Jacek Szafader May 15, 2025 You Read:
Is Dynamics 365 secure? 9 facts to reassure your IT team
Migrating your CRM to the cloud sounds tempting, but the first questions from the security team are always the same: Where will our data be stored? Who protects it? Will we pass audits?
In this article, we’ve gathered the key facts about certifications, data center locations, backup procedures, and incident response in Dynamics 365 Sales, Customer Insights, and Customer Service. No marketing fluff — just straight answers to help you make an informed decision.
1. Why trust Dynamics 365?
Microsoft builds its business apps on the same infrastructure that powers Azure. This means:
- 99.9% SLA availability
- Global data centers
- A set of certifications trusted by banks, public institutions, and regulated industries
2. Certifications - who audits Microsoft and what do they confirm?
Abbreviation
ISO / IEC 27001
Guarantees
Information security management system
Why it matters
One of the most recognized global standards – it confirms a process-based approach to data protection.
SOC 1 & SOC 2
Independent auditor reports (operational controls)
Transparent proof of how Microsoft meets confidentiality, availability, and integrity requirements.
PCI DSS
Payment card industry standard
Crucial if you store or process transactional data.
HIPAA, FedRAMP
US health and public sector compliance
Proof that the platform meets strict regulatory compliance tests.
Full list: Microsoft Trust Center
3. Where is your data actually stored?
You choose the region when setting up the service – for Polish companies it’s usually Europe (e.g. crm4.dynamics.com).
No cross-continental replication – data and backups stay within your chosen macro-region (Europe, US, APAC, etc.).
Geo-redundancy within the region – backups are stored in Availability Zones to ensure continuity in case of data center failure.
Region changes are only possible during tenant-to-tenant migration – so choose carefully from the start.
4. Physical data center security
- 24/7 protection, CCTV, biometric access control
- Power redundancy + pre-action fire suppression systems
- “Zero standing privilege” access – no one has constant admin rights
These procedures are verified during ISO 27001 and SOC audits.
5. Encryption – at rest and in transit
Data at rest:
- SQL Transparent Data Encryption (TDE) enabled by default; encrypts entire databases and backups.
- BYOK (Bring Your Own Key) – full control via Azure Key Vault, meeting industry compliance needs.
Data in transit:
- All communication (browser ↔ front-end ↔ back-end ↔ API) requires TLS 1.2+; older protocols are blocked.
Why it matters:
- Immediately compliant with ISO 27001, SOC 2, GDPR, and more.
- Physical disk access does not allow attackers to read data.
- You manage keys and certificates in your own Azure tenant.
- Data in Dynamics 365 Sales is always encrypted — and you can’t disable it.
6. Backup, High Availability (HA), and Disaster Recovery (DR)
Feature
Automatic backups
How it works
Production: up to 28 days; Sandbox: up to 7 days. Full + differential + logs.
Restore
Self-service restore to a specific point in time via Power Platform Admin Center.
High Availability
Automatic failover within the region (Managed Availability).
Disaster Recovery
Data replicated across zones + ready recovery procedures.
Dynamics 365 Sales runs on Azure-based SaaS architecture, offering:
- Automatic updates
- 99.9% SLA
- Resilience to failures
- Scalable infrastructure — without hardware investment or user downtime
7. Incident response and customer alerts
Microsoft has a global 24/7 Incident Response Team across three time zones. In case of confirmed data breaches:
- Admins are notified in the Microsoft 365 Message Center within 72 hours of detection.
- After the incident is resolved, clients receive a post-mortem report detailing causes and future prevention steps.
8. Penetration testing and live audits
Both you and Microsoft can proactively test system resilience — but with clear rules:
Pen‑tests : You can test your own tenant (no shared infrastructure); follow Microsoft’s Penetration Testing Rules of Engagement.
Red Team Reports: : Microsoft regularly commissions external pen tests and shares reports via the Microsoft regularly commissions external pen tests and shares reports via the.
9. Data export and Data Loss Prevention (DLP)
Need more control over data flow and protection?
- Microsoft Purview DLP - Create rules that detect and block/mask sensitive data (e.g. national IDs, card numbers) in Dynamics 365 and across Microsoft 365.
Summary
The Dynamics 365 family inherits top security practices from Azure and Microsoft 365 — from ISO/SOC certifications to geo-redundant backups and real-time monitoring. The platform is designed to meet even the strictest security requirements.
If you want to explore specific topics (e.g., BYOK encryption or DR scenarios), visit the Microsoft Trust Center or Service Trust Portal
You’ll see results faster than you think
See the latest posts
Atteli expands its Microsoft solutions portfolio – a team of Dynamics 365 Business Central experts joins the company
Read More
RapidStart or Dynamics 365? When to choose which solution
Read More
Marketing and the Customer Insights – Journey with Microsoft Dynamics 365 Customer Insights – Journeys. What challenges do businesses face, and how can they overcome them?
Read More