Microsoft 365 Immutable Audit
& Administrative Transparency Agreement

1. Purpose & Background

This Agreement governs the specific technical and procedural implementation of SoftSol’s “Framework B — Immutable Transparency” administrative accountability model within the Client’s Microsoft 365 tenant. It sets out precisely how SoftSol’s administrative actions are logged, monitored, streamed to an external repository, and made available for independent review by the Client.

Under this framework, SoftSol maintains standing administrative access to the Client’s Microsoft 365 environment for the purpose of efficient managed service delivery. In exchange for this operational convenience, SoftSol commits to implementing the comprehensive audit, alerting, and external log streaming architecture described in this Agreement — ensuring that no administrative action can occur without generating a permanent, independently verifiable record that the Client can access, review, and retain independently of SoftSol.

This Agreement supplements the Master Services Agreement (“MSA”) between the parties. In the event of a conflict between this Agreement and the MSA with respect to Microsoft 365 administrative transparency obligations, this Agreement shall prevail.

2. Definitions

3. Scope of Administrative Access

Under Framework B, SoftSol holds the following GDAP roles with standing activation within the Client’s tenant. These roles are individually specified, approved by the Client’s global administrator during onboarding, and documented in Schedule A of this Agreement.

The specific roles active for the Client’s engagement are confirmed in Schedule A. SoftSol does not request or hold Global Administrator at any time. All roles are scoped to infrastructure management functions and do not confer default access to mailbox content, OneDrive files, Teams messages, or any end-user data. The Administrative Access Rights Statement (document ref SS-M365-AARS-01) governs the specific permissions carried by each role.

The Client acknowledges that the transparency obligations in this Agreement — continuous logging, external streaming, and real-time alerting — are the mechanism by which the Client maintains oversight and accountability over SoftSol’s standing access. The Client may, at any time, reduce the scope of standing access or migrate to Framework A (Just-In-Time access) subject to a service change request.

4. Microsoft 365 Unified Audit Log — Native Logging

The Microsoft 365 Unified Audit Log (UAL) is a platform-level capability built into every Microsoft 365 tenancy. It records all administrative and compliance-relevant activity at the infrastructure level. It is not an optional add-on and cannot be disabled by SoftSol or the Client. Every administrative action taken by any account — including SoftSol’s delegated administrators — generates a permanent, timestamped, identity-attributed log entry that cannot be altered, overwritten, or deleted by any party.

4.1 Audit Licence Configuration

SoftSol will configure the Client’s tenancy to use Microsoft Purview Audit (Standard) as a minimum, or Purview Audit (Premium) where the Client’s licence tier permits. The table below summarises the differences relevant to this Agreement:

SoftSol will confirm which tier is applicable for the Client’s engagement in Schedule A. Where Purview Audit Premium is not included in the Client’s licence, SoftSol will advise on licence upgrade options. The external log streaming described in Section 6 supplements the UAL retention period regardless of the native Microsoft retention setting.

4.2 Events Captured by the UAL

The UAL captures events across all Microsoft 365 services. The following event categories are of particular relevance to this Agreement (i.e., operations performable by a delegated administrator):

5. Real-Time Alert Configuration

SoftSol will configure the following alert policies within the Client’s Microsoft Purview Compliance portal. Each policy triggers an immediate email notification to the Client’s designated management contact(s) when the defined operation is detected, regardless of which account performed it.

5.1 Alert Delivery

Alerts are delivered to the Client’s designated management contact(s) via email from Microsoft Purview. The alert email contains:

• •The exact UTC timestamp of the event
• •The UPN (email address) of the account that performed the action
• •The specific operation code and a plain-language description
• •The target object (e.g., affected mailbox, user account, or policy)
• •A link to the full event detail in the Microsoft Purview compliance portal

The Client shall designate a minimum of one and a maximum of five email recipients for alert delivery. Recipient details are recorded in Schedule B. The Client may update recipients at any time by written notice to SoftSol. SoftSol commits to implementing recipient changes within two business days of notification.

5.2 Alert Response Expectations

The Client is not required to respond to every alert. Alerts serve as real-time transparency notifications — not approval requests. However, if the Client receives an alert for an action they did not expect or did not authorise, they should contact SoftSol immediately via the support portal or at support@softsol.co.za. SoftSol commits to providing a written account of any disputed action within four business hours of notification.

7. Client Access & Self-Audit Rights

The Client is entitled to independently access, query, and export logs from all components of the audit infrastructure described in this Agreement at any time, without prior notice to SoftSol. SoftSol will provision and maintain the following access for the Client:

SoftSol will provide onboarding documentation and, where requested, a walkthrough session to train the Client’s designated compliance or IT contact on querying each access point.

8. Roles & Responsibilities

9. Implementation Checklist

The following steps will be completed by SoftSol during onboarding, with Client participation as indicated. Completion of each step will be confirmed in writing to the Client.

10. Compliance Alignment

11. Duration, Annual Review & Termination

Duration: This Agreement takes effect on the date of signature by both parties and remains in force for the duration of the managed services engagement.

Annual Review: SoftSol will initiate a formal review of this Agreement annually, including confirmation that all alert policies remain active, that the streaming pipeline is functioning correctly, and that the alert recipient list in Schedule B is current. A written review summary will be provided to the Client.

Material Changes: Either party may propose amendments to this Agreement by providing 30 days written notice. Amendments require written agreement by both parties before taking effect.

Termination: Upon termination of the managed services engagement, SoftSol will transfer ownership of the log repository resources to the Client or provide a full export of all archived logs, at the Client’s election, within 30 days of termination. SoftSol’s access to the log resources will be revoked simultaneously with the revocation of the GDAP relationship.

12. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Republic of South Africa. Any disputes arising from this Agreement shall be subject to the jurisdiction of the South African courts, with Gauteng as the preferred seat of any proceedings.

Schedule B — Alert Recipients