ITAR Compliance Consultants for Microsoft 365: Who Can Fix It?

Quick answer. ITAR compliance consultants you bring in to fix a Microsoft estate come in three kinds: export-control counsel, export compliance consultancies and Microsoft government-cloud integration firms. If technical data may have reached a foreign person, engage counsel first, then choose the others by who will touch your data.

If an access review has just found a foreign national in a Teams channel or SharePoint library that holds drawings, or an access list that does not reconcile, your export-control function will ask IT which firm to bring in to fix it. The Directorate of Defense Trade Controls (DDTC) lists “Unauthorized access to technical data” among the examples of common violations on its Report a Violation page, and 22 CFR 120.56 describes a release as including “The use of access information to cause or enable a foreign person, including yourself, to access, view, or possess unencrypted technical data”. Whether a release occurred is a determination for your export-control function and counsel, and this guide does not make it. It covers which kinds of firms to bring in, in what order, and the questions that separate one firm from another. Each regulatory, Microsoft and firm statement in this guide is quoted from its own page as read on October 19, 2026, with its link.

Where the open question is still whether your data is export-controlled at all, that comes first and is covered in the guide to which compliance regime applies.

The Order in Which to Engage the Firms

If technical data may already have reached a foreign person, the order of work matters because of how a voluntary disclosure is built. Under 22 CFR 127.12, a company that discloses should notify DDTC “immediately after a violation is discovered”, and where that first notice is incomplete, “a full disclosure must be submitted within 60 calendar days of the notification”, and a senior officer of the company “may request an extension of time in writing”. The same section asks for “A description of corrective actions already undertaken that clearly identifies the new compliance initiatives implemented to address the causes of the violations”. The remediation work you commission becomes part of what that description covers. Whether to disclose is the company’s decision, taken with counsel; this guide describes the rule and does not advise on it.

1. Export-control counsel. Counsel advises on whether a violation occurred, on a disclosure and its timing, and on how the remaining work is sequenced.
2. An export compliance consultancy. The consultancy reviews and rewrites the program itself: policies, procedures, classification of the data and training.
3. A Microsoft government-cloud integration firm. The integration firm changes who can reach technical data in Teams, SharePoint and Azure, and where that data is stored.

Where no release is suspected and the gap is a program that has drifted, the consultancy’s program review can come first, with the integration firm working from its findings.

What Each Kind of Firm Does

Export-control law firms advise on whether a release occurred, prepare a voluntary disclosure, and represent the company before DDTC. One example is Torres Trade Law, which describes itself on its home page as an “International Trade & National Security Law Firm” and lists “International Traffic in Arms Regulations (ITAR)” under its Exports practice, alongside a “Corporate & Internal Investigations” practice.

Export compliance consultancies build and review the written program, classify products and data, and train staff. One example is Export Solutions, Inc., whose home page lists “Compliance Program Development”, “Classification Projects” and “Audits & Assessments” among its services and describes “Reviewing your trade compliance program to find areas that need improvement in policies and procedures.”

Microsoft government-cloud and integration firms work in the tenant: Teams channel membership, SharePoint permissions, guest access, identity governance and where files are stored. One example is Summit 7, a firm in Huntsville, Alabama, whose guide “What is ITAR Compliance?” covers export licensing and Microsoft’s government cloud offerings. If you are weighing whether one integrator can carry CMMC, ITAR and DFARS work in a single engagement, that question is answered in Microsoft system integration for CMMC, ITAR and DFARS

CMMC Registered Practitioner Organizations that also advise on ITAR, and large federal systems integrators, take this work as well. Ask each one which of the three roles described in this section it is proposing to fill, and which it expects another firm to fill. The three firms named in this section are examples of their kinds, listed in no order of preference.

Two roles stay inside your company whichever firms you hire. Under 22 CFR 120.67, the rule states: “Empowered official means a U.S. person who”, among other conditions, “Is directly employed by the applicant or a subsidiary in a position having authority for policy or management within the applicant organization”, with the independent authority to “Refuse to sign any license application or other request for approval without prejudice or other adverse recourse”. The decision to disclose, as described in the order of engagement, is the company’s own. An outside firm supports both; it does not hold either.

Questions That Separate One Firm From Another

If you are comparing proposals, these five questions apply to all three kinds of firm. A useful answer names people, documents and rules, not a badge.

1. Who on your team will access our technical data, and on what basis? 22 CFR 120.62 defines a U.S. person, for an individual, as “a person who is a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3)”. Ask the firm to name the people who will touch your data and state their status under that definition. Where a firm’s offices are located is a separate fact from that status.
2. Do you build the program to DDTC’s own description of a good one? DDTC’s How To Comply page says “A good program is generally” “Clearly documented in writing”, “Tailored to the business”, “Regularly reviewed/updated” and “Fully supported by management”. Ask to see how a past program deliverable met each of the four, with client details removed.
3. How does your design relate to 22 CFR 120.54(a)(5)? 22 CFR 120.54 describes technical data “Secured using end-to-end encryption” and secured with cryptographic modules that conform to FIPS 140-2 “or its successors”, and states that the ability to access data encrypted that way “does not constitute the release or export of such technical data”. A firm should walk through each criterion from the text and leave the determination to your export-control function.
4. What does any certification named in your proposal certify? Microsoft’s International Traffic in Arms Regulations (ITAR) page states: “While there’s no compliance certification for the ITAR, Microsoft designs and operates its in-scope services to be capable of supporting a customer’s ITAR obligations and compliance program.” If a proposal uses the word certification, ask who issued it and what it covers.
5. Will your records stand as the description of corrective actions? Among the mitigating factors DDTC may consider, 22 CFR 127.12 lists “Whether the person has instituted or improved an internal compliance program to reduce the likelihood of future violation”. Ask what records the engagement leaves behind and whether a reviewer outside the firm could follow them.

The last question carries weight after the engagement ends. DDTC’s Compliance Actions page says consent agreements “often run 3-4 years” and can include conditions such as “Compliance program improvements” and “Appointment of a Special Compliance Official”, which is one reason to ask for records that a later reviewer can follow.

Where Microsoft’s Commitments Stop and the Tenant Work Starts

If your firm choice depends on what Microsoft already covers, read Microsoft’s own boundary first. Its ITAR page states: “Microsoft Azure Government and Microsoft Office 365 U.S. Government for Defense provide support for customers with data subject to the ITAR through additional contractual commitments to customers regarding the location of stored data, and limitations on the ability to access such data to US persons.” It adds: “Microsoft provides these assurances for the infrastructure and operational components of these government cloud services, but customers are ultimately responsible for the protection and architecture of their applications within their environments.” It also states: “Customers must sign additional agreements formally notifying Microsoft of their intention to store ITAR-controlled data”.

Teams channel membership, SharePoint library permissions, guest access and sharing links are set in your own tenant, on your side of that boundary, and that is where the integration firm works. Once a firm is chosen, the redesign architecture is set out in our guide to redesigning an ITAR export-control program in Microsoft 365. If the remediation ends in a move to a different Microsoft tenant, choosing the firm for that move is covered in hiring a Microsoft 365 GCC High implementation firm.

When an Integration Firm Should Not Come First

If a suspected release is still unfolding and counsel has not been engaged, bringing in an integration firm first puts the order of engagement in reverse. Changes made to access and storage before counsel is engaged become part of the record that counsel later has to describe. Timing also bears on a disclosure: 22 CFR 127.12 applies “only when information is received by the Directorate of Defense Trade Controls for review prior to such time that either the Department of State or any other agency, bureau, or department of the United States Government obtains knowledge of either the same or substantially similar information from another source and commences an investigation or inquiry that involves that information”.

The second case is a data set no one has classified. 22 CFR 120.33 defines technical data to include information “which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles”, including “blueprints, drawings, photographs, plans, instructions, or documentation”. Until your export-control function has said which libraries and channels hold that kind of information, an integration firm has no boundary to scope its access controls against, so the classification work comes first.

How i3solutions Works on the Microsoft Half

When your team brings the tenant side of an ITAR remediation to i3solutions, the work starts from an inventory of who can reach each Teams channel, SharePoint library and Azure resource that your export-control function has identified as holding technical data, and it is scoped to work alongside the counsel and program consultancy you have engaged. i3solutions has deep experience implementing identity governance for enterprises in aerospace and defense manufacturing, financial services, and healthcare, including environments with CMMC and ITAR obligations. i3solutions has delivered enterprise SharePoint and Power Platform programs for aerospace and defense manufacturers, major defense organizations, a financial-services firm, a national healthcare system, and military organizations.

i3solutions is entirely U.S.-based. Every i3solutions employee is U.S.-based, every i3solutions project is U.S.-based, and every technology i3solutions delivers is U.S.-based. That is a statement of where the work happens. Status under 22 CFR 120.62, the first of the five questions for comparing firms, is a separate fact that each firm answers person by person for the people named on your engagement, i3solutions included.

Key Takeaways

• When you choose ITAR compliance consultants for a Microsoft estate, there are three kinds: export-control counsel, export compliance consultancies and Microsoft government-cloud integration firms.
• If technical data may have reached a foreign person, engage counsel first: 22 CFR 127.12 sets 60 calendar days for a full disclosure after an incomplete first notice, unless an extension is granted, and the disclosure describes the corrective actions taken.
• Ask each firm who will touch your technical data and their status under 22 CFR 120.62, and how its work meets DDTC’s four program criteria.
• Microsoft’s ITAR page says there is no compliance certification for the ITAR and that customers are responsible for the protection and architecture of their applications, which is the tenant work an integration firm carries.
• The official who signs license applications under 22 CFR 120.67, and the decision to disclose, stay inside your company whichever firms you hire.

Sources

• Electronic Code of Federal Regulations, title 22, up to date as of October 15, 2026: 120.33, 120.54, 120.56, 120.62, 120.67 and 127.12, read October 19, 2026. eCFR notes an amendment to 120.54 published August 28, 2026; check the current text before relying on it.
• Directorate of Defense Trade Controls, How To Comply, Report a Violation and Compliance Actions, read October 19, 2026.
• Microsoft Learn, International Traffic in Arms Regulations (ITAR), last updated June 2, 2026, read October 19, 2026. Microsoft updates this page from time to time; check the current text before relying on it.
• Firm pages, each read October 19, 2026: Torres Trade Law home page, Export Solutions, Inc. home page and Summit 7, What is ITAR Compliance?