SOX is the standard for change management for financial companies to prevent shadow changes that could enable another Enron, Worldcom, or Adelphia style cooking-of-books financial scandal. The idea is that all changes should be fully analyzed for their impact. If a change is found to have been made without going through the controls process then a review and an emergency after-the-fact change record must be created. This leads me to believe you did not just login to a server, unless you weren't supposed to have access in the first place (separation of duties requirement), but actually made a modification to that server without an approved change.
All this means that the system is very resilient and will not suffer random outages but most importantly, in the SOX world, there is no avenue for malicious changes to be introduced to critical financial systems and their data.
Even good and thoughtful regulations get interpreted into nonsensical bureaucratic nightmares by some companies’ compliance departments. The implementations that add disproportionate friction usually don’t achieve the intended benefit either. It’s not people choosing a convenience vs. safety tradeoff. It’s just people who don’t understand the subject matter at all.
As a result what we end up having is this shadow-structure/architecture at the company that is highly resistant to change, such that when new projects are discussed and designed, oftentimes decisions are made that are technically worse but save time due to not messing with the SOX structure.
I feel the Azure choice might be due to a similar phenomenon. Maybe the Azure people promise all sorts of out-of-the box HIPAA compliance and insurance and security etc. and the upper management is happy not having to deal with it. Price difference almost doesn't matter very much, if saving a few bucks means that you'll now have to hire and retain a team to design and maintain compliance in your AWS stack. I've no idea if this is actually what happens but it smells like it.