Microsoft Advanced Specializations: All 28, 16 Need an Audit

1. What Changed on 30 July 2026

If you built a specialization plan before July, part of it is now invalid.

On 30 July 2026, Microsoft moved all four Security specializations off customer references and onto a paid, third-party audit. Microsoft's own August Partner Center announcement states it plainly:

Microsoft 365 Copilot moved the same way, and there the before-and-after is stated outright: "The customer references requirement is replaced with a third-party capabilities audit. This audit update is part of a shift to an independent, objective validation process."

That is five specializations that changed their qualification route inside a single month. Add the eleven Azure specializations that were already audited, and 16 of the 28 Advanced Specializations now require a third party to inspect your actual delivery work. Self-attestation is now the minority route — and it is the minority route precisely where Microsoft spends the most money.

2. Why Microsoft Did It — and Why That’s Good News If You Can Pass

It is easy to read this as Microsoft getting bureaucratic. That reading will cost you money, because it misses what Microsoft actually did: it decided who it wants doing this work. Look at where the audits landed and the intent is unmistakable.

Azure, Security, Copilot. That is not a compliance decision — that is Microsoft's FY27 investment thesis restated as a standard of proof. Business Applications has zero audited specializations. Modern Work has exactly one, and it is the one with Copilot in the name. Microsoft is concentrating its funding and its trust in the same three places.

Microsoft raises the bar where the stakes are highest. Understand that sentence and the rest of this page is obvious.

Security is the clearest case. When a partner deploys Microsoft’s security stack badly, the customer’s breach becomes Microsoft’s problem too — its name is on the product. Three friendly customer references could never establish whether a partner can actually stand up a SOC, harden an identity perimeter, or run an incident to ground. A live evidence review can. Microsoft expanded audits into Security because Security is where it least wants to be wrong, and because it wants its most capable partners on that work — not its loudest.

The mechanism behind all of it is funding. Specializations gate ECIF — End Customer Investment Funds, Microsoft putting its own cash into partner-led deals — along with co-sell priority and PDM attention. When the badge only bought a directory listing, an honour system was good enough. Now it gates a funded pipeline, and Microsoft is writing cheques against it. The audit is not bureaucracy. It is what makes the funding real — and it is why the partners who hold these specializations get the introductions.

3. The Five That Break Your Plan

This is the single most expensive assumption in the Microsoft partner ecosystem right now, so it gets its own section rather than a footnote.

Most partners carry a mental model that says Azure gets audited, everything else gets references. That model was correct until July. It is now wrong for five specializations:

A partner who budgeted for reference coordination on any of these now meets a partner-funded audit of roughly $2,700–$4,000, a 4–8 hour evidence review, and a documentation burden that takes months to assemble — not weeks.

4. The Consolidation Signal: Twelve Azure Specializations Became Eleven

The audit shift is not happening in isolation. Microsoft is simultaneously narrowing the catalog and deepening the proof required for each survivor.

Two FY27 changes did that on the Azure side. Kubernetes on Microsoft Azure and Migrate Enterprise Applications to Microsoft Azure were merged into a single specialization, App Modernization on Azure. Separately, Data Warehouse Migration to Microsoft Azure was renamed Analytics on Azure. Twelve became eleven — one merge, not two. And counting the renames, six retired names now resolve to five of today’s eleven Azure specializations, which is the part that actually breaks a plan written last year.

If you were mid-flight on a retired name, your evidence did not disappear — but the specialization you were working toward no longer exists under that title, and the requirements you were reading may have moved. Every rename on this page is carried verbatim from Microsoft's own formerlyKnownAs record, and the old name stays visible on each card so a search for the retired term still lands here.

Read the two trends together and the direction is unambiguous: fewer specializations, harder to earn, worth more when you hold one. Scarcity is the point. A badge that 5% of partners hold is only valuable to Microsoft if the 5% is real.

5. How the Audits Actually Work — and Where the Money Leaks

Three different audit systems now sit behind the word "audit," and confusing them is what turns a $2,400 plan into a $12,000 one. They are not interchangeable.

Security and Copilot pricing is Microsoft's published figure as of 31 July 2026, partner-funded and subject to change. Microsoft publishes Module A + four Module B use cases for each Security specialization but does not state a single total control count for them the way it does for Copilot — so we don't either.

Module A is an asset — but only on Azure

This is the most valuable sentence on the page for anyone planning more than one specialization, and it is routinely misapplied.

On Azure, Module A is a one-time purchase. The seven Azure Essentials Cloud Foundation controls are shared across all eleven Azure specializations. Pass them once and every subsequent Azure specialization becomes a Module B-only audit — roughly $2,400 instead of $3,600. Across four Azure specializations that is about $3,600 saved, and considerably less evidence work.

On Security, it is not. The Security Foundation module is a different module with different requirements, and Microsoft's own checklists mark it as not shared across specializations. Budget Module A for every Security specialization you pursue. Copilot has no Module A at all — it is a single flat audit of six capabilities and fifteen controls.

Evidence is a standing discipline, not a scramble

Every one of these audits reads real customer delivery work — architecture documents, migration assessments, deployment artifacts, post-go-live monitoring. Evidence must come from real customer engagements inside the specialization’s evidence window — one to three customers, depending on the specialization; nothing in the governed FY27 catalog requires more than three, and it must demonstrate production engagements, not demos, POCs or internal environments.

Partners who fail rarely lack the capability. They lack the paperwork for work they genuinely did. The partners who pass are the ones who started filing evidence as a habit 60–90 days before they scheduled anything.

What a scan actually returns

All of the above stays abstract until you point it at a real Statement of Work. Below is the shape of PIE’s Audit-Heavy Control & Evidence Plan — the report it produces after reading a SOW against the governed control baseline of every specialization the work actually touches.

Note what it matched. One SOW, and it lands on two audit-heavy specializations at once — one Azure, one Security. That is section 1 of this page arriving on a real deal: the partner was almost certainly planning for an audit on the Azure side and customer references on the Security side.

Now read the number that matters. All 32 controls have SOW language mapped to them — on paper this partner looks covered. Not one of them has a delivery artifact counted against it. Nineteen are described in the SOW with nothing filed to prove the work; thirteen are not addressed at all.

It also counts honestly in the places it cannot know. Artifacts live in the ISSI evidence workspace, not on the analysis document, so rather than printing a misleading zero the report reads “Not tracked here” — a control showing PARTIAL may already have its artifact on file. And it counts control instances, not distinct controls: each specialization is audited separately and carries its own catalog record, so a control required by two specializations is two requirements. Scope is set by audit posture, never by Azure versus non-Azure — which is precisely why Cloud Security is in this plan at all.

Figures above are from an actual PIE Specialization Report. Control counts and evidence requirements are read from the governed specialization catalog; the partner and customer detail on the source report is not reproduced here.

6. All 16 Audit-Heavy (ISSI) Specializations

These are the sixteen specializations that require a paid third-party audit by Information Security Systems International (ISSI). They span three solution areas — Azure, Security, and Modern Work via Copilot.

Azure — 11 specializations

Prerequisite designations vary. All eleven share the Azure Essentials Cloud Foundation Module A.

Security — 4 specializations

All four moved to the audit model on 30 July 2026. Each requires an active Solutions Partner designation in the Security solution area, and each carries its own Security Foundation Module A — the module is not shared between them.

Modern Work — 1 specialization

The only audited specialization outside Azure and Security, and the only one of the sixteen with no Module A.

7. The 12 Self-Attested Specializations

These twelve still validate through customer references and Partner Center telemetry rather than a third-party audit. The bar is different, not necessarily lower — you need customers willing to go on record about your work. How many is not a single number across the twelve, and we have not been able to verify it from Microsoft’s published requirements; confirm it on your specialization’s own Partner Center page.

Given the direction of travel in sections 1 and 2, treat this list as the current state, not a permanent one. Five specializations left it in a single month.

Modern Work — 6 specializations

Prerequisite: Solutions Partner for Modern Work. Focus on Teams, Microsoft 365 and collaboration workloads, with performance measured by Monthly Active User growth. Includes Calling for Microsoft Teams, Custom Solutions for Microsoft Teams, Meetings and Meeting Rooms for Microsoft Teams, Modernize Endpoints, Teamwork Deployment, and Clinical Applications. Copilot is no longer among them.

Business Applications — 6 specializations

Prerequisite: Solutions Partner for Business Applications. Includes Agentic Business Solutions, Finance, Sales, Service, Supply Chain, and Small and Midsize Business Management. Some of these are reported to require an AppSource marketplace listing. We could not verify that against Microsoft’s published requirements — the governed FY27 catalog records no marketplace requirement for any of the six, and every specialization where Microsoft does publish the field states “Microsoft Marketplace: N/A”. Confirm on the specialization’s own Partner Center page before planning around it. This is the only solution area with no audited specialization at all.

Note on Clinical Applications: PIE does not currently have sufficient verified Microsoft criteria to classify this specialization's audit posture with certainty. The governed catalog places it in Modern Work and records its audit posture as null — which must never be read as “no audit”. It is listed here because it is not on the audit list, but treat that placement as unconfirmed until Microsoft's published requirement is verified.

8. The Specialization-to-Incentive Map

Not all specializations unlock the same funding. Azure specializations generally provide the strongest incentive pipeline because they are tied to ACR, which feeds Azure Accelerate and ECIF. Note that Partner Earned Credit (PEC) is not published in the FY27 incentives guide at all — if your model still assumes it, rebuild the model. Here is what each solution area unlocks:

FY27 incentive programs publish per-engagement payout ladders, not annual totals per solution area. There is no summing field across the 69 published programs, published caps conflict between program groups, and several programs are prerequisite-chained to one another at the same engagement size — so any single “annual value” figure would be invented rather than derived. The Security figure above is the published Market A range across the Frontier Accelerate for Security ladder, per engagement.

9. The 5-Step Qualification Process

Step 1: Hold the Right Designation (Ongoing)

You need an active Solutions Partner designation aligned to the specialization. This requires 70+ points across Performance, Skilling, and Customer Success in Partner Capability Score. If you don't have the designation yet, that's your first priority — specializations build on top of it.

Step 2: Meet Performance Thresholds (Ongoing)

Azure specializations require specific ACR thresholds, and the spread is far wider than most partners assume: the governed FY27 catalog ranges from $1,500 (Hybrid Cloud Infrastructure with Azure Stack HCI) to $30,000 (Agentic DevOps, Azure VMware Solution, Infra and Database Migration, Networking Services), measured over the trailing 3 months. Check your specific target before assuming you are short — several thresholds are low enough that partners already clear them. The 4 Security specializations and Copilot use MAU growth or workload-specific ACR; the 12 self-attested specializations use MAU growth or seat deployment counts. These are measured continuously; you must stay above threshold.

Step 3: Hold Required Certifications (Plan 60+ Days Ahead)

Each specialization requires specific Microsoft certifications held by team members. Typically 2-5 individuals need current certs. Certification requirements refresh semi-annually — check Partner Center for current requirements before your audit window.

Step 4: Prepare Evidence or Customer References (60-90 Days)

For Azure: Gather Module A + Module B documentation from real customer projects within the evidence window (typically 12-24 months). For the 12 self-attested specializations: Identify the customers willing to provide references, and ensure they’re prepared for Microsoft’s outreach. We could not verify a required reference count for any of the twelve — the governed FY27 catalog records none, so confirm the number on your specialization’s own Partner Center page before you commit to it.

Step 5: Schedule and Complete Audit or Validation (2-4 Weeks)

Azure: Schedule through ISSI in Partner Center. The auditor reviews your documentation and may request clarifications. Self-attested specializations: Submit customer references in Partner Center and wait for Microsoft to validate them. The 4 Security specializations and Copilot do not use this route — they schedule an ISSI audit like the Azure specializations.

10. Common Qualification Mistakes

• Waiting too long to start. The 3-6 month timeline means you should begin qualification planning the moment you earn your Solutions Partner designation.
• Ignoring Module A reuse. Partners who don't plan their specialization sequence pay $3,600 per audit instead of $2,400 for the second and beyond.
• Evidence from the wrong time window. Module B evidence typically must be from the last 12-24 months. Projects from 3 years ago don't count, no matter how impressive.
• Not reading the ISSI guide before the audit. Every audited specialization has a published ISSI audit checklist — Microsoft hosts one for each Azure specialization, for all four Security specializations, and for Microsoft 365 Copilot. It tells you exactly what the auditor will check. Read it cover to cover.
• Forgetting AppSource for Business Applications. All 6 Business Applications specializations are commonly said to need a published AppSource listing — unverified against Microsoft’s published requirements, and not recorded in the governed FY27 catalog. If it applies to yours, approval takes weeks, so check first and start early.
• Letting certifications lapse before renewal. Microsoft checks certification status during renewal windows. A lapsed cert can block your renewal even if everything else is perfect.
• Not establishing PAL/DPOR/CPOR first. Your performance metrics depend on attribution. If your consultants aren't properly attributed, your ACR or MAU numbers may be too low to qualify.

11. Planning Your Specialization Sequence

If you're pursuing multiple specializations, order matters. Here's the strategic approach:

1. Start with the specialization closest to your existing evidence. If you've been doing data warehouse migrations for 3 years, that's your first target — not something aspirational.
2. Pick Azure first for Module A banking. Your first Azure specialization costs ~$3,600. Every subsequent one costs ~$2,400. Bank Module A early.
3. Align to your highest-ACR workload. The specialization that matches your biggest Azure consumption gets you the strongest incentive pipeline.
4. Add self-attested specializations for breadth. The 12 self-attested specializations — 6 Modern Work excluding Copilot, and 6 Business Applications — carry no audit fee and expand your co-sell surface area. Do not put the 4 Security specializations or Copilot in this bucket: since July 2026 they are audited — Security from 30 July, Copilot from 09 July — at ~$2,700–$4,000 each.
5. Target ECIF-eligible specializations first. Not all specializations carry the same ECIF weight. Azure infrastructure and security specializations currently unlock the strongest ECIF pipeline.