a year.