Azure Government FedRAMP documentation and authorization status

Executive takeaways

• The FedRAMP Marketplace lists Microsoft Azure Government as Authorized at the High impact level, establishing its eligibility for handling High baseline federal information with reuse by agencies subject to their ATO processes ¹.
• FedRAMP control baselines have transitioned to NIST SP 800 53 Rev 5, and agencies should expect Azure Government FedRAMP artifacts to reflect Rev 5 controls in the Microsoft Service Trust Portal package set ^{2 3}.
• FedRAMP is advancing automation via OSCAL for machine readable packages, which affects how agencies and CSPs exchange security documentation and enables more automated validation workflows ⁴.

What is confirmed today about Azure Government and FedRAMP

• Azure Government appears on the FedRAMP Marketplace as an Authorized cloud service at the High impact level, indicating it has completed a FedRAMP authorization and is available for agency reuse consistent with FedRAMP policy ¹.
• Microsoft’s compliance documentation states Azure and Azure Government participate in FedRAMP, and Microsoft maintains FedRAMP documentation including SSPs and related artifacts accessible to customers through the Microsoft Service Trust Portal subject to appropriate access controls ^{5 3}.
• FedRAMP’s current control baselines are aligned to NIST SP 800 53 Rev 5, and the FedRAMP Program Management Office provides Rev 5 baseline templates and guidance for CSP packages and agencies ².

Documentation access and verification path for agencies

• Confirm the current authorization status and impact level on the FedRAMP Marketplace entry for Microsoft Azure Government before relying on reuse, as this is the authoritative listing for FedRAMP statuses ¹.
• Obtain Azure Government FedRAMP package artifacts such as the System Security Plan and supporting documentation via the Microsoft Service Trust Portal, which is Microsoft’s distribution channel for audit and compliance reports, subject to sign in and access agreements ³.
• Validate which Azure services are in scope for FedRAMP in Azure and Azure Government by consulting Microsoft’s in scope services list and ensure that intended services for deployment are covered by the relevant FedRAMP authorization scope ⁶.

Compliance and authorization context that changed in the FedRAMP program

• FedRAMP has migrated baselines to NIST SP 800 53 Rev 5, requiring CSP packages and agency ATOs to align with updated control sets, which may change control wording, parameters, and evidence expectations relative to Rev 4 ².
• FedRAMP is adopting OSCAL to support machine readable security package artifacts, enabling more automated ingestion and validation by agencies and the FedRAMP PMO, which can impact how Microsoft and agencies exchange and process Azure Government documentation ⁴.
• The FedRAMP Authorization Act, enacted as part of the National Defense Authorization Act, codifies FedRAMP in law and directs improvements including automation and reciprocity to enhance reuse, which informs agency acceptance and oversight of authorized CSPs such as Azure Government ⁷.

Operationalizing FedRAMP controls in Azure Government

• Azure Policy provides built in regulatory compliance initiatives, including a FedRAMP High initiative mapping Azure Policy definitions to FedRAMP controls, enabling agencies to assess resource configurations against control aligned policies in Azure Government ⁸.
• Microsoft Defender for Cloud’s regulatory compliance dashboard aggregates assessment results against regulatory standards, including FedRAMP, to support continuous monitoring of control implementation across Azure subscriptions in scope, which agencies can use as part of their security operations in Azure Government ⁹.
• FedRAMP requires continuous monitoring with monthly and quarterly reporting expectations, and agencies should integrate Azure Government telemetry and Microsoft provided compliance assessments into their ConMon processes to meet FedRAMP continuous monitoring requirements ¹⁰.

Mission owner actions

• Verify authorization reuse: Document the Azure Government FedRAMP High authorization as shown in the FedRAMP Marketplace and confirm your agency’s specific ATO scope aligns to the Azure Government authorization boundary and in scope services ^{1 6}.
• Pull current artifacts: Access the Microsoft Service Trust Portal to retrieve the latest Azure Government FedRAMP SSP, Customer Responsibility artifacts, and evidence to support control implementation and agency specific overlays aligned to Rev 5 ^{3 2}.
• Implement technical guardrails: Assign the Azure Policy FedRAMP High initiative and leverage Defender for Cloud’s regulatory compliance dashboard in Azure Government to continuously assess and report on control relevant configurations as part of your ATO ConMon plan ^{8 9 10}.
• Clarify shared responsibilities: Use Microsoft’s shared responsibility guidance to delineate responsibilities between Microsoft and your organization for each control, ensuring agency implemented controls are explicitly planned and evidenced in the SSP and ConMon reporting ¹¹.

Items that cannot be verified from public primary sources at this time

• The specific content and timing of any recent Azure Government documentation updates described as compliance and authorization changes could not be corroborated beyond the general FedRAMP Rev 5 transition and OSCAL adoption; agencies should consult the FedRAMP Marketplace entry and Microsoft Service Trust Portal for the most current artifacts and version dates before making decisions ^{1 3 2 4}.

¹: FedRAMP Marketplace — Microsoft Azure Government — https://marketplace.fedramp.gov/#!/product/microsoft-azure-government
⁵: Azure compliance offerings — FedRAMP — https://learn.microsoft.com/en-us/azure/compliance/offerings/fedramp
³: Microsoft Service Trust Portal — https://learn.microsoft.com/en-us/compliance/regulatory/service-trust-portal
²: FedRAMP Baselines — NIST SP 800-53 Rev 5 — https://www.fedramp.gov/baselines/
⁴: FedRAMP OSCAL — https://www.fedramp.gov/oscal/
⁷: FedRAMP Authorization Act overview — https://www.fedramp.gov/fedramp-authorization-act/
⁸: Azure Policy regulatory compliance built in initiatives — https://learn.microsoft.com/en-us/azure/governance/policy/samples/regulatory-compliance#fedramp-high
⁹: Microsoft Defender for Cloud regulatory compliance dashboard — https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance
⁶: Azure services in scope for compliance — FedRAMP — https://learn.microsoft.com/en-us/azure/compliance/offerings/services-in-scope#fedramp
¹¹: Shared responsibility in cloud computing — https://learn.microsoft.com/en-us/compliance/regulatory/shared-responsibility
¹²: Azure Government overview — https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview
¹⁰: FedRAMP Continuous Monitoring Strategy Guide — https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf