Chapter 10: Azure Privacy and Compliance

In Chapter 9, Azure Governance, you learned about the skills that covered resource tags, resource locks, role-based access control (RBAC), Azure Policy, Azure Blueprints, and the Cloud Adoption Framework for Azure.

This chapter will outline the Microsoft core tenets of security, privacy, and compliance.

This chapter aims to provide coverage of the AZ-900 Azure Fundamentals Skills Measured section called Describe identity, governance, privacy, and compliance features.

By the end of this chapter, you will have learned the following skills:

• How to describe the Microsoft core tenets of security, privacy, and compliance.
• How to describe the purpose of the Trust Center, Microsoft Privacy Statement, the Product Terms site, Data Protection Addendum (DPA), Azure compliance documentation, and Azure Sovereign Regions (Azure Government cloud services and Azure China cloud services).

To support your learning with some practical...

Technical requirements

To carry out the hands-on exercise in this chapter, you will require the following:

• Access to an internet browser

Core security, privacy, and compliance tenets

As we learned in Chapter 1, Introduction to Cloud Computing, security is a shared responsibility model. This means that certain responsibilities transfer to the cloud provider in a cloud environment operating model, while other responsibilities are retained by the customer; you should understand when it is your responsibility to provide the appropriate level of security and control, and when it is not your responsibility but instead that of the cloud services provider to ensure that their platform is kept compliant and your data is kept private.

The following security model diagram visually sets out the division or separation of responsibilities between the consumer of the cloud resources and the cloud services provider itself:

Figure 10.1 – Shared responsibility model

The most critical responsibilities to be aware of are the responsibilities that you, as the consumer of cloud services, always retain and...

Trust Center

The Trust Center is a publicly accessible web portal that acts as a single point of focus for an organization that needs resources and in-depth information regarding the Microsoft principles of security, privacy, and compliance. The Trust Center can be accessed from https://www.microsoft.com/trust-center:

Figure 10.3 – Microsoft Trust Center

The Trust Center is a centralized place for any organization that needs information or resources on security, privacy, and compliance regarding Microsoft Online Services, not just Azure. The following section looks at the Microsoft Privacy Statement.

Microsoft Privacy Statement

The Microsoft Privacy Statement contains details about how each Microsoft service interacts with your data. It covers how this personal data is collected, the purpose it serves, and how it is used. The Microsoft Privacy Statement extends across all products and services, such as Windows, M365, Azure, and Xbox; across all operating environments such as the cloud and on-premises; and all markets such as commercial, academic, consumer, and so on.

The Microsoft Privacy Statement can be accessed from https://privacy.microsoft.com/privacystatement:

Figure 10.4 – Microsoft Privacy Statement

In this section, we looked at the Microsoft Privacy Statement and what information it contains. The following section will look at the Microsoft Product Terms site.

The Product Terms site

The Products Terms site is an online portal containing the legal agreement and licensing terms and conditions that an organization must comply with through Microsoft commercial licensing programs.

The site covers all products and services; that is, Software and Online Services; these were previously available as separate resources and have now been combined into a single unified online resource.

The Product Terms site can be accessed from https://www.microsoft.com/licensing/terms:

Figure 10.5 – Microsoft Product Terms site

In this section, we looked at the Product Terms site. The following section looks at the Data Protection Addendum.

Data Protection Addendum

The Data Protection Addendum (DPA) is an addendum to the Product Terms site we looked at in the previous section. It defines the data processing and security terms for any Online Services an organization subscribes to under the Product Terms site.

The current and archived versions of the addendum can be downloaded from the Product Terms site and can also be accessed from https://www.microsoftvolumelicensing.com/DocumentSearch.aspx:

Figure 10.6 – Data Protection Addendum

In this section, we looked at the DPA for subscribed Online Services. The following section looks at the Azure compliance documentation.

Azure compliance documentation

As its name suggests, the Azure compliance documentation is an online documentation site that provides detailed information and resources about legal, regulatory standards, as well as compliance an organization has on Azure. The documentation can be accessed at https://docs.microsoft.com/azure/compliance:

Figure 10.7 – Azure compliance documentation

In this section, we looked at the Azure compliance documentation. The following section looks at Azure Sovereign Regions.

Azure Sovereign Regions

Azure supports what is referred to as Sovereign Regions; these support greater compliance for specific markets. These regions, as shown in the following diagram, operate isolated instances of the Azure cloud computing platform that run dedicated hardware and isolated networks:

Figure 10.8 – Azure Sovereign Region cloud

As outlined here, the Sovereign Region platforms also have portals with different URLs and service endpoints in DNS:

• Azure Government: This is a separate instance of the Azure platform that Microsoft operates; it is for the sole use of US government bodies (and partners):
  • The Azure portal can be accessed via a dedicated URL: https://portal.azure.us.
  • The service endpoints to connect to in DNS are in the form of *.azurewebsites.us.
  • You can find more information at https://azure.microsoft.com/global-infrastructure/government.
• Azure China (21Vianet): This is a separate instance of the Azure platform operated...

Thought exercise

Returning to our online pizza company MilesBetter Pizza, they wish to know where they should look to determine whether they need to be compliant with regulatory standards such as Payment Card Industry Data Security Standard (PCI DSS) as they handle online transactions. They also don't want to fall foul of any Microsoft product terms for Online Services they have.

In addition, in preparation for an audit, they have been asked to provide evidence in the form of information on the compliance, security, and privacy statements from their cloud service provider of the data stored in Azure. The following diagram visualizes all the resources that are required that were covered in this chapter:

Figure 10.9 – Azure privacy and compliance resources

The following URLs will be required to explore, collate, and present the required audit information:

• Microsoft Trust Center Portal: https://www.microsoft.com/trust-center
• Microsoft...

Hands-on exercise

To support your learning with some practical skills, we will explore some of the resources and information covered in this chapter.

The following exercise will be carried out:

• Exercise – exploring Microsoft Trust Center Portal.

Getting started

To get started with this hands-on exercise, you will need the following:

• Access to an internet browser

Exercise – exploring Microsoft Trust Center Portal

This section will help you explore the Microsoft Trust Center Portal.

Task – accessing Microsoft Trust Center Portal

1. From a browser, navigate to https://www.microsoft.com/trust-center.

   Task – exploring the Trust Center Portal

2. The Trust Center Portal can be explored using the top navigation bar. The core navigation components to explore can be found in the Privacy, Compliance, and Tools & Documentation drop-down menus. In addition to this, from the Products and services navigation component...

Summary

This chapter covered some of the AZ-900 Azure Fundamentals exam skills area known as Describe identity, governance, privacy, and compliance features.

In this chapter, you learned about the various governance services in Azure, including the core tenets of security, privacy, and compliance. You also learned how to describe the purpose of the Microsoft Privacy Statement, the Product Terms site, DPA, Trust Center, Azure compliance documentation, and Azure Sovereign Regions (Azure Government cloud services and Azure China cloud services).

Additional information and study references

This section provides links to additional exam information and study references:

• Exam AZ-900: Microsoft Azure fundamentals: https://docs.microsoft.com/learn/certifications/exams/az-900
• Exam AZ-900: skills outline: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VwUY
• Microsoft Learn: Azure Fundamentals – Describe identity, governance, privacy, and compliance features: https://docs.microsoft.com/learn/paths/az-900-describe-identity-governance-privacy-compliance-features/

Skills check

Challenge yourself with what you have learned in this chapter:

1. What are the Microsoft trusted cloud principles?
2. What is the Trust Center?
3. What information is included in the Microsoft Privacy Statement?
4. What is the Product Terms site?
5. What does the DPA cover?
6. Where can you find detailed information on how to conform to regulatory standards such as PCI-DSS?
7. Explain Sovereign Regions.