Microsoft audit documents and self-assessment submissions

This bug tracks Microsoft Corporation’s ongoing submission of audit documents and related CCADB self-assessment materials for its CA program records. The thread began with uploaded independent accountant reports and management assertions, and it was later noted that the bug could continue to be used for annual audit statements and documents for this CA. New activity in July 2026 added FY26 Microsoft PKI audit reports for WTCA, WTBR TLS, and WTNS, along with a FY26 Microsoft Self-Assessment. The bug remains resolved with WORKSFORME, and the thread shows continued document uploads rather than a dispute or remediation action. The case is about maintaining the CA’s compliance documentation in CCADB, not about a certificate incident.

1. 2018-09-05 Initial upload of Microsoft CSEO baseline independent accountant report and management assertion.
2. 2018-10-02 Additional Microsoft CSEO audit reports were uploaded.
3. 2021-08-03 Microsoft DSR audit opinions and an auditor qualifications document were uploaded.
4. 2025-07-31 CCADB Self Assessment Framework v1.5 was uploaded.
5. 2026-07-29 FY26 Microsoft PKI audit reports and a FY26 Microsoft Self-Assessment were uploaded.

1. 2018-09-05 DigiCert — Created attachment 9006713 with the Microsoft CSEO Baseline independent accountant report and management assertion.
2. 2018-10-02 DigiCert — Created attachments 9013731 and 9013733 with Microsoft CSEO 2018 audit reports.
3. 2018-10-11 Mozilla representative — Said the bug may continue to be used for uploading annual audit statements and documents for this CA.
4. 2025-07-31 DigiCert — Created attachment 9504383, the CCADB Self-Assessment Framework v1.5 for 2025 Microsoft Corporation.
5. 2026-07-29 DigiCert — Created FY26 Microsoft PKI audit report attachments for WTCA, WTBR TLS, and WTNS, plus a FY26 Microsoft Self-Assessment attachment.