How Secure Are Cloud-Native Business Applications?

Cloud-native business applications are, for most mid-market organisations, more secure than the on-premises servers they replace, and not because the software is better written. Your provider takes over the layers a mid-sized business was never resourced to defend, while a fixed set of responsibilities stays with you. Cloud application security is the discipline of knowing where that line falls and holding your own side of it.

That is less comfortable than "the cloud is safe", and more useful. Cloud security is not perfect on either side of that line. Verizon's 2026 Data Breach Investigations Report, drawn from "more than 22,000 breaches", found the human element in 62% of them (Verizon). Almost none of that is a datacentre problem.

If your question is the architecture rather than its security, the differences between a cloud-based and a cloud-native application sit in a separate post.

Cloud application security divides along the shared responsibility model

In a software-as-a-service application your provider secures the datacentre, the host hardware, the operating system and the network controls. Four things stay with you in every deployment model, and Microsoft states it without qualification: "Regardless of the type of deployment, you always retain the following responsibilities".

• Your data, including classification, protection and encryption decisions.
• Your endpoints: the laptops, desktops and phones your people use to reach the service.
• Your accounts, including removing access when someone leaves.
• Access management: role-based access control, multifactor authentication and conditional access, the rules deciding when a sign-in is challenged.

Nobody sells you those four. They are yours whether you buy a platform, build one, or keep the server in the comms room.

For Microsoft Dynamics 365 Business Central, Microsoft lists "enterprise-grade encryption at rest and in transit", Microsoft Entra ID for centralised identity, multifactor authentication and "granular user permission controls and role-based access control (RBAC)", while assigning "audit logging and activity tracking for compliance" to the "partner/customer/auditor". Zoosh Digital's guide to the architecture principles behind a good ERP system puts it from your side: much of the ISO and GDPR control burden moves onto Microsoft's infrastructure. What does not move is what follows.

Where the real risk actually sits

Risk concentrates on identity, configuration and unpatched software rather than on the building your servers sit in. In the same Verizon report, exploitation of vulnerabilities was "the most prominent initial access vector in our dataset this year, reaching the height of 31%", ahead of phishing at 16% and credential abuse at 13%, though credential abuse still appeared somewhere in the attack chain in 39% of cases.

That first figure cuts both ways: the fault can sit on your provider's side as well as yours, and unpatched software is unpatched whoever runs it. An interface with weak authentication can let a caller bypass controls the application enforces properly. What the model tells you is which part is yours. Microsoft patches the platform beneath the service; you keep the endpoints, the accounts and anything built alongside it, because what is built on the platform is governed by whoever built it.

Multifactor authentication sits on your side of the line, inside Microsoft's own access-management responsibility, and it is a configuration decision rather than a feature you buy. Narrower access matters just as much: a compromised account reaches only what it was entitled to reach, and a marketing login rarely needs payment detail or payroll.

What changes when the application holds the general ledger

Once the application holds your general ledger, security stops being about keeping people out and becomes about what people can do once they are in. That is configured during your implementation, not purchased. Microsoft states that in Business Central "all users must be assigned one or more permission sets before they can access Business Central", and permissions are set per database object across five rights: read, insert, modify, delete and execute.

Segregating access by role

The useful setting is the middle one. Alongside blank and yes there is an "indirect" permission, which Microsoft defines as one where "the user can perform the action on the object, but only through another related object that the user has full access to". That is how someone posts a document without open access to the table behind it. SUPER, which opens everything the licence allows, is the set to issue sparingly and review by name. That is the mechanism behind your finance director's questions: who approves a payment, who changes a bank account, who sees payroll.

Approvals and the audit trail

Approval workflows, as Microsoft documents them, cover your purchase and sales documents, payment journals, customer cards and item cards, with approvers and amount limits set per user. A submitted record moves to Pending Approval, where it "remains locked for processing until all approvers approve the record". The change log "lets you track all direct modifications a user makes to data in the database", and field monitoring emails a nominated person when a chosen field, such as your company IBAN, is changed.

Microsoft attaches a caveat: "Tracking changes can affect performance, which can cost you time, and increase the size of your database, which might cost you money." Your audit trail is a scoped decision with a cost, which is why roles, permissions and governance sit inside Zoosh Digital's published Microsoft Cloud ERP design and implementation scope rather than arriving as defaults. If your prior question is whether an ERP fits at all, start with The Zoosh ERP Readiness Indicators, Zoosh Digital's published readiness framework.

The regulatory position for an Irish business in 2026

Four instruments shape what your business has to do about cloud application security in Ireland. Three are in force here, one is not, and the difference matters.

GDPR: the obligation does not move to the provider

The Irish statute is the Data Protection Act 2018 (Number 7 of 2018), which gives further effect to Regulation (EU) 2016/679 and establishes the Data Protection Commission (Irish Statute Book). In the ordinary cloud arrangement your business is the controller and your provider the processor: the controller "defines the purposes and means of the processing of personal data" and the processor acts only on documented instructions (Data Protection Commission). A compliant platform therefore does not produce a compliant business. The Commission's 2019 cloud guidance adds that a controller "must remain in control of the personal data it collects when it subcontracts the processing to a cloud provider" (Data Protection Commission, October 2019).

Your breach duty follows the same logic, and it is narrower than it is usually quoted at you. The Commission requires organisations to report a personal data breach to the supervisory authority "where the breach presents a risk to the affected individuals", within 72 hours of becoming aware of it (Data Protection Commission). Article 33(1) puts it as "without undue delay and, where feasible, not later than 72 hours after having become aware of it", and carves out the breach that "is unlikely to result in a risk to the rights and freedoms of natural persons" (EUR-Lex). Neither qualification removes your duty to assess every breach. Jurisdiction is part of the case for local delivery and single accountability.

NIS2: the obligation is coming, the Irish law is not yet in force

NIS2 is Directive (EU) 2022/2555, due to be transposed by 17 October 2024, and as a rule it applies to medium-sized and large entities in 18 sectors identified as critical (European Commission). As at September 2026, Ireland has not notified complete transposition, and on 8 July 2026 the Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union over that failure (European Commission). An IAPP analysis published on 26 February 2026 recorded that the draft text of the Irish legislation, the National Cyber Security Bill 2024, had still not been published, only its General Scheme. Ireland's National Cyber Security Centre confirms that registration and incident reporting portals are not yet available (NCSC). So no Irish NIS2 statute binds your company yet, and any Irish registration deadline or fine ceiling quoted at you comes from a Bill nobody has read.

DORA: in force since 2025, and narrower than it looks

DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, in application since 17 January 2025 (Central Bank of Ireland). It covers a wide range of regulated financial entities and, through them, their ICT third-party providers (ESMA), so it puts no direct obligation on a mid-market manufacturer or distributor unless you supply ICT services into a financial entity, where it can reach you by contract. Ireland's NCSC states that for financial market infrastructures, DORA "will take priority".

The EU Data Act: getting your data out is now a statutory right

Lock-in is a security-adjacent concern, because a system you cannot leave is one whose risks you keep accepting. The EU Data Act, Regulation (EU) 2023/2854, became applicable on 12 September 2025 and creates a switching framework for data processing services (European Commission). Article 25(2) caps the notice period for starting a switch at two months, and requires the switch to complete "without undue delay and in any event not after the mandatory maximum transitional period of 30 calendar days, to be initiated after the maximum notice period", so those 30 days run from the expiry of your notice period rather than from the day you ask. Where 30 days is technically unfeasible, Article 25(4) lets your provider propose an alternative period of no more than seven months, having told you within 14 working days. Article 29(1) provides that "From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process" (EUR-Lex), and the Commission puts the same date on removing "switching charges, including charges for data egress" (European Commission).

Where your data is physically held

For Dynamics 365 you choose the macro region geography, the broad region in which your customer data is stored, and Microsoft may replicate it to other datacentre regions inside that geography "for data performance, scale, and durability". Above it sits the EU Data Boundary, Microsoft's commitment to store and process customer data and personal data within EU and EFTA countries for Azure, Dynamics 365, Power Platform and Microsoft 365, with datacentres in fifteen countries including Ireland. Microsoft announced it complete on 26 February 2025.

Microsoft states the commitments are subject to limited circumstances in which data still leaves the boundary, and the continuing-transfer list, last updated 30 March 2026, names remote access by Microsoft DevOps and support personnel, sign-ins from outside the EU, and consulting data held in United States datacentres. Microsoft 365 Multi-Geo customers are outside its scope. So the accurate answer for your board is that the data sits inside the EU with a published list of named exceptions, not that it never leaves.

What to settle before you sign

If you are buying an off-the-shelf cloud application rather than building one, the due diligence on that product's security is yours. Four questions are worth putting in writing: where will our data be stored and replicated, who at your organisation can reach it, what can we export and in what format, and who notifies whom, within what time, when something goes wrong. Each has a documented answer for Business Central, and a provider who cannot answer them in writing has told you something.

Zoosh Digital is a Business Central implementation and technology partner working with organisations across the UK, Ireland and Europe, supporting cloud ERP, custom development and long-term optimisation. Where your own line falls is a design question, and it is cheaper to answer than to discover. Zoosh Digital's on-demand webinar Cloud-Native: Practices, Platforms, Services and Architectures covers the wider architecture.

FAQ

Where is our data physically held if we move to a cloud business application?

For Dynamics 365 you select the macro region geography where your customer data is stored, and Microsoft may replicate it inside that geography. The EU Data Boundary keeps customer data and personal data within EU and EFTA countries, subject to Microsoft's published list of continuing transfers out of it.

What happens if the cloud provider is breached, and who has to report it?

The reporting obligation stays with your business, and it carries a threshold. Under GDPR as implemented by the Data Protection Act 2018, the controller must report a personal data breach to the supervisory authority where the breach presents a risk to the affected individuals, within 72 hours of becoming aware of it, and in Ireland that authority is the Data Protection Commission. Article 33(1) frames the duty as "without undue delay and, where feasible, not later than 72 hours", and carves out a breach unlikely to result in a risk to the rights and freedoms of natural persons, so you assess every breach even where you do not report it. Microsoft, as processor, commits to notifying customers "in no more than 72 hours from the time we declared a breach", except in the circumstances its own page lists, and leaves the decision on notifying the regulator to the controller.

Does moving to the cloud make our business GDPR compliant?

No. Your business is normally the controller and your provider is the processor, and the Data Protection Commission's position is that a controller "defines the purposes and means of the processing of personal data" while a processor acts only on documented instructions. A compliant platform makes compliance achievable, not automatic.

Is an Irish company already bound by NIS2?

Not by an Irish NIS2 statute, because there is not one yet. As at September 2026, Ireland has not notified complete transposition of Directive (EU) 2022/2555, due by 17 October 2024, and on 8 July 2026 the European Commission decided to refer Ireland to the Court of Justice. An IAPP analysis published on 26 February 2026 recorded that the draft text of the National Cyber Security Bill 2024 had still not been published.

Can we get our data out of a cloud business application later?

Yes, and since 12 September 2025 there is a statutory framework for it. Under Article 25(2) of the EU Data Act your contract may set a notice period of no more than two months to start a switch, and the mandatory maximum transitional period of 30 calendar days runs from the expiry of that notice period, extendable under Article 25(4) to no more than seven months where the switch is technically unfeasible. Article 29(1) provides that from 12 January 2027 providers may not impose any switching charges for the switching process. Business Central online also exports your environment database as BACPAC files, up to 10 times per environment per month.

Referenced sources

• Verizon. www.verizon.com/business/resources/T161/reports/2026-dbir-data-breach-investigations-report.pdf.
• Microsoft Learn. learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility.
• Microsoft Learn. learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/security/security-and-protection.
• Microsoft Learn. learn.microsoft.com/en-us/dynamics365/business-central/ui-define-granular-permissions.
• Microsoft Learn. learn.microsoft.com/en-us/dynamics365/business-central/across-how-use-approval-workflows.
• Microsoft Learn. learn.microsoft.com/en-us/dynamics365/business-central/across-log-changes.
• Irish Statute Book. www.irishstatutebook.ie/eli/2018/act/7.
• Data Protection Commission. www.dataprotection.ie/en/organisations/know-your-obligations/controller-and-processor-relationships.
• Data Protection Commission. www.dataprotection.ie/sites/default/files/uploads/2019-10/Guidance%20for%20Engaging%20Cloud%20Service%20Providers_Oct19.pdf.
• Data Protection Commission. www.dataprotection.ie/en/organisations/know-your-obligations/breach-notification.
• EUR-Lex. eur-lex.europa.eu/legal-content/EN/TXT/HTML.
• European Commission. digital-strategy.ec.europa.eu/en/policies/nis2-directive.
• European Commission. digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules.
• IAPP. iapp.org/news/a/nis2-and-ireland-s-national-cyber-security-bill-what-management-boards-must-know-and-do.
• National Cyber Security Centre. www.ncsc.gov.ie/nis2.
• Central Bank of Ireland. www.centralbank.ie/regulation/digital-operational-resilience-act-dora.
• ESMA. www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora.
• European Commission. digital-strategy.ec.europa.eu/en/policies/data-act.
• EUR-Lex. eur-lex.europa.eu/legal-content/EN/TXT/HTML.
• European Commission. digital-strategy.ec.europa.eu/en/factpages/data-act-explained.
• Microsoft Learn. learn.microsoft.com/en-us/dynamics365/get-started/availability.
• Microsoft Learn. learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn.
• Microsoft. blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency.
• Microsoft Learn. learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-transfers-for-all-services.
• Microsoft Learn. learn.microsoft.com/en-us/compliance/regulatory/gdpr-breach-notification.
• Microsoft Learn. learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/tenant-admin-center-database-export.