What security certifications should I expect a reputable CSP partner to have?

While Microsoft's own cloud infrastructure carries extensive certifications (ISO 27001, SOC 2, etc.) independent of any partner, it's reasonable to ask a CSP partner about their own internal security practices — such as how they protect their own systems and credentials used to access customer tenants, whether they have documented security policies, and whether they carry relevant industry certifications or insurance.

A partner that can speak clearly and specifically to their own security practices (rather than only pointing to Microsoft's certifications) is generally a good sign.