SOC 2 · Microsoft 365
Close failing SOC 2 access tests in Microsoft 365
Deixic reads your Microsoft 365 users and groups, finds access that fails a test, and sends the exact change to your admin with the evidence attached.
Tests Deixic works on in Microsoft 365
Criteria touched: CC6.1 Logical access, including MFA, CC6.2 Provisioning and deprovisioning, CC6.3 Access modification and least privilege.
Failing testWhat Deixic doesCriterion
Offboarding revokes accessReads the user list, matches it to your HR terminations, and flags every account still enabled after the termination date.CC6.2
Admin roles limited to named peopleReads group membership and lists privileged groups against the people your policy names.CC6.3
MFA enforced for all usersReads each account and sends the accounts without MFA to your admin as one decision with the settings to change.CC6.1
What runs, what waits, what is yours
Deixic classifies every Microsoft 365 action before it runs.
Runs within policy
- Read users and groups
- Match accounts to HR records and open a work item for each mismatch
Waits for a named approver
- Any change an approver authorizes in Microsoft 365, with the approver and reason recorded
Sent to you as a decision
- Every Microsoft 365 setting change, sent to your admin with the before state and the target state.
- Deleting a user or mailbox.
Read back and evidence
Each change is read back from Microsoft 365, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The user list and enabled state after your admin makes the change
- Privileged group membership after a removal
Your auditor gets
- The user and group snapshot the test was judged against
- The HR termination record matched to each account
- Your admin's decision and the read-back that closed it