SWO Finops

Is Dynamics 365 secure? 9 facts to reassure your IT team

4 min read

Migrating your CRM to the cloud sounds tempting, but the first questions from the security team are always the same: Where will our data be stored? Who protects it? Will we pass audits?

In this article, we’ve gathered the key facts about certifications, data center locations, backup procedures, and incident response in

Dynamics 365 Sales, Customer Insights, and Customer Service

. No marketing fluff — just straight answers to help you make an informed decision.

1. Why trust Dynamics 365?

Microsoft builds its business apps on the same infrastructure that powers Azure. This means:

  • 99.9% SLA availability
  • Global data centers
  • A set of certifications trusted by banks, public institutions, and regulated industries

2. Certifications - who audits Microsoft and what do they confirm?

Abbreviation

ISO / IEC 27001

Guarantees

Information security management system

Why it matters

One of the most recognized global standards – it confirms a process-based approach to data protection.

SOC 1 & SOC 2

Independent auditor reports (operational controls)

Transparent proof of how Microsoft meets confidentiality, availability, and integrity requirements.

PCI DSS

Payment card industry standard

Crucial if you store or process transactional data.

HIPAA, FedRAMP

US health and public sector compliance

Proof that the platform meets strict regulatory compliance tests.

Full list:

Microsoft Trust Center

3. Where is your data actually stored?

You choose the region when setting up the service

– for Polish companies it’s usually Europe (e.g. crm4.dynamics.com).

No cross-continental replication

– data and backups stay within your chosen macro-region (Europe, US, APAC, etc.).

Geo-redundancy within the region

– backups are stored in Availability Zones to ensure continuity in case of data center failure.

Region changes are only possible during tenant-to-tenant migration

– so choose carefully from the start.

4. Physical data center security

  • 24/7 protection, CCTV, biometric access control
  • Power redundancy + pre-action fire suppression systems
  • “Zero standing privilege” access – no one has constant admin rights

These procedures are verified during ISO 27001 and SOC audits.

5. Encryption – at rest and in transit

Data at rest:

  • SQL Transparent Data Encryption (TDE) enabled by default; encrypts entire databases and backups.
  • BYOK (Bring Your Own Key) – full control via Azure Key Vault, meeting industry compliance needs.

Data in transit:

  • All communication (browser ↔ front-end ↔ back-end ↔ API) requires TLS 1.2+; older protocols are blocked.

Why it matters:

  • Immediately compliant with ISO 27001, SOC 2, GDPR, and more.
  • Physical disk access does not allow attackers to read data.
  • You manage keys and certificates in your own Azure tenant.
  • Data in Dynamics 365 Sales is always encrypted — and you can’t disable it.

6. Backup, High Availability (HA), and Disaster Recovery (DR)

Feature

Automatic backups

How it works

Production: up to 28 days; Sandbox: up to 7 days. Full + differential + logs.

Restore

Self-service restore to a specific point in time via Power Platform Admin Center.

High Availability

Automatic failover within the region (Managed Availability).

Disaster Recovery

Data replicated across zones + ready recovery procedures.

Dynamics 365 Sales runs on Azure-based SaaS architecture, offering:

  • Automatic updates
  • 99.9% SLA
  • Resilience to failures
  • Scalable infrastructure — without hardware investment or user downtime

7. Incident response and customer alerts

Microsoft has a global 24/7 Incident Response Team across three time zones. In case of confirmed data breaches:

  • Admins are notified in the

    Microsoft 365 Message Center

    within 72 hours of detection.

  • After the incident is resolved, clients receive a

    post-mortem report

    detailing causes and future prevention steps.

8. Penetration testing and live audits

Both you and Microsoft can proactively test system resilience — but with clear rules:

Pen‑tests

: You can test your own tenant (no shared infrastructure); follow Microsoft’s

Penetration Testing Rules of Engagement.

Red Team Reports:

: Microsoft regularly commissions external pen tests and shares reports via the

Microsoft regularly commissions external pen tests and shares reports via the.

9. Data export and Data Loss Prevention (DLP)

Need more control over data flow and protection?

  • Microsoft Purview DLP

    • Create rules that detect and block/mask sensitive data (e.g. national IDs, card numbers) in Dynamics 365 and across Microsoft 365.

Summary

The Dynamics 365 family inherits top security practices from Azure and Microsoft 365 — from ISO/SOC certifications to geo-redundant backups and real-time monitoring. The platform is designed to meet even the strictest security requirements.

If you want to explore specific topics (e.g., BYOK encryption or DR scenarios), visit the

Microsoft Trust Center

or

Service Trust Portal

Atteli CRM

If you feel like it’s time for the next step - see what CRM can change

You’ll see results faster than you think

Check it out

See the latest insights