Is Microsoft 365 GxP compliant?

By Hugh Donatello, LAN Service Group · Reviewed October 5, 2026

What Microsoft actually says

Microsoft's GxP compliance page states there is no GxP certification for cloud service providers. Instead, Azure and Office 365 undergo independent audits for quality management and information security, including ISO 9001 and ISO/IEC 27001, and Microsoft bases its qualification approach on ISPE GAMP good practice guides and PIC/S PI 011-3.

Microsoft retained Montrium, an independent life-science quality firm, to review its approach. The resulting Qualification Guidelines for Office 365 identify the responsibilities shared by Microsoft and its customers and recommend controls customers can put in place. Microsoft lists Azure, Microsoft 365 and Dynamics 365 as in scope.

Your side of the shared responsibility

Microsoft's own FAQ says customers should determine the GxP requirements that apply based on intended use, then follow their own procedures for qualification and validation. In practice, that means:

• Define which Microsoft 365 workloads hold GxP records, such as SharePoint document libraries for SOPs or quality records, and which do not.
• Assess supplier risk and keep Microsoft's audit reports and qualification documents in your supplier file.
• Configure unique accounts, MFA, permissions, versioning, retention and audit logging to match your requirements.
• Qualify the configuration with risk-based testing and keep it under change control.
• Plan for Microsoft's continuous updates: decide how you will assess release changes that could affect GxP use.

Electronic records and signatures

21 CFR Part 11 sets requirements for electronic records and signatures. Microsoft notes that no certification exists for Part 11 compliance; it maps its SOC 1, SOC 2, ISO/IEC 27001 and ISO/IEC 27018 audited controls to the Part 11 requirements it is responsible for, and states that customers who deploy applications subject to FDA regulation are responsible for ensuring those applications meet FDA requirements. Microsoft 365 alone is not a validated electronic signature or document control system; many companies pair it with a purpose-built quality management system or a validated add-on for controlled documents and signatures.

Data integrity in Microsoft 365

The ALCOA+ principles still apply. Every user must be uniquely identified, version history and audit logs must be retained for the record's retention period, and originals must not be overwritten or deleted outside procedure. Retention policies, sensitivity labels and audit log retention in Microsoft Purview are the usual tools. Purview Compliance Manager also offers a premium assessment template for GxP that can help track controls.

Keep the scope small

Not everything in Microsoft 365 needs to be qualified. Email and general collaboration can stay outside GxP scope while a defined set of sites or libraries carries regulated records. The tighter the boundary, the less you have to validate and the easier it is to keep under control.

Collect the evidence once. Microsoft makes its SOC 1 Type 2, SOC 2 Type 2, ISO/IEC 27001 and ISO/IEC 27018 audit reports available through the Service Trust Portal, subject to nondisclosure terms. File them with your supplier assessment and the Qualification Guidelines, and review them on a set cycle so your supplier file stays current.

Common follow-up questions

Sources

• Microsoft Learn: Good Clinical, Laboratory, and Manufacturing Practices (GxP)
• Microsoft Learn: FDA CFR Title 21 Part 11
• FDA Guidance: Data Integrity and Compliance With Drug CGMP, Questions and Answers (Dec 2018)