Continuous SOC 2 and ISO 27001 configuration monitoring for Microsoft 365
Passing an audit proves your controls were on that day. Zybim's Compliance Drift Monitor checks your Microsoft 365 configuration twice a day and alerts you in plain language when something changes, with the fix. Findings carry an indicative mapping to SOC 2 and ISO 27001 areas.
Included in Monitoring Plus. Read-only, with a free assessment to start.
See pricing Run a free Microsoft 365 assessment firstWhy configuration drifts
Settings change for ordinary reasons. An admin turns off MFA for a user who lost their phone. A contractor gets Global Admin for a quick fix and keeps it. An old app needs legacy authentication, so someone re-enables it. Each change is small and understandable, and each one can quietly break a control your auditor tested.
What the monitor watches
- Multi-factor authentication: no Conditional Access policy enforcing MFA, or MFA enforcement weakened since the last check
- Legacy authentication: sign-in methods that bypass MFA are not blocked
- Privileged access: too many Global Administrators, or a new Global Administrator added since the last check
These map to access-control areas in SOC 2 and ISO 27001. The mapping is indicative and pending independent review; it is a guide for your own audit conversation, not an attestation.
Audit-ready evidence
Every finding is time-stamped with what changed and when. That history shows an auditor that controls were monitored through the period, not just on audit day. Alerts and their history can be exported as PDF, CSV and JSON evidence to share with your auditor or load into any compliance platform.
Read-only by design
The monitor uses a publisher-verified Microsoft Entra app with read-only permissions. It reads configuration only. A human decides every fix; the agent never changes your tenant.
Who it's for
- SaaS and services companies with a SOC 2 report to maintain
- Organisations working towards ISO 27001 on Microsoft 365
- MSPs that need to show client tenants stay in line: see the partner program
Pricing
Included in Monitoring Plus, from ₹14,399 a month (about $169) for up to 50 Microsoft 365 users, with the price set by team size. See the pricing page for every band, in rupees or dollars. Monitoring Plus can also be bought through Microsoft Marketplace as a private offer; ask us.
Frequently asked questions
What is compliance drift?
Changes to configuration after an audit that move you out of line with the controls you were assessed against.
Does this replace our SOC 2 audit?
No. It helps keep your Microsoft 365 controls in place between audits and gives you a record of monitoring. It is not an audit or a certification.
Does it work with Vanta or Drata?
There is no direct integration. Alerts and their history can be exported as PDF, CSV and JSON evidence to use with any compliance platform.
Does it change any settings?
No. It is read-only and advisory.
Which frameworks are covered?
SOC 2 and ISO 27001, with NIST CSF, DPDP and CERT-In references in the audit evidence pack. All mappings are indicative.