Publisher attestation is a self-assessment completed by the app vendor. Microsoft 365 Certification is stronger evidence: Microsoft's documentation describes a yearly independent audit with penetration testing. Neither badge replaces your own review of the data an app can reach, but they help you decide how deep to go.
Where the badges appear
Microsoft's App Compliance Program covers apps, add-ins and agents that integrate with Microsoft 365. The documentation says Certified and Publisher Attested apps are shown across Microsoft 365 storefronts and admin pages with badging, filters and consent prompts. In the Teams admin center, the Manage apps page includes an "Apps to consider allowing" tile that counts both groups, and each app's details page has a Security and Compliance tab showing certification status and publisher attestation.
The two paths side by side
| Publisher attestation | Microsoft 365 Certification | |
|---|---|---|
| Who assesses | The vendor, as a self-assessment | An independent audit |
| What it covers | Security, data handling and compliance practices | Application security, operational security, and data handling, security and privacy |
| Testing | Not described as including penetration testing | The documentation describes a yearly audit that includes penetration testing |
| Effort stated by Microsoft | Most attestations can be completed in an hour or less | A longer process |
| Where the answers go | A dedicated page in Microsoft's documentation set | Same, plus the badge across storefronts |
The documentation also says certification evaluates apps against controls based on widely recognized standards such as SOC 2, PCI DSS and ISO 27001. That is a statement about how the controls are built. It does not mean a certified app holds those reports.
There is a third item in the program: ACAT, the App Compliance Automation Tool in Azure, which helps vendors automate evidence for certification.
How to use the badge in an approval decision
Match the depth of your review to the data at stake.
- List what the app can reach. Mail, files, chat history, calendars, directory data. This list matters more than the badge.
- Check the badge level. Certified gives you independent evidence. Attested gives you the vendor's own statements, which you can still read and challenge.
- Read the published page. Look at where data is stored, what is sent to subprocessors and how long data is kept.
- Ask for what is missing. If an app handles sensitive data and is only attested, ask the vendor for a penetration test summary or an independent report.
- Record the decision. Write down who approved the app, when, and on what evidence.
The Microsoft documentation notes that in some cases certification may be required for an app to be enabled in a tenant. Check your own tenant's settings rather than assume.
What the badge cannot answer
A badge describes a point in the vendor's history. It does not tell you whether your tenant's permission grants are narrow, whether the vendor will keep the controls running, or whether the app's data flows match your data handling commitments. It also does not tell you whether you need the app.
If your customers send you security questionnaires, your own app approval records become evidence. Our guide on how to answer how you manage third-party integrations shows how to describe the process.
Safeguard helps with the compliance and evidence side for your own software, including collecting and organizing the artifacts that auditors ask for. You can try it with a free scan at gold.safeguard.sh/scan.
Quick check
Is a publisher attested app unsafe?
Not necessarily. It means the vendor made a self-assessment that is published for customers. Treat it as vendor statements to verify, and review the permissions and data flows yourself.
Does Microsoft 365 Certification mean the app holds a SOC 2 report?
No. The documentation says the controls are based on standards such as SOC 2, PCI DSS and ISO 27001, which is different from holding those reports. Ask the vendor directly if you need one.
Sources
- Microsoft 365 App Compliance Program overview, Microsoft Learn
- Manage your apps in the Microsoft Teams admin center, Microsoft Learn
Last reviewed: 19 October 2026.
