{
"canonical_url": "microsoft.com/en-us/microsoft-365/government",
"category": "Government productivity agent",
"commercial": true,
"compliance": [
{
"certificate_id": "microsoft",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "Microsoft",
"terms": [
"star_level_1",
"star_level_2",
"star_for_ai_level_1",
"partner_entries",
"caiq",
"certification",
"validaited-ai-caiq",
"eu-cloud-coc",
"iso-iec-42001",
"star_for_ai_level_2",
"validaited-42001"
]
},
"display": "STAR for AI: found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/microsoft",
"framework": "csa_star",
"issued": "2016-04-05",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:35Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "STAR_FOR_AI"
},
{
"certificate_id": "microsoft",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "Microsoft",
"terms": [
"star_level_1",
"star_level_2",
"star_for_ai_level_1",
"partner_entries",
"caiq",
"certification",
"validaited-ai-caiq",
"eu-cloud-coc",
"iso-iec-42001",
"star_for_ai_level_2",
"validaited-42001"
]
},
"display": "STAR Level 2: found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/microsoft",
"framework": "csa_star",
"issued": "2016-04-05",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:35Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "STAR_LEVEL_2"
},
{
"certificate_id": "F1603087869",
"covers_resource": "inherited",
"credited": true,
"detail": {
"cso": "Azure Government (includes Dynamics 365)",
"csp": "Microsoft",
"deployment_model": "Government Community Cloud",
"fedramp_status": "FedRAMP Authorized",
"impact_level": "High"
},
"display": "FedRAMP High: FedRAMP Authorized (FedRAMP Marketplace, 2026-10-26)",
"evidence_url": "https://marketplace.fedramp.gov/products/F1603087869",
"framework": "fedramp",
"issued": "2020-04-29",
"issuer": "JAB / 3PAO Kratos",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "64bc98d4cebbc137a6e7b94442b8678790eefa29e4347928a0de8620b56a168a",
"period_end": null,
"retrieved_at": "2026-10-26T12:24:28Z",
"review_reason": "vendor authorization for Azure Government (includes Dynamics 365); entity 1.00",
"reviewer": null,
"scope": "entity",
"source": "fedramp",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "FEDRAMP_HIGH"
},
{
"certificate_id": "microsoft",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "Microsoft",
"terms": [
"star_level_1",
"star_level_2",
"star_for_ai_level_1",
"partner_entries",
"caiq",
"certification",
"validaited-ai-caiq",
"eu-cloud-coc",
"iso-iec-42001",
"star_for_ai_level_2",
"validaited-42001"
]
},
"display": "ISO 42001: Found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/microsoft",
"framework": "iso42001",
"issued": "2016-04-05",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:35Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "ISO42001"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Cyber Essentials: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "cyber_essentials",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "CYBER_ESSENTIALS"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Cyber Essentials Plus: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "cyber_essentials",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "CYBER_ESSENTIALS_PLUS"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "dora",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "EU AI Act: Art. 50 statement (vendor statement, 2026-10-26)",
"evidence_url": "https://www.microsoft.com/en-us/trust-center",
"framework": "eu_ai_act",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "cb29ddf7ba6a197e4eeeb6a46594e22391e370c1510d926b807e7c4845a964ce",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "ART50_STATEMENT"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "fedramp",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "gdpr",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "HIPAA: BAA available (vendor-claimed, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "hipaa",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "hitrust",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "irap",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "ISO 27001: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "iso27001",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "ISO27001"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "ISO 27017: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "iso27001",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "ISO27017"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "ISO 27018: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "iso27001",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "ISO27018"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "ISO 27701: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "iso27701",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "ISO27701"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "pci_dss",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
"framework": "soc2",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "15994eab65c970d0a0f4e59e2588c2c4446d268f14094f445845fe9fef3d3c7a",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:12Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
}
],
"deployment": "Microsoft Government cloud",
"description": "Microsoft productivity/agent ecosystem for government cloud environments.",
"disclaimer": "Reference implementation by Hemant Naik. Compliance information is compiled from the sources shown as of the date shown. It is not an assessment, certification, legal opinion or recommendation. Confirm current status with the vendor and the issuing body.",
"domains": {
"business": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 32.5,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "general",
"rank": 12,
"recomputed": 94.2,
"score": 88.1,
"score_version": "sar-score-2.0",
"seed_rank": 12,
"seed_score": 94.2,
"source": "seed_xlsx",
"unknown": []
},
"cybersecurity": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 36.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "security",
"rank": 25,
"recomputed": 82.8,
"score": 85.6,
"score_version": "sar-score-2.0",
"seed_rank": 25,
"seed_score": 82.8,
"source": "seed_xlsx",
"unknown": []
},
"data": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 29.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso27701": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "data",
"rank": 38,
"recomputed": 87.8,
"score": 92.7,
"score_version": "sar-score-2.0",
"seed_rank": 38,
"seed_score": 87.8,
"source": "seed_xlsx",
"unknown": []
},
"finance": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 29.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso42001": 0.5,
"pci_dss": 0.15,
"soc2": 0.15
},
"profile": "regulated",
"rank": 42,
"recomputed": 77.2,
"score": 81.8,
"score_version": "sar-score-2.0",
"seed_rank": 42,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"government": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 43.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"fedramp": 0.5,
"iso27001": 0.15,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 10,
"recomputed": 95.8,
"score": 84.0,
"score_version": "sar-score-2.0",
"seed_rank": 10,
"seed_score": 95.8,
"source": "seed_xlsx",
"unknown": []
},
"healthcare": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 29.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"hipaa": 0.15,
"hitrust": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "regulated",
"rank": 34,
"recomputed": 77.2,
"score": 81.8,
"score_version": "sar-score-2.0",
"seed_rank": 34,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"insurance": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 26.7,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"hipaa": 0.15,
"iso27001": 0.15,
"iso42001": 0.5,
"pci_dss": 0.15,
"soc2": 0.15
},
"profile": "regulated",
"rank": 27,
"recomputed": 77.2,
"score": 81.5,
"score_version": "sar-score-2.0",
"seed_rank": 27,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"legal": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 29.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso27701": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "regulated",
"rank": 29,
"recomputed": 77.2,
"score": 81.8,
"score_version": "sar-score-2.0",
"seed_rank": 29,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"regulatory": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 29.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso27701": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "regulated",
"rank": 41,
"recomputed": 77.2,
"score": 81.8,
"score_version": "sar-score-2.0",
"seed_rank": 41,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"sales": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 29.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"gdpr": 0.15,
"iso27701": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "commercial",
"rank": 31,
"recomputed": 85.0,
"score": 89.2,
"score_version": "sar-score-2.0",
"seed_rank": 31,
"seed_score": 85.0,
"source": "seed_xlsx",
"unknown": []
},
"supply_chain": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 32.5,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "operations",
"rank": 24,
"recomputed": 82.2,
"score": 89.8,
"score_version": "sar-score-2.0",
"seed_rank": 24,
"seed_score": 82.2,
"source": "seed_xlsx",
"unknown": []
},
"technology": {
"components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 36.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso27001": 0.15,
"iso42001": 0.5,
"soc2": 0.15
},
"profile": "technology",
"rank": 27,
"recomputed": 94.8,
"score": 92.2,
"score_version": "sar-score-2.0",
"seed_rank": 27,
"seed_score": 94.8,
"source": "seed_xlsx",
"unknown": []
}
},
"external_ids": {},
"first_seen": "2026-10-26T12:11:40Z",
"governance": {
"certification_disclaimer": true,
"claims": [],
"evidence_urls": []
},
"id": "res_3929f878d4d8171a",
"identity": {
"evidence": [
"vendor_domain_product_page"
],
"rules_version": "identity-1.1",
"tier": 2
},
"issues": {
"advisories": 0,
"cves": 0,
"incidents": 0,
"links": [],
"regulator_actions": 0,
"withdrawn_certificates": 0
},
"last_seen": "2026-10-26T12:11:40Z",
"license": "Commercial",
"name": "Microsoft 365 Copilot for Government",
"news": [],
"news_checked": true,
"protocols": {
"a2a": {
"checked_at": "2026-10-26T12:23:19Z",
"parser_version": "a2a-0.3+1.0",
"status": "not_found"
},
"ard": {
"checked_at": "2026-10-26T12:23:18Z",
"parser_version": "ard-0.91",
"status": "not_found"
},
"mcp": {
"checked_at": "2026-10-26T12:23:20Z",
"parser_version": "mcp-2025-06-18",
"status": "not_found"
}
},
"publisher_domain": "microsoft.com",
"resource_type": "agent",
"scope": "public",
"security": {
"advisories": 0,
"checked_at": "2026-10-26T12:31:40Z",
"cves": 0,
"source": "nvd",
"tier": 1
},
"seed": {
"last_verified": "2026-09-25",
"snapshot_date": "2026-09-25"
},
"seed_components": {
"adoption": 27.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 45.0,
"health": 20.0,
"trust": 25.0
},
"signals": {
"observed_popularity": "Commercial"
},
"slug": "microsoft-microsoft-365-copilot-for-government",
"sources": [
{
"payload_hash": "1335702247c35efdff4ce932dd1f4b513e6aba90d4435988e6575b87a2bfd910",
"retrieved_at": "2026-10-26T12:11:40Z",
"system": "seed_xlsx",
"url": "https://www.microsoft.com/en-us/microsoft-365/government"
}
],
"tags": [],
"tenant": null,
"traces": [
{
"checked_on": null,
"date": "2025-06-11",
"format": "report",
"id": "tr_echoleak_m365_copilot_2025",
"kind": "red_team",
"notes": "Microsoft 365 Copilot (commercial); the catalog entry is the Government edition of the same platform",
"observed": {
"actions": [
"retrieved the attacker's email as context",
"rendered a markdown image whose URL carried retrieved data",
"request routed through a trusted Microsoft redirector, bypassing the CSP"
],
"approval": false,
"egress": true,
"entry": "indirect prompt injection via an inbound email indexed for retrieval",
"outcome": "Data from the user's Copilot context left the tenant with no user interaction; Microsoft patched server-side (CVE-2025-32711, CVSS 9.3)",
"refused": false,
"secrets_touched": true
},
"reviewer": null,
"scenario": "A crafted email, never opened by the user, is retrieved by Copilot's RAG and instructs it to embed sensitive context in an image URL fetched through an allowed Microsoft domain",
"scope": "platform",
"source": "Aim Security (Aim Labs); reported by Dark Reading",
"tier": 3,
"title": "EchoLeak: zero-click prompt injection exfiltrates Microsoft 365 Copilot context (CVE-2025-32711)",
"url": "https://darkreading.com/application-security/researchers-detail-zero-click-copilot-exploit-echoleak",
"vendor_response": "Fixed server-side by Microsoft before publication; CVE-2025-32711"
}
],
"trust": {
"compliance": 5,
"identity": 2,
"issues": 1,
"protocols": 5,
"security": 1,
"traces": 3,
"vendor_compliance": 1
},
"url": "https://www.microsoft.com/en-us/microsoft-365/government",
"vendor": "Microsoft"
}