Posted by: kurtsh | August 7, 2026

HOWTO: Implement FBI CJIS 6.0-auditable configurations of Azure Commercial cloud

Earlier this year, our Director of Solutions Engineering for State & Local Government, Mike Smucny, documented the process for setting up a CJI-auditable Azure Commercial environment to allow law enforcement & justice agencies to deliver a CJI-ready, secure “Azure Commercial” cloud instance – mitigating the need for using “Azure Government”.

This blog focuses on the technical controls required to use Azure Commercial for CJIS workloads. With the release of CJIS Security Policy 6.0 in late 2024, agencies now have a clear pathway to leverage Azure Commercial through Customer Managed Keys (CMK) and other advanced security measures, rather than relying solely on vendor personnel screening. However, it’s critical to understand: Microsoft provides the tools; your agency and your state CJIS Systems Agency (CSA) determine compliance. 3/19/2026 Update Step 3.b-Confidential Computing Clarification: Azure Commercial and Customer Managed Key (CMK) encryption satisfy the requirements of the CJIS Security Policy but customers can choose to add an additional control through a Confidential Computing enclave.

We have documented a “Step-by-Step Walkthrough for CJIS 6.0 in Azure Commercial” that breaks down the process of establishing a CJI-auditable configuration in multiple phases:

  • Phase 1: Foundation & Residency
  • Phase 2: The “Technical Control” (Encryption)
  • Phase 3: Identity & Access (CJIS 6.0 Focus)
  • Phase 4: Continuous Monitoring
  • Phase 5: Endpoint & Mobile
  • Phase 6: Personnel & Documentation

To review the complete walkthrough, visit:

If you require guidance to implement the above walkthrough, work through your Unified Services to request a Cloud Solutions Architect. Additionally, there are Microsoft Partners that can assist with this as well.

Posted in Uncategorized

«

Categories