Start free trial
Start free trial
How-to

How to produce DORA audit evidence in Microsoft 365

DORA counts the agents, flows and workspaces in your tenant as ICT assets. Inventory them, assign owners, review access and export the evidence.

Rencore 4 min read
How-to

DORA evidence in Microsoft 365 is the documented, retained proof that connects your tenant to the ICT risk duties of the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It shows which ICT assets exist in the tenant, who owns each one, who can reach it and how problems were handled over time, as records a supervisor can follow without anyone rebuilding them under audit pressure.

In short

  • DORA has applied to EU financial entities since 17 January 2025, and its asset and access duties reach into Microsoft 365.
  • Agents, Power Platform flows and apps built by business users are ICT assets too, and many registers have never seen them.
  • Evidence means records over time: inventory, owners, access decisions and policy results.
  • Build them during normal operations, and the audit becomes a matter of handing them over.

Where DORA meets your Microsoft tenant

DORA makes the management body responsible for the ICT risk framework (Article 5) and requires financial entities to identify every ICT asset and keep that view current (Article 8). It expects protection and detection measures, including access control (Articles 9 and 10), and a managed process for ICT incidents (Articles 17 to 19).

In a Microsoft tenant the ICT assets are not only servers and business applications. A Copilot Studio agent that reads customer data, a flow that moves files to an external system and a SharePoint site that holds a credit file are assets as well. Any licensed user can create them, so they appear faster than any asset intake process records them.

Why the evidence decides the audit

A supervisor asks what existed, who was accountable and what happened over the period, and a current screenshot answers none of that. Entities that collect evidence only before an audit end up reconstructing a year of decisions from mailboxes and memory. Entities that let owners, reviews and policies leave a record as they run can answer from data they already have.

Step by step

These five steps produce the Microsoft 365 part of your DORA evidence and keep it current between audits.

  1. Map the DORA duties to Microsoft 365 controls

    For each relevant article, name the Microsoft 365 control that answers it and the person who owns it: the asset inventory for Article 8, access control and MFA for Article 9, monitoring rules for Article 10. Every duty then has a control and an owner.

  2. Inventory every ICT asset in the tenant, agents included

    List workspaces, apps, flows and agents with owner, last activity and the data each can reach, and feed that list into your ICT asset register. Include what business users build, because that is the part asset registers often miss.

    Tip: Flag agents and flows whose owner has left first. They keep their access and nobody answers for them.

  3. Set a baseline and watch for drift

    Record the configuration you consider correct, such as MFA for every administrator, no ownerless apps and no mail redirected to external recipients, as policies that flag each deviation. The policy results over time show that the controls held for the whole period.

  4. Review access and ownership on a fixed cycle

    Have owners confirm on a schedule who can reach their workspaces, apps and agents, and remove what they do not confirm. Keep the Microsoft 365 audit log in Microsoft Purview for a period that covers your incident and audit duties.

  5. Package the evidence for supervisors

    Assemble the control map, the inventory, owner and review records and the policy trend into reports a supervisor can follow from article to proof. Schedule them, so they exist before the request arrives.

Connectors in this How-to

Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.

Watch it in Rencore

Short narrated product guides that play in your browser, with no sign-in.

  • An agent nobody owns anymore

    Length: 4 min

    A Copilot agent keeps running on its own after its maker leaves, and nobody answers for what it can reach.

    • Copilot Studio
    • AI Governance
    • Sprawl & Lifecycle

  • Power Apps and flows without owners

    Length: 5 min

    Apps and flows keep running after their makers leave, and nobody is accountable for them.

    • Power Apps
    • Power Automate
    • Sprawl & Lifecycle
    • Policies
    • Automation

  • Who has access to what for one user

    Length: 3 min

    When someone leaves or an auditor asks, nobody can say quickly which teams, sites, licences and shared files one person can reach.

    • Microsoft 365
    • Teams
    • SharePoint
    • OneDrive
    • Entra ID
    • Access & Sharing
    • Reports

  • Build a governance dashboard

    Length: 4 min

    Leadership, security and service owners each want their own view of the estate, and building every one by hand takes days.

    • Teams
    • SharePoint
    • Power Platform
    • Copilot
    • Dashboards

Common questions about DORA evidence in Microsoft 365

Is a Copilot agent or a Power Automate flow an ICT asset under DORA?
DORA defines an ICT asset as a software or hardware asset in the network and information systems the financial entity uses (Article 3(7)). An agent or a flow runs in your tenant, reads business data with the permissions it was given and acts on that data, so it falls inside that definition. Article 8 then requires you to identify it, with its owner and dependencies, like any other asset.
Does Microsoft's own tooling keep the ICT asset register for us?
Each Microsoft admin center lists its own objects, per service and per environment, and Microsoft Purview keeps the audit log. The Article 8 duty asks for something else: one current view of all ICT assets with owners and dependencies, feeding your register. That view has to be assembled across Microsoft 365, Power Platform and Copilot, and kept current.
What do supervisors usually ask for in a DORA review of Microsoft 365?
Expect questions about which assets exist and who owns them, who holds privileged access and whether it is protected with MFA, how external access is controlled and reviewed, and how changes and incidents are tracked. Answers backed by dated records, such as a completed access review or a policy trend, carry more weight than a description of the intended process.
How does Rencore help with DORA evidence?
Rencore Governance inventories the workspaces, Power Platform apps and flows and Copilot Studio agents in your tenant with their owners, flags orphaned and over-shared assets with built-in policies, and runs owner access reviews in the Rencore Teams App. The inventory, owners, violations and trend can be exported or scheduled as reports. It covers the Microsoft slice of your DORA scope and complements the Microsoft controls you already run. No tool makes you DORA-compliant on its own.

Last updated 8 October 2026

About the author

Rencore

Rencore is a B2B software company providing award-winning solutions that help organizations maintain control over Microsoft 365, Copilot, AI Agents, and the Power Platform. Our customers rely on our tools to simplify, automate, and accelerate their daily challenges in control, risk, cost, and compliance.

Related

See your Microsoft 365 ICT assets in one view

We will show the agents, flows and workspaces in your tenant with their owners, and the evidence you can export from them, in a short demo.

Request a demoGet started free
Rencore newsletter

Subscribe to our newsletter

Get the latest insights on governing Microsoft 365, Copilot and AI agents, delivered to your inbox.

Loading form