Entra ID compliance for SOC 2: MFA and admin gaps, followed through.
Obsinto keeps Microsoft Entra ID audit-ready: it checks MFA, Conditional Access, admin roles and legacy sign-ins against SOC 2 and ISO 27001, gives your identity owner the exact change to make, re-checks it, and keeps the proof.
What Obsinto does for you
Identity is where audits fail
Logical access is the most tested area of a SOC 2 audit. Obsinto watches the Entra ID settings auditors sample, every day, not once a quarter.
Gaps followed through
When MFA coverage slips or an extra global admin appears, Obsinto names the exact change, routes it to your identity owner, and re-checks until it holds.
Evidence for the whole period
Conditional Access and admin-role state is recorded continuously, so you can show the control worked all year, not just on audit day.
How an Entra ID gap gets closed
- 01 / DETECT
A sign-in control drifts, for example a Conditional Access policy that no longer requires MFA for every user.
- 02 / MAP
The gap is tied to the SOC 2 and ISO 27001 access controls it puts at risk.
- 03 / PREPARE
Obsinto spells out the exact policy or role change, and who it affects.
- 04 / APPLY
Your identity owner reviews the change and makes it in Entra ID.
- 05 / VERIFY
Entra ID is re-checked and the result is filed as evidence against the control.
Does SOC 2 require MFA?
SOC 2 does not name a technology, but the logical access criteria (CC6.1 to CC6.3) expect strong authentication and least privilege. In practice auditors expect MFA for every user, with no legacy sign-ins that bypass it, and a short, reviewed list of admins. Obsinto checks exactly that in Entra ID.
Already using Secure Score and Entra ID Governance?
Keep them. Secure Score tells you what Microsoft recommends. Obsinto ties each identity setting to the audit requirement it serves, gets the gap fixed with your approval, and keeps the record your auditor will ask for.
Where identity findings usually stall
Most tools report that MFA is missing for some users and open a task. The task then waits. Obsinto follows it through: the exact change, the owner who makes it, the re-check and the evidence, so identity findings stop piling up before the audit.
What Obsinto checks in Entra ID
Identity checks mapped to SOC 2 logical access criteria, ISO 27001:2022 Annex A and NIST 800-53.
Authentication
MFA enforced through Conditional Access, phishing-resistant and strong authentication methods, legacy authentication blocked
Privileged access
Global admin count, standing privileged role assignments
Sign-in policy
Conditional Access coverage, security defaults versus Conditional Access
Evidence
Policy and role snapshots over the full audit period, ready for your auditor
What access Obsinto needs in Entra ID
Read-only Microsoft Graph permissions for directory, policy, role and sign-in data, granted once with admin consent.
Entra ID settings are re-read on a schedule, so drift shows up long before the audit.
Your identity owner makes each change. Obsinto’s Entra ID access is read-only, so it cannot change your directory.
Entra ID compliance questions
Does SOC 2 require MFA in Entra ID?
SOC 2 does not name MFA, but auditors test strong authentication under CC6.1. In practice they expect MFA for every user through Conditional Access, with legacy authentication blocked.
How many global admins should we have for SOC 2?
Keep it small. Microsoft recommends fewer than five global administrators, including emergency access accounts. Obsinto flags when the count grows and keeps the history as evidence.
What Entra ID permissions does Obsinto need?
Read-only Microsoft Graph permissions, granted with admin consent. Obsinto cannot change your directory; your identity owner makes each change.
How is Obsinto different from Vanta or Drata for Entra ID?
They report failing identity tests with fix guidance for your team. Obsinto drives the gap to closure: the exact change, the approval, the re-check and the evidence filed against the control.