Who validates what on the Microsoft cloud
Microsoft runs the platform and publishes audited controls for it; the regulated company decides how each system is used, validates that use and owns the records. Microsoft’s own words: “There’s no GxP certification for cloud service providers,” and customers “should determine the GxP requirements that apply to their computerized systems based on the intended use.” Microsoft’s GxP page lists Azure, Microsoft 365 and Dynamics 365 as in scope; it does not name Power BI or Microsoft Fabric separately, so confirm the current scope before you rely on it (Microsoft Learn, accessed 2026-10-28).
| Layer | Microsoft provides | The regulated company owns |
|---|---|---|
| Platform | Infrastructure, audited controls (SOC 1 Type 2, SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 27018 listed for Part 11 scope), qualification guidelines | Supplier assessment and the decision to rely on that evidence |
| Configuration | The settings and tools | The configured baseline, access model and change control |
| Intended use | — | Requirements, risk assessment, validation evidence and procedures |
| Records | Audit logging, retention and eDiscovery capabilities | Retention periods that match predicate rules, and review of audit trails |
What 21 CFR Part 11 and Annex 11 ask of each system
- Validation: “accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records” (21 CFR 11.10(a)); “The application should be validated; IT infrastructure should be qualified” (Annex 11, Principle).
- Access: “Limiting system access to authorized individuals” and authority checks (11.10(d), (g)).
- Audit trails: secure, computer-generated, time-stamped, not obscuring earlier entries, and kept at least as long as the records (11.10(e)); in the EU, built in based on a risk assessment and regularly reviewed (Annex 11 §9).
- Electronic signatures: printed name, date and time and meaning of the signature (11.50), linked to the record so they cannot be excised or copied (11.70), and unique to one person (11.100).
FDA’s 2003 Part 11 scope guidance still applies: FDA exercises enforcement discretion on some Part 11 provisions, but predicate rule requirements for validation, records and retention remain in force. The EU consulted on a revised Annex 11 and a new Annex 22 on artificial intelligence in 2025; until adoption, the January 2011 Annex 11 is the version in operation.
How it maps to Microsoft 365, Power BI, Fabric and Copilot
| Requirement | Microsoft capability to configure and validate |
|---|---|
| Access and authority checks | Microsoft Entra ID groups, Conditional Access and role assignments; SharePoint and Power BI workspace permissions |
| Audit trail | Microsoft Purview Audit; retention set by license and audit log retention policies (180 days default; one year for E5 users on Exchange, SharePoint, OneDrive and Entra; longer terms need the 10-Year add-on) |
| Change control for reports and models | Fabric Git integration for versioning and deployment pipelines for development, test and production stages (Power BI items are in preview there, so document that in your risk assessment) |
| Electronic signatures | A Part 11 e-signature tool such as Docusign Life Sciences Modules or Acrobat Sign with Bio-Pharma Settings, validated within your procedures |
| Generative AI | Copilot interactions logged in Purview Audit (Standard); prompts and responses held in the mailbox for eDiscovery and retention; Microsoft states prompts and responses aren’t used to train foundation models |
Risk-based assurance instead of screenshot binders
FDA’s final Computer Software Assurance guidance (February 3, 2026) defines assurance as “a risk-based approach for establishing and maintaining confidence that software is fit for its intended use.” It sorts features into high process risk and not high process risk, allows scripted testing where risk is high and unscripted methods such as scenario or exploratory testing elsewhere, and accepts vendor evidence such as SOC reports for some lower-risk features. It applies to medical device production and quality system software; EPC Group uses the same risk-based structure for other GxP systems only where the firm’s own quality system adopts it.
How an engagement runs
- Intended use and risk. Inventory each Microsoft workload, the GxP records it touches and its process risk.
- Supplier assessment. Assemble Microsoft’s audit reports and qualification guidance as platform evidence.
- Configuration baseline. Access, retention, audit and change-control settings documented and locked.
- Assurance. Test plans scaled to risk, executed and recorded with evidence.
- Operate. Periodic audit-trail review, change control and re-assessment when Microsoft changes a service.
Primary sources
- 21 CFR Part 11 — Electronic Records; Electronic Signatures — eCFR, accessed 2026-10-28
- Computer Software Assurance for Production and Quality Management System Software (final, Feb 3 2026) — FDA, accessed 2026-10-28
- Part 11, Electronic Records; Electronic Signatures — Scope and Application — FDA, accessed 2026-10-28
- EudraLex Volume 4 — EU GMP, including Annex 11 — European Commission, accessed 2026-10-28
- GxP — Microsoft compliance offering — Microsoft Learn, accessed 2026-10-28
- FDA CFR Title 21 Part 11 — Microsoft compliance offering — Microsoft Learn, accessed 2026-10-28
- Audit logs for Copilot and AI applications — Microsoft Learn, accessed 2026-10-28
This page is guidance, not legal or regulatory advice. Validation decisions belong to your quality unit and regulatory affairs team.
Frequently Asked Questions
Is Microsoft 365 or Azure GxP certified or 21 CFR Part 11 certified?
No. Microsoft states that there’s no GxP certification for cloud service providers and that no certification exists for complying with 21 CFR Part 11. Microsoft publishes qualification guidelines describing the responsibility it shares with customers, and customers determine the GxP requirements for each computerized system based on its intended use (Microsoft Learn, GxP and FDA 21 CFR Part 11 offerings, accessed 2026-10-28).
Who is responsible for validating SharePoint Online, Power BI or Copilot for GxP use?
The regulated company. Microsoft states that customers who build and deploy applications subject to FDA regulation are responsible for ensuring those applications meet FDA requirements. Microsoft’s audited controls, such as SOC 1 Type 2, SOC 2 Type 2 and ISO/IEC 27001 reports, are evidence you can use for the platform layer; your configuration, intended use and procedures are yours to validate (Microsoft Learn, accessed 2026-10-28).
What does 21 CFR Part 11 require of an electronic records system?
For closed systems, §11.10 requires controls including validation to ensure accuracy, reliability and consistent intended performance; limiting system access to authorized individuals; secure, computer-generated, time-stamped audit trails that do not obscure earlier entries and are kept as long as the records; and authority checks. Signed records must show the signer’s printed name, the date and time and the meaning of the signature (§11.50), and signatures must be linked to their records so they cannot be excised or copied (§11.70).
Does FDA’s Computer Software Assurance guidance apply to pharmaceutical GMP?
Not directly. FDA’s final guidance “Computer Software Assurance for Production and Quality Management System Software” (issued February 3, 2026, superseding the September 24, 2025 version) covers software used in medical device production or quality systems. Its risk-based thinking is widely referenced elsewhere, but pharmaceutical and biologics firms should apply their own predicate rules and, in the EU, EU GMP Annex 11.
How long are Microsoft 365 Copilot interactions kept in the audit log?
Copilot interactions are logged automatically in Microsoft Purview Audit (Standard). Microsoft’s default one-year retention for E5-licensed users covers Exchange, SharePoint, OneDrive and Entra records, so other records, including Copilot, keep the 180-day default unless a custom audit log retention policy extends them; 3-, 5-, 7- and 10-year retention needs the 10-Year Audit Log Retention add-on (Microsoft Learn, accessed 2026-10-28). Prompt and response content itself is held in the user’s mailbox and is reached with eDiscovery and retention policies.
Which e-signature tools are designed for Part 11 on top of SharePoint?
Two common options are Docusign’s Life Sciences Modules for 21 CFR Part 11, which add Part 11 authentication, reason-for-signature and signature manifestation, and Adobe Acrobat Sign’s Bio-Pharma Settings. Adobe itself states that the Bio-Pharma Settings alone are insufficient to satisfy all 21 CFR Part 11 requirements, so either tool still has to be configured and validated within your procedures.
Talk to a senior architect
A one-hour call with a senior EPC Group architect covers your GxP systems on Microsoft 365, Power BI, Fabric or Copilot and what validation evidence you already have. Email contact@epcgroup.net or call 888-381-9725.
Anonymized engagement summaries
EPC-reported accounts of client work. The client is not named, and supporting project records are not published in the Evidence Center, so these summaries are not part of its documented-engagement counts.
- Azure Data Warehouse and Power BI: Medical Devices (2025) — Medical devices
- Cross-Tenant Migration After an Acquisition: Life Sciences — Life sciences