Microsoft SOX Compliance Consulting

Auditors testing IT general controls (ITGCs) start with access provisioning and deprovisioning, and for most enterprises that process now runs through Entra ID rather than through the ERP's native user administration screen. A terminated employee whose Entra ID account is disabled loses access to every downstream application using single sign-on — Dynamics, SAP Fiori, Oracle Cloud, Concur — in one action. Conversely, an Entra ID account that is not disabled promptly leaves every connected financial system reachable, regardless of how tightly the ERP itself restricts roles. This is why a SOX-scoped access review increasingly starts with a query against Entra ID sign-in logs and app assignments, not a report pulled from the ERP.

The practical consequence is that ERP-specific segregation-of-duties (SoD) work — the kind that maps 'create vendor' against 'approve payment' inside SAP or Dynamics — has to be paired with identity-layer controls that most SOX programmes under-scope: Conditional Access policies restricting finance-system sign-in to managed devices, Privileged Identity Management (PIM) time-boxing Global Administrator and Application Administrator roles, and access reviews certifying who holds an Entra ID group that grants ERP entitlement. A perfectly configured Dynamics or SAP role model does not survive an Entra ID Global Admin who can add themselves to a finance approval group.

Microsoft Purview's unified audit log captures directory changes, mailbox access, SharePoint and Teams file activity, and — when connected via Microsoft Sentinel or a SIEM — sign-in and Conditional Access events, all with a retention period configurable up to 10 years on E5/Compliance E5 licensing (90 days by default on lower tiers, which is a common SOX gap when nobody has raised the retention setting). Purview Compliance Manager also maps Microsoft's control implementations against frameworks including SOX-adjacent standards, giving internal audit a starting inventory of what Microsoft has already attested to versus what the customer organization is responsible for configuring itself under the shared responsibility model.

Defender for Cloud Apps (Microsoft's cloud access security broker) extends visibility beyond Microsoft 365 into any SaaS application a finance team has connected — expense tools, treasury platforms, a second ERP instance acquired through M&A — and can enforce session policies such as blocking file downloads from an unmanaged device during a Dynamics or NetSuite session. For SOX purposes, the auditor-relevant question is whether these logs are retained long enough and specific enough to support a testing sample: who signed in, from where, to what application, and whether a Conditional Access policy applied. A tool that logs the event but ages it out before the audit cycle closes does not produce usable evidence.

Power Automate and Power Apps are increasingly where finance teams build the workaround the ERP does not support natively — an approval flow that reroutes a purchase order above a threshold, a canvas app that lets a controller override a hold. Every one of these is in scope for SOX if it touches a financially relevant transaction, and most are built without IT's knowledge because Power Platform's low floor for entry is the point. The Power Platform admin center's Data Loss Prevention (DLP) policies and the newly required Managed Environments tier are the control point: DLP policies restrict which connectors a flow can combine (blocking, for example, a flow that reads from a financial data source and writes to an unapproved external endpoint), and Managed Environments add usage insights and sharing limits that make an unauthorized citizen-developed workflow visible to IT audit rather than invisible.

The common failure pattern is a Power Automate flow built by a finance analyst, using their own delegated credentials, that posts journal entries or approves invoices — a control that exists, runs correctly, and is completely undocumented. Because the flow's owner can modify its logic without a change ticket, it fails ITGC change-management testing the moment an auditor asks who approved the last change to the approval threshold. Bringing citizen-developed finance automation into the SOX control inventory, with an owner, a change log, and a decommissioning date if the underlying ERP later absorbs the function, is now a standard finding in Microsoft-heavy environments.