Cyber insurance renewals have turned into security audits. The questionnaire asks about MFA, endpoint detection, backups and admin accounts, and a wrong answer can mean a higher premium, an exclusion or a denied claim later. The good news for Microsoft 365 tenants is that most questions map directly to a setting you can check and prove. This guide maps common cyber insurance questions to Microsoft 365 controls, shows where to find the evidence, and flags the answers that cause trouble at claim time.
Why honest, evidenced answers matter
The questionnaire is part of your policy. If you answer “yes, MFA is enforced for all users” and an investigation after an incident finds a service account or a group of users excluded, the insurer may argue the application was inaccurate. That is a bad conversation to have in the middle of a breach.
Two habits prevent it:
Answer for the whole tenant, not the intended state. “We rolled out MFA” is not the same as “MFA is enforced for every account.”
Keep evidence. A screenshot or export of each control, dated, stored with the application. You will want it at renewal and after any claim.
The mapping table
Wording varies by carrier, but most questionnaires cover the same ground. Here is how the common questions map to Microsoft 365.
Typical question
Microsoft 365 control
Where to find evidence
License
Is MFA required for all email access?
Conditional Access policy requiring MFA for all users and all cloud apps
Entra admin center, Conditional Access policies, plus the authentication methods registration report
Entra ID P1 (Business Premium, E3)
Is MFA required for remote access?
Same policy, plus MFA on any VPN or Entra Private Access
Conditional Access, Global Secure Access settings
Entra ID P1
Is MFA required for privileged accounts?
Conditional Access for directory roles, ideally phishing-resistant
Policy targeting admin roles
Entra ID P1
Is legacy authentication disabled?
Conditional Access block on legacy clients
Policy plus sign-in logs filtered by client app
Entra ID P1
Do you use EDR on all endpoints?
Defender for Business or Defender for Endpoint Plan 2
Defender portal device inventory, onboarding status
Business Premium or E5
Is email filtered for phishing and malware?
Defender for Office 365 Safe Links, Safe Attachments, anti-phishing
Defender portal, Email & collaboration policies
Defender for Office 365 Plan 1+
Do you use SPF, DKIM and DMARC?
DNS records plus DKIM signing in Defender
DNS lookup, DKIM page in Defender portal
Included
Are laptops encrypted?
Intune disk encryption policy (BitLocker, FileVault)
Intune encryption report
Intune (Business Premium, E3)
Are patches applied within a set time?
Windows Autopatch or Update rings in Intune
Intune or Autopatch update reports
Intune
Do you back up data, with offline or immutable copies?
Microsoft 365 Backup or third-party backup
Backup console, last successful restore test
Pay-as-you-go or third party
Do you provide security awareness training?
Attack simulation training, or a dedicated training program
Simulation and training completion reports
Defender for Office 365 Plan 2 for attack simulation
How long do you retain logs?
Microsoft Purview Audit
Audit retention policies
Audit (Standard) or Premium
The questions that most often get answered wrong
“MFA for all users”
In the tenants I review, the most common gap is exclusions. A Conditional Access policy that requires MFA for “All users” but excludes a group called “MFA exceptions” with fifteen people in it does not meet the question. Neither does relying on per-user MFA for some accounts and nothing for others. Check exclusions, and check the authentication methods registration report to confirm users have actually registered a method.
Break-glass emergency accounts are a legitimate exclusion. Document them, protect them with strong credentials or FIDO2 keys, and alert on their use.
“EDR on all endpoints”
Defender for Business, included in Business Premium, is an EDR product. The gap is coverage. Compare the device count in the Defender portal with your actual fleet, including Macs and servers. Servers need a separate Defender for Servers or Defender for Business servers license.
“Immutable or offline backups”
Microsoft’s built-in replication and recycle bins are not what insurers mean. They want a backup that an attacker with admin credentials cannot destroy, and evidence that you have tested a restore. Microsoft 365 Backup uses immutable, append-only storage. Many third-party products offer similar protection. Either way, record the date of your last restore test.
“Privileged access management”
Insurers increasingly ask whether admins use separate accounts and whether admin access is time-limited. Separate admin accounts are free. Just-in-time elevation through Privileged Identity Management requires Entra ID P2, included in E5.
A renewal-ready evidence pack
Build this once and refresh it each year before the questionnaire arrives:
Export of every Conditional Access policy, with assignments and exclusions
Email authentication status for each domain (SPF, DKIM, DMARC)
Backup configuration and the result of the most recent restore test
Security awareness training completion rates
Your incident response plan, with contact details for the insurer’s breach hotline
Microsoft Secure Score with its history, as a summary of overall posture
Secure Score is not a pass/fail measure, and insurers do not usually ask for it directly, but its history tab is a useful way to show steady improvement. Microsoft explains it in Microsoft Secure Score.
Fixing gaps before the deadline
If the questionnaire exposes gaps, prioritize the items that most often appear as conditions of cover: MFA everywhere, EDR on every device, tested backups and phishing training. Most can be closed in weeks rather than months on Business Premium.
For MFA rollout and Conditional Access, see MFA enablement.
For a quick external look at your tenant’s email and identity setup, try our tenant checker.
Frequently asked questions
Does Microsoft 365 Business Premium meet cyber insurance requirements?
Business Premium includes the tools for most common requirements: Conditional Access MFA, Defender for Business EDR, Defender for Office 365 email filtering and Intune device encryption. What matters is that the controls are configured across every user and device. Backup usually needs an additional product.
What evidence do insurers want for cyber insurance Microsoft 365 controls?
Dated exports or screenshots of Conditional Access policies, MFA registration, device onboarding, encryption status, backup configuration and training completion. Keep them with your application so you can show what was true when you answered.
Is per-user MFA enough for a cyber insurance questionnaire?
It can technically satisfy the question if every account is covered, but it is easy to miss accounts. Conditional Access applied to all users, with documented emergency exclusions only, is easier to prove and maintain.
Cyber insurance renewals have turned into security audits. The questionnaire asks about MFA, endpoint detection, backups and admin accounts, and a wrong answer can mean a higher premium, an exclusion or a denied claim later. The good news for Microsoft 365 tenants is that most questions map directly to a setting you can check and prove. This guide maps common cyber insurance questions to Microsoft 365 controls, shows where to find the evidence, and flags the answers that cause trouble at claim time.
Why honest, evidenced answers matter
The questionnaire is part of your policy. If you answer “yes, MFA is enforced for all users” and an investigation after an incident finds a service account or a group of users excluded, the insurer may argue the application was inaccurate. That is a bad conversation to have in the middle of a breach.
Two habits prevent it:
The mapping table
Wording varies by carrier, but most questionnaires cover the same ground. Here is how the common questions map to Microsoft 365.
The questions that most often get answered wrong
“MFA for all users”
In the tenants I review, the most common gap is exclusions. A Conditional Access policy that requires MFA for “All users” but excludes a group called “MFA exceptions” with fifteen people in it does not meet the question. Neither does relying on per-user MFA for some accounts and nothing for others. Check exclusions, and check the authentication methods registration report to confirm users have actually registered a method.
Break-glass emergency accounts are a legitimate exclusion. Document them, protect them with strong credentials or FIDO2 keys, and alert on their use.
“EDR on all endpoints”
Defender for Business, included in Business Premium, is an EDR product. The gap is coverage. Compare the device count in the Defender portal with your actual fleet, including Macs and servers. Servers need a separate Defender for Servers or Defender for Business servers license.
“Immutable or offline backups”
Microsoft’s built-in replication and recycle bins are not what insurers mean. They want a backup that an attacker with admin credentials cannot destroy, and evidence that you have tested a restore. Microsoft 365 Backup uses immutable, append-only storage. Many third-party products offer similar protection. Either way, record the date of your last restore test.
“Privileged access management”
Insurers increasingly ask whether admins use separate accounts and whether admin access is time-limited. Separate admin accounts are free. Just-in-time elevation through Privileged Identity Management requires Entra ID P2, included in E5.
A renewal-ready evidence pack
Build this once and refresh it each year before the questionnaire arrives:
Secure Score is not a pass/fail measure, and insurers do not usually ask for it directly, but its history tab is a useful way to show steady improvement. Microsoft explains it in Microsoft Secure Score.
Fixing gaps before the deadline
If the questionnaire exposes gaps, prioritize the items that most often appear as conditions of cover: MFA everywhere, EDR on every device, tested backups and phishing training. Most can be closed in weeks rather than months on Business Premium.
Frequently asked questions
Does Microsoft 365 Business Premium meet cyber insurance requirements?
Business Premium includes the tools for most common requirements: Conditional Access MFA, Defender for Business EDR, Defender for Office 365 email filtering and Intune device encryption. What matters is that the controls are configured across every user and device. Backup usually needs an additional product.
What evidence do insurers want for cyber insurance Microsoft 365 controls?
Dated exports or screenshots of Conditional Access policies, MFA registration, device onboarding, encryption status, backup configuration and training completion. Keep them with your application so you can show what was true when you answered.
Is per-user MFA enough for a cyber insurance questionnaire?
It can technically satisfy the question if every account is covered, but it is easy to miss accounts. Conditional Access applied to all users, with documented emergency exclusions only, is easier to prove and maintain.
Renewal coming up? Book a free Microsoft 365 security assessment and we will check each common questionnaire item against your tenant before you sign.