Azure compliance architecture: SOC 2, HIPAA, ISO 27001, Loi 25

The four questions every framework asks

SOC 2, HIPAA, ISO 27001, Loi 25, GDPR and the French HDS referential were written by different bodies, in different languages, for different reasons. Read them against a running Azure estate and four questions repeat.

Where is the regulated data, exactly? Not “in the platform”. Which subscription, which resource, which region, which backup, which Log Analytics workspace, which export somebody made into a storage account in 2023 and never deleted.

Who can reach it, and how do you know? Standing administrative access is the most common finding across every framework and every auditor. It is also the cheapest to fix.

What changed, who approved it, and when? Change control is a property of how you deploy. If it is a form somebody fills in afterwards, it fails the moment the deadline is tight.

How would you notice, and how fast? Reporting clocks differ (72 hours to a supervisory authority under GDPR, promptly under Loi 25, 60 days under the HIPAA breach notification rule) but every one of them assumes you detected the incident at all.

Answer those four in the architecture and the framework-specific work shrinks to a short list. That short list is what the five pages below are about.

One control substrate, five control sets

We build the same foundation regardless of which framework is driving the budget, because the overlap is large and the duplication is expensive.

Management group hierarchy and Azure Policy. Region restriction, mandatory diagnostic settings, denied public network access on data services, required tags. Assigned at the management group so every future subscription inherits it.
Entra ID as the control point. Conditional Access, Privileged Identity Management so administrative access is requested and time-bound rather than held, scheduled access reviews, and workload identities with federated credentials instead of secrets in a pipeline variable.
Network segmentation. Hub-and-spoke, private endpoints on storage, databases and Key Vault, private DNS zones, and no public path to regulated data.
Logging with a stated retention. Diagnostic settings routed to Log Analytics, retention set to the number the framework actually requires, and archive beyond it.
Change as code. Terraform or Bicep in a repository with branch protection, required reviewers and deployment history. Every infrastructure change carries an author, a reviewer, a test result and a timestamp before it exists in production.
Classification before protection. Microsoft Purview for cataloguing, sensitivity labels and DLP, because a control applied to data nobody has located is decoration.

What changes between frameworks is narrower than most vendors imply: the region rule, the retention period, the evidence format, the wording of the risk assessment, and which service selection is permitted. That is the work described on each page.

The five frameworks

SOC 2. A customer-driven report, not a certificate. The trust services criteria that consume real effort are logical access, change management and monitoring, and all three are architecture. The observation window records how the system behaved, so the system has to behave correctly without anyone remembering to make it.

HIPAA. No certificate exists. The Security Rule sets required and addressable implementation specifications, Microsoft signs a business associate agreement covering in-scope services, and everything after that depends on how PHI is segmented, encrypted, logged and reached. Service selection becomes a compliance decision.

ISO 27001. A management system standard with an annex of 93 controls. The certificate covers the ISMS, and the architecture supplies the technological theme plus the evidence for most of the organizational one. We map to your statement of applicability rather than replacing it.

Loi 25. Quebec’s private sector privacy law, with real administrative monetary penalties and a regulator that publishes decisions. The architectural obligations are specific: know where personal information lives, justify any communication outside Quebec with an assessment, be able to produce, correct and delete an individual’s information, keep an incident register, and detect the incident in the first place.

GDPR and HDS. European residency, transfer boundaries you can defend in writing, records of processing supported by a real data inventory, and the French health data hosting referential where clinical data is involved. Hosting on a certified provider does not make your platform certified, and knowing which activities you actually perform is the first question.

Evidence: exported, not assembled

The recurring cost of compliance is not the controls. It is the six weeks somebody spends every year rebuilding proof that the controls were operating. We build the evidence layer as part of the architecture:

Azure Policy compliance state, per assignment, exportable per control.
Defender for Cloud regulatory compliance dashboards mapped to the framework in scope.
PIM activation history, access review outcomes and Conditional Access sign-in data.
Pull request and deployment history as the change management record.
Log Analytics queries written once, against a schema that will still exist next year.
Backup and restore test results, because availability criteria are tested, not asserted.

What we do, and what we will not claim

We design architecture and build it as code. We are a Microsoft AI Cloud Partner, an Azure Solutions Partner and a direct CSP, and our security architecture is led by architects certified in information security management. We are not auditors, we do not issue certificates, and we hold no certification that would let us assess yours. Any firm offering to both remediate and certify is selling you a conflict of interest.

We also say when a deadline is not achievable. If you need a SOC 2 Type II report next quarter and the estate has no policy set, no identity model and no pipeline, the honest answer is that the observation window cannot start yet.

Where this work sits

The compliance cluster is the framework detail. The engagement that delivers it is compliance architecture, and the foundation it is enforced on is the Azure landing zone. If the regulated data is clinical, healthcare covers the sector-specific version of the same problem.

Questions we get

Do you certify or audit us?

No. SOC 2 reports are issued by licensed CPA firms, ISO 27001 certificates by accredited certification bodies, and HDS certificates by COFRAC-accredited auditors. We design and build the architecture those parties examine, and we produce the evidence they ask for. Being both the builder and the auditor would make the report worthless.

We are facing three frameworks at once. Do we do three projects?

No. Access control, change control, logging, retention and region enforcement are shared across all of them. We build that substrate once, then map it to each control set separately. The second framework typically costs a fraction of the first, mostly in mapping and evidence formatting rather than in new engineering.

How long does this take?

For an organization already on Azure with a reasonably clean estate, six to twelve weeks of architecture work before an observation window or a certification audit is realistic. Unmanaged identity and informal change control are what extend it, not encryption or firewalls.

Which framework should we start with?

Usually the one a customer or a regulator is holding you to. If nothing external is forcing the order, start with the one whose scope is narrowest, get the substrate built, then extend. Starting with ISO 27001 because it feels comprehensive is a common and expensive mistake for a small team.

Does the compliance work slow down delivery?

It changes where the friction sits. Policy denies a non-conforming deployment in seconds instead of a security review catching it three weeks before go-live. Teams that have been through it usually ship faster afterwards, because the guardrails remove the question of whether a given change is allowed.