DORA in the Microsoft cloud: what financial entities must implement and evidence

The Digital Operational Resilience Act (DORA) requires financial entities in the EU to manage, test and evidence their digital resilience systematically. For many mid-sized institutions, a large part of IT now runs in Microsoft 365 and Azure. As a result, Microsoft becomes an ICT third-party service provider under DORA, and the Microsoft tools become the most important source of evidence.

Who does DORA apply to, and what does the regulation require?

DORA has applied since 17 January 2025 to the financial entities listed in Art. 2, including credit institutions, payment and e-money institutions, investment firms, insurers and crypto-asset service providers. In Germany, the Financial Market Digitalisation Act (FinmadiG) extended the scope to further institutions under the German Banking Act and Insurance Supervision Act. BaFin answers detailed scope questions in its DORA FAQ (in German).

The regulation is structured in five areas: ICT risk management, handling and reporting of ICT-related incidents, digital operational resilience testing, management of ICT third-party risk, and information sharing on threats. For management, Art. 5(2) is decisive: the management body defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for managing ICT risk. Certain smaller entities, such as small and non-interconnected investment firms, apply a simplified framework under Art. 16.

What role does Microsoft play as an ICT third-party service provider?

If you use Microsoft 365 or Azure for critical or important functions, you must treat Microsoft like any other ICT third-party service provider. Three obligations apply:

• Register of information (Art. 28(3)): All contractual arrangements for ICT services belong in the register, including the Microsoft contracts with the services and functions in use.
• Minimum contractual content (Art. 30): This includes the regions where data is processed, access, inspection and audit rights, termination rights and support during ICT incidents. Microsoft covers these points in the Product Terms, the Data Protection Addendum (DPA) and the Financial Services Amendment, and provides a DORA mapping document on request. You still need to verify this against your own contract.
• Exit strategy (Art. 28(8)): For services supporting critical or important functions, you need documented and tested exit plans. In practice: how do mailboxes, SharePoint content and Azure workloads leave in an easily accessible format, and how long does it take?

On 18 November 2025, the European Supervisory Authorities designated Microsoft Ireland Operations Limited as a critical ICT third-party service provider. Microsoft is therefore subject to direct EU oversight. Your own obligations as a financial entity remain unchanged.

On data processing: with the EU Data Boundary, Microsoft has committed to store and process customer data and personal data for Azure, Microsoft 365, Dynamics 365 and Power Platform within the EU and EFTA, with documented exceptions. For Microsoft 365, this applies to tenants with a sign-up location in the EU or EFTA, but not to Multi-Geo tenants. In Azure, the location depends on the regions you select. This information belongs in the register and the risk assessment.

How do you evidence DORA requirements with Microsoft Purview Compliance Manager?

For management, Compliance Manager is where the implementation status becomes visible: which requirements are met, which are open, and who is responsible? For IT, the tool provides a DORA template, which is one of the premium templates. It maps improvement actions to the requirements, partly with automated testing of the Microsoft 365 configuration and partly with manual evidence uploaded as documents.

Two limitations apply. The compliance score measures progress on actions; it is not a legal confirmation of compliance. And organisational requirements such as contingency plans or contract reviews are still evidenced with your own documents, which you attach to the assessment.

How do you classify and report ICT incidents on time?

Major ICT-related incidents must be reported to the competent authority in three stages. The deadlines are set by Art. 5 of Delegated Regulation (EU) 2025/301:

• Initial notification within four hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
• Intermediate report no later than 72 hours after the initial notification.
• Final report no later than one month after the latest intermediate report.

The four-hour clock starts with classification. That is why you need predefined classification criteria and clear ownership. Technically, Microsoft Defender XDR and Microsoft Sentinel combine signals from identities, endpoints, email and Azure into incidents with timestamps and handling history. From this data you can derive the affected services, duration and impact, which is exactly the information the report requires.

What applies to resilience testing and TLPT?

DORA requires a risk-based testing programme with vulnerability assessments, scenario-based tests and penetration tests (Art. 24 and 25). Financial entities selected by the supervisor must also carry out threat-led penetration testing (TLPT) at least every three years (Art. 26). Contracts with ICT third-party service providers for critical functions must provide for participation in TLPT (Art. 30(3)). Testing your own resources in Microsoft 365 and Azure is governed by the Microsoft Cloud Penetration Testing Rules of Engagement; no prior notification to Microsoft is required.

Where are the typical gaps?

The same topics come up repeatedly in practice: a register of information that does not fully cover the Microsoft services, no tested exit strategy, missing classification criteria for incidents, and a testing programme that excludes cloud services. Organisations already operating an ISO 27001 ISMS can build on much of it. DORA is, however, more specific on the register, reporting deadlines and testing.

Our Gap Assessment reviews your Microsoft environment at a fixed price against the DORA requirements and shows which evidence exists and which is missing. For detection and incident handling in day-to-day operations, there is our Managed Security service; for penetration tests and scenario testing, our Security Assessments.

Book an introductory call

Frequently Asked Questions

What fines does DORA provide for?

DORA itself sets no fixed fine amounts for financial entities. Under Art. 50, member states lay down effective, proportionate and dissuasive administrative penalties and remedial measures; in Germany, this is regulated in the supervisory laws through the Financial Market Digitalisation Act. The regulation names a specific amount only for critical ICT third-party service providers: a periodic penalty payment of up to 1 percent of average daily worldwide turnover, imposed daily for up to six months (Art. 35). Terms such as “essential entity” come from NIS2 and play no role under DORA.

Does Microsoft’s designation as a critical provider relieve us of our own obligations?

No. ESA oversight of Microsoft complements your obligations but does not replace them. The register, risk assessment, contract review and exit strategy remain the financial entity’s responsibility.

Does DORA also apply to a bank’s IT service providers?

Only ICT third-party service providers designated as critical are directly supervised. If your service supports critical or important functions, however, the bank must agree the Art. 30 requirements with you contractually, such as audit rights, incident support and participation in testing.

We are ISO 27001 certified. Is that enough for DORA?

Not entirely. ISO 27001 covers many fundamentals. DORA additionally requires a register of information in a prescribed format, fixed reporting deadlines and a testing programme, including TLPT for selected entities. A gap analysis shows which existing measures can be credited.