The direct answer
Microsoft Fabric is covered by ISO/IEC 27001, 27017, 27018 and 27701 certifications and a HIPAA BAA (Microsoft Learn, accessed 2026-10-27). Microsoft Purview is covered through the Microsoft cloud audits that name it, including Office 365 ISO/IEC 27001 and Azure FedRAMP High. GDPR is not a certificate: Microsoft meets it through processor commitments in its contracts. Each of these attests to Microsoft’s platform, not to how your tenant is configured.
What Microsoft Learn says, by framework
| Framework | Microsoft Fabric and Power BI | Microsoft Purview |
|---|---|---|
| ISO/IEC 27001 | Fabric certified; Power BI and Power BI Embedded listed in scope | Purview portal listed in Office 365 scope (commercial, GCC, GCC High, DoD) |
| ISO/IEC 27017, 27018, 27701 | Fabric certified | Not stated on the Learn pages cited here |
| SOC 2 Type 2 | Power BI listed in scope on the Learn SOC 2 page; Fabric’s SOC 1 Type II, SOC 2 Type II and SOC 3 compliance announced on the Fabric Updates blog (confirm the current report on the Service Trust Portal) | Purview portal listed in Office 365 GCC, GCC High and DoD scope |
| FedRAMP High and DoD IL2 (Azure) | Fabric, Power BI and Power BI Embedded in scope | Purview (Data Map, Data Estate Insights, governance portal) in scope |
| HIPAA | Fabric has a HIPAA BAA | Not stated on the Learn pages cited here |
| GDPR | A regulation, not a certificate; Microsoft is processor, the customer is controller | |
Sources: Fabric governance and compliance overview, ISO/IEC 27001 and SOC 2 Type 2 compliance offerings, the FedRAMP and DoD audit scope list (last updated February 2026) and the GDPR overview on Microsoft Learn (accessed 2026-10-27). For the full in-scope service lists, Microsoft points to Appendices A and B of the Microsoft Azure Compliance Offerings document on the Service Trust Portal (Microsoft Learn, accessed 2026-10-27).
ISO/IEC 27001 and the ISO privacy and cloud standards
Microsoft’s Fabric governance and compliance article states that Microsoft Fabric has HIPAA BAA, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27001 and ISO/IEC 27701 compliance certifications (Microsoft Learn, accessed 2026-10-27). Microsoft also states that Office 365 cloud services are reviewed by auditors at least annually against ISO 27001, and its Office 365 in-scope list includes Power BI, Compliance Manager and the Microsoft Purview portal (Microsoft Learn, accessed 2026-10-27).
SOC 2 Type 2
SOC 2 Type 2 reports are attestations by an independent AICPA-accredited CPA firm covering security, availability, processing integrity, confidentiality and privacy (Microsoft Learn, accessed 2026-10-27). For Office 365, Microsoft examines a rolling 12-month period from October 1 to September 30 and issues quarterly bridge letters between reports (Microsoft Learn, accessed 2026-10-27). The SOC 2 offering page lists Power BI in scope; it does not name Microsoft Fabric, so confirm Fabric coverage in the current report on the Service Trust Portal before you rely on it.
GDPR: commitments, not a certificate
Microsoft acts as a data processor, processing personal data on behalf of the customer as controller under its Product Terms and Data Protection Addendum (Microsoft Learn, accessed 2026-10-27). Its GDPR Terms reflect the processor commitments in Article 28, and controllers remain responsible for assessing privacy risk, responding to data subject requests and preparing data protection impact assessments (Microsoft Learn, accessed 2026-10-27). Microsoft Purview Compliance Manager has a prebuilt GDPR assessment for Enterprise E5 customers to track your side of the work (Microsoft Learn, accessed 2026-10-27).
Shared responsibility: what the certificate does not cover
A Microsoft certificate covers Microsoft’s platform. Microsoft says you can use its certifications in your own assessment, but you are responsible for engaging an assessor to evaluate your own controls, processes and implementation, and that your organization is wholly responsible for compliance with applicable laws and regulations (Microsoft Learn, accessed 2026-10-27). In Fabric, the controls you configure include workspace roles, row-level and object-level security, and Microsoft Purview sensitivity labels, data loss prevention and audit, some of which require additional Purview licensing (Microsoft Learn, accessed 2026-10-27).
How to get Microsoft’s audit reports
- Go to the Service Trust Portal. Microsoft describes it as its public site for publishing audit reports and other compliance information for its cloud services (Microsoft Learn, accessed 2026-10-27).
- Sign in. Use a Microsoft Entra organization account with a Microsoft 365, Dynamics 365 or Azure subscription, trial or paid (Microsoft Learn, accessed 2026-10-27).
- Accept the NDA. Some resources require accepting the Microsoft Non-Disclosure Agreement for Compliance Materials (Microsoft Learn, accessed 2026-10-27).
- Filter by framework and cloud service. Open the ISO/IEC, SOC or GDPR section and filter documents by cloud service (Microsoft Learn, accessed 2026-10-27).
Where EPC Group fits
EPC Group does not hold or resell Microsoft’s attestations. It configures the customer side in Fabric and Microsoft Purview, such as workspace access, sensitivity labels, data loss prevention and audit, and maps that configuration to the framework your auditor uses. See data governance services, Microsoft Fabric consulting and the Microsoft Purview implementation answer.
Primary sources
- Governance and compliance in Microsoft Fabric — Microsoft Learn, accessed 2026-10-27
- Security in Microsoft Fabric — Microsoft Learn, accessed 2026-10-27
- ISO/IEC 27001 Information Security Management Standards — Microsoft Learn, accessed 2026-10-27
- ISO/IEC 27001 - Azure Compliance — Microsoft Learn, accessed 2026-10-27
- System and Organization Controls (SOC) 2 Type 2 — Microsoft Learn, accessed 2026-10-27
- Azure and other Microsoft cloud services in compliance audit scope — Microsoft Learn, accessed 2026-10-27
- Azure and other Microsoft cloud services compliance scope (FedRAMP and DoD) — Microsoft Learn, accessed 2026-10-27
- General Data Protection Regulation — Microsoft Learn, accessed 2026-10-27
- Get started with the Microsoft Service Trust Portal — Microsoft Learn, accessed 2026-10-27
Frequently Asked Questions
Is Microsoft Fabric ISO 27001 certified?
Yes. Microsoft states that Microsoft Fabric has ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701 compliance certifications, plus a HIPAA BAA (Microsoft Learn, accessed 2026-10-27). Power BI, as a standalone service or included in an Office 365 plan, is also listed in scope for Microsoft’s ISO/IEC 27001 certification (Microsoft Learn, accessed 2026-10-27).
Is Microsoft Fabric covered by a SOC 2 report?
Microsoft Learn’s SOC 2 Type 2 page lists Power BI among the in-scope services but does not name Microsoft Fabric on that page (Microsoft Learn, accessed 2026-10-27). Microsoft’s Fabric team has separately announced that Fabric is compliant with SOC 1 Type II, SOC 2 Type II and SOC 3 (Microsoft Fabric Updates blog, “Microsoft Fabric is compliant with SOC certifications”). Microsoft points to the Azure compliance offerings document on the Service Trust Portal for the detailed list of services in scope for each SOC and ISO audit, so check the current report there before you cite SOC 2 coverage for a specific Fabric workload (Microsoft Learn, accessed 2026-10-27).
Is Microsoft Purview covered by Microsoft’s compliance certifications?
Microsoft lists the Microsoft Purview portal among the in-scope services for its Office 365 ISO/IEC 27001 certification in the commercial, GCC, GCC High and DoD environments (Microsoft Learn, accessed 2026-10-27). Microsoft Purview, including Data Map, Data Estate Insights and the governance portal, is in scope for FedRAMP High and DoD IL2 in Azure, and for FedRAMP High, DoD IL2 and DoD IL4 in Azure Government (Microsoft Learn, accessed 2026-10-27).
Does Microsoft’s certification make my Fabric deployment compliant?
No. Microsoft says you can use its certification in your own compliance assessment, but you are responsible for engaging an assessor to evaluate the controls and processes in your own organization and your implementation (Microsoft Learn, accessed 2026-10-27). SOC 2 reports also list user entity responsibilities, the controls you must operate for the system as a whole to meet the standard (Microsoft Learn, accessed 2026-10-27).
Is Microsoft Fabric GDPR compliant?
GDPR is a regulation, not an audit certificate. Microsoft acts as a data processor for customer data and makes the GDPR commitments required of processors in its Product Terms and Data Protection Addendum, while the customer, as controller, remains responsible for assessing privacy risk, answering data subject requests and notifying a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people’s rights and freedoms; Microsoft, as processor, must notify the controller without undue delay (GDPR Article 33(1) and (2); Microsoft Learn, accessed 2026-10-27).
Where do you download Microsoft’s ISO and SOC audit reports?
From the Microsoft Service Trust Portal, which Microsoft describes as its public site for publishing audit reports produced by external auditors (Microsoft Learn, accessed 2026-10-27). For some documents you sign in with a Microsoft Entra organization account under a Microsoft 365, Dynamics 365 or Azure subscription, trial or paid, and accept the Microsoft Non-Disclosure Agreement for Compliance Materials (Microsoft Learn, accessed 2026-10-27).
Talk to a senior architect
A one-hour scoping call with a senior EPC Group architect covers which frameworks your auditors expect, which Fabric and Purview controls sit on your side of the line, and what evidence to collect. Email contact@epcgroup.net or call 888-381-9725.
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- Microsoft Teams Cleanup and Governance: Manufacturer (2024)Anonymized engagement summary · Industrial manufacturer · 2024
- Dynamics 365 CRM Remediation: Professional AssociationAnonymized engagement summary · Professional association · 2021
- Power BI Governance Strategy: Global Insurer (2020)Anonymized engagement summary · Global insurer · 2020
- Power BI POC, Governance and Roadmap: Electronics (2020)Anonymized engagement summary · Global electronics manufacturer · 2020