Microsoft becomes 'certified strategic' cloud provider

Microsoft has become the fifth cloud service provider cleared to carry protected-level public sector data under the federal government’s hosting certification framework.

The tech giant quietly joined Amazon Web Services, Vault Cloud, Sliced Tech and AUCloud as a ‘certified strategic’ service provider last week, almost two months after the first providers were certified.

Certified strategic is the highest level of assurance under the framework, which was introduced to “mitigate against supply chain and data centre ownership risks”.

Hosting providers certified at this level have allowed the government to specify ownership and control conditions, unlike the lesser certification of ‘certified assured service provider’.

All protected-level data and data from whole-of-government systems will be required to be stored by certified strategic or certified assured service providers from July 2022.

The Digital Transformation Agency is, however, yet to certify any service providers or data centres at the certified assured level.

Agencies are also able to use uncertified service providers for "non-sensitive data, or where their internal risk assessment determines it is appropriate to do so".

A spokesperson from Microsoft told iTnews that the certification sets a "new high watermark" for the company's cloud services across all three Australian regions.

"More than 180 of our core online services – including Dynamics 365, Microsoft 365 and Azure – are now certified under the framework," the spokesperson said.

Microsoft's certification as a certified strategic provider comes after the government's Microsoft volume sourcing arrangement grew by more than $600 million in five months.

As revealed by iTnews, the agreement with exclusive Microsoft licence reseller, Data#3, is now valued at $809 million over six years, more than eight times its value in 2019.

In addition to Microsoft, the DTA has also certified DCI Data Centres’ Sydney-based facility under the framework.

DCI Data Centres also has a data centre in Melbourne, and last month revealed plans to build a facility in Darwin.

Other data centres to be certified to date include Canberra Data Centres, Macquarie Telecom, Australian Data Centres, NEXTDC, Equinix and Fujitsu.

Panellists on the government’s data centre arrangement were the first to become eligible for certification in April, while ‘indirect’ providers like cloud providers began applying in September.