Vendor Quality Assessment

Microsoft does not publish a dedicated email address for Azure or Azure DevOps vendor-quality requests; first obtain the available assessment evidence from the Service Trust Portal, then send any questionnaire, proposed quality agreement, or audit-right request to your Microsoft account or sales representative for a contract-specific determination.

Recommended process

1. Sign in to the Microsoft Service Trust Portal (STP).
   Use an organizational Microsoft Entra account associated with an Azure subscription or trial. Some materials require acceptance of Microsoft’s NDA for compliance materials.^1^
2. Search separately for Azure and Azure DevOps.
   Download the applicable certificates, independent audit reports, bridge letters, assessment reports, and control documentation. Azure DevOps reports and certificates can be separate from Azure’s documents.^2^
3. Use the existing assessment material to answer the questionnaire.
   Microsoft specifically directs vendor assessments to STP for audit reports, control implementation summaries, bridge letters, and compliance guides.^3^ Azure DevOps has also completed the Cloud Security Alliance Consensus Assessment Initiative Questionnaire (CAIQ), available through STP.^4^
4. If information is missing, select Feedback at the bottom of an STP page.
   That is Microsoft’s documented contact mechanism for questions about STP compliance reports and trust resources; the documentation does not provide a general email address for these requests.^1^
5. Send contractual requests to the Microsoft account team or sales contact.
   Include:
   • Legal customer name and tenant/subscription details
   • Products and services in scope
   • The questionnaire or draft quality agreement
   • Required standard or regulation
   • Proposed audit scope, evidence requested, and whether remote or on-site
   • Required completion date
   If your organization does not have an assigned account representative, use Microsoft sales support for your country or region to request routing to the appropriate Azure commercial team.^5^

Answers to the three requests

• Will Microsoft complete a vendor quality questionnaire?
  The public documentation establishes a self-service evidence route through STP and provides an existing CAIQ for Azure DevOps. It does not establish that Microsoft will complete every customer-specific questionnaire. Submit only the unanswered items to the account team after reviewing the published evidence.
• Will Microsoft sign a vendor quality agreement?
  No blanket public commitment is documented. A proposed agreement must be reviewed through the account or sales team against the applicable Microsoft Product Terms, Data Protection Addendum, and customer contract.
• Will Microsoft support an on-site or remote customer audit?
  Microsoft publishes independent third-party audit evidence, including separate reports where applicable for Azure DevOps. For example, Azure and Azure DevOps have SOC 2 Type 2 reports available through STP.^6^ The public material does not grant a general right to conduct an on-site or remote customer audit. Any additional audit access must be assessed under your contract by the Microsoft account and legal teams.

An Azure technical-support ticket is not the primary route for negotiating agreements or audit rights. If the issue is specifically access to STP reports, use STP Feedback; if it concerns commercial or contractual commitments, use the account or sales team.

References

1. Get started with Microsoft Service Trust Portal
2. Azure, Dynamics 365, Microsoft 365, and Power Platform compliance offerings
3. Microsoft Discovery SIG-based security and compliance FAQ
4. Data protection overview
5. [Personal account](https://support.microsoft.com/support/#microsoft-sales-support)
6. System and Organization Controls (SOC) 2 Type 2