Question about penetration testing of marketing forms

(1) Share

Report

Posted on by truc binh

Hi community,

We are currently using Dynamics 365 Customer Insights – Journeys. Our marketing team has created marketing forms and event registration forms, which are being embedded on our website for customers to register for events.
Recently, our security team asked whether these forms have been tested or implemented with security measures such as protection against cross-site scripting (XSS), SQL injection, and similar vulnerabilities—or if we need to implement these validations ourselves.
I would like to confirm whether the reports available on Microsoft Service Trust Portal include penetration testing for marketing forms.
How should we respond to this question from our security team?

Best Regards,

Binh.

Categories:

Dynamics 365 Customer Insights - Journeys

I have the same question (0)

All responses (1)

Answers (1)

Verified answer

MVP-Daniyal Khaleel 676 on at

Like (0)

Report

Question about penetration testing of marketing forms

The marketing forms and event registration forms used in Dynamics 365 Customer Insights – Journeys are hosted and processed entirely within the Microsoft Cloud infrastructure. These forms are part of the Dynamics 365 platform, which inherits Microsoft’s enterprise-grade security framework and compliance controls.Microsoft performs regular penetration testing, code reviews, and security assessments on Dynamics 365 online services as part of their Software Development Lifecycle (SDL) and Operational Security Assurance (OSA) programs.Details of these assessments , including third-party audits, certifications, and penetration testing summaries ,are available through the Microsoft Service Trust Portal under the Dynamics 365 and Microsoft 365 sections.It’s important to note that while the platform (including form rendering, submission endpoints, and data storage) is secured and tested by Microsoft, any custom JavaScript, HTML embedding, or third-party integrations added when embedding the forms on your website are considered customer responsibility. These should be reviewed and tested by our own security team for XSS, injection, or other vulnerabilities that could arise from local customization or embedding.

Was this reply helpful? Yes No