Cyber insurance questionnaire: the Microsoft 365 evidence behind each answer

The short version: Most cyber insurance questions about Microsoft 365 are yes/no, but an honest "yes" needs a dated export behind it. This guide walks through the usual questions, shows where each answer lives in Microsoft 365, and names the common gaps that turn a confident "yes" into an honest "no".

A cyber insurance questionnaire looks like a form, but it is really a request for proof that a handful of controls are on across your whole tenant, not just on the account of the person filling it in. If you run Microsoft 365, nearly every answer can be checked in a few admin portals. The portals show today's configuration, while a signed application covers the whole policy period. Dated evidence closes that gap.

This article is for IT managers and finance or operations leads at small and mid-sized companies who have been handed a renewal form. One caveat up front: every insurer and broker writes its own form and decides for itself what it accepts. Nothing here tells you what your insurer will accept. Treat it as a way to get your own house in order before you sign.

What is a cyber insurance questionnaire really asking?

Underwriters want to know how likely a claim is and how bad it would be. Coalition, a cyber insurer, lists multi-factor authentication, staff training, backups, identity and access management and data classification among its core requirements, and also mentions EDR or antivirus and incident response plans (read 27 October 2026). The UK National Cyber Security Centre's cyber insurance guidance (published 6 August 2020, read 27 October 2026) tells buyers to keep accurate security documentation for the annual policy reassessment, and recommends keeping backups separate from the network or in a cloud service built for the purpose.

The mistake to avoid is answering from memory or from the original design. The question is not "did we intend to enforce MFA?" It is "is MFA enforced today for every account that can reach email, remote access and admin roles, and can we show it?"

Which Microsoft 365 questions do insurers commonly ask?

The questions below reflect themes that recur in published insurer guidance and common application forms. Wording differs by insurer, so read your own form closely. For each one we cover four things: what it checks, where the answer lives, what evidence helps, and the common gap.

Is MFA enforced for email and remote access?

• What it really checks: Whether a stolen password alone is enough to read mail or get into your systems. Insurers care about coverage, not about whether MFA exists somewhere.
• Where in Microsoft 365: Microsoft Entra admin center, under Entra ID, Conditional Access, Policies. Then Entra ID, Authentication methods, Activity, where the Registration tab and the user registration details report show which users are MFA capable (Microsoft documentation, page updated June 2026, read 27 October 2026).
• Evidence that helps: A dated list of Conditional Access policies showing the state of each (On, Report-only or Off), their user and app scope and their exclusions. Plus a dated export of the user registration details report, filtered to show any user who is not MFA capable.
• Common gap: A policy that requires MFA but is still in report-only mode. Microsoft's own documentation is clear that report-only policies are evaluated but not enforced (updated June 2026, read 27 October 2026). Users are never prompted and never blocked. A second common gap is an "All users" policy with an exclusion group that quietly grew to include executives, shared mailboxes or "temporary" accounts.

Capable of MFA is not the same as required to use it: a registered user can still sign in without being asked if no enforced policy covers them. Use the policy list and the registration report together.

Are administrator and privileged accounts protected separately?

• What it really checks: Whether the accounts that can change everything are the hardest to take over, and whether there are too many of them.
• Where in Microsoft 365: Entra ID, Roles and administrators, for the list of role holders. Conditional Access for any policy that targets directory roles. Privileged Identity Management, where your licence includes it, for eligible versus permanent assignments.
• Evidence that helps: A dated export of role assignments (who holds Global Administrator and other privileged roles), the number of Global Administrators, and the MFA method each admin uses. Stronger evidence shows administrators use separate, non-mailbox admin accounts and phishing-resistant methods such as passkeys.
• Common gap: The break-glass account. Microsoft recommends two or more emergency access accounts (updated June 2026, read 27 October 2026), excluded from Conditional Access policies that block or restrict sign-in, protected by a passkey or certificate, and monitored with alerts. Some tenants have either none, or one with a password and no MFA and no alert on use. The honest answer to "is MFA enforced on all admins?" becomes "yes, except these accounts, which are controlled like this". Write the exception down.

Microsoft's mandatory MFA rules (updated October 2026, read 27 October 2026) cover the Azure, Entra, Intune and Microsoft 365 admin portals, break-glass accounts included. That is an admin-portal rule. It does not replace a policy for mail and apps.

Is legacy authentication blocked?

• What it really checks: Whether an attacker can bypass MFA by using an old protocol that cannot prompt for it, such as POP, IMAP or older SMTP clients.
• Where in Microsoft 365: Entra ID, Monitoring & health, Sign-in logs, filtered on Client app, on both the interactive and non-interactive tabs. Microsoft describes this under blocking legacy authentication with Conditional Access (updated March 2026, read 27 October 2026). The Exchange admin center holds the related mail-flow settings.
• Evidence that helps: The Conditional Access policy that blocks legacy client apps, shown as On, plus a dated sign-in log export covering the last 30 days that shows no successful legacy sign-ins (or listing the ones that remain and why).
• Common gap: SMTP AUTH. Microsoft states that Basic authentication is disabled in all tenants (updated July 2026, read 27 October 2026) for most protocols, but SMTP AUTH is still available, with Microsoft publishing a separate retirement timeline for its Basic authentication. Printers, scanners and line-of-business applications often rely on it. If it is enabled, know which devices use it, and why. Check before answering "no legacy authentication".

Are SPF, DKIM and DMARC configured, and is external forwarding controlled?

• What it really checks: Whether someone can send mail that appears to come from your domain, and whether a compromised mailbox can silently copy mail out of the company.
• Where in Microsoft 365: SPF and DMARC are DNS records at your domain host. DKIM signing is switched on per domain in the Microsoft Defender portal. External forwarding is controlled in the outbound spam policy in Defender, and reported in the Exchange admin center's auto-forwarded messages report.
• Evidence that helps: A dated DNS lookup of the SPF and DMARC records for each sending domain, a dated screenshot or export showing DKIM enabled, and the outbound spam policy showing automatic forwarding set to Off. Microsoft documents the DMARC set-up and the move from p=none through p=quarantine to p=reject (updated July 2026, read 27 October 2026) and the controls for automatic external forwarding (updated August 2026, read 27 October 2026).
• Common gap: A DMARC record that exists but stays at p=none, so it monitors without protecting. Also parked or old domains with no DMARC record at all, and the *.onmicrosoft.com domain, which Microsoft says needs its own record if unused. On forwarding, the default setting is "Automatic - System-controlled", which Microsoft says behaves differently depending on when the organisation was created, so set it explicitly rather than assuming.

DMARC at p=none is a legitimate stage. Say where you are and when you plan to move to quarantine or reject.

Is endpoint protection or EDR on every device?

• What it really checks: Whether a laptop that clicks a bad link has something that can stop or at least detect the attack, and whether you can say how many devices are covered.
• Where in Microsoft 365: Microsoft Defender portal (device inventory, onboarding status) and Intune admin center, Devices (compliance state, which devices are managed at all).
• Evidence that helps: A dated export listing every device with its operating system, protection status and last check-in, compared with your headcount.
• Common gap: The unknown device. "100% of endpoints" falls apart when the inventory shows devices that have not checked in for 90 days, personal laptops reading mail, or Macs never enrolled. If personal devices access company mail, say so and describe the control, such as app protection or browser-only access.

If you are building device management from scratch, see our Microsoft Intune pricing page.

Are systems patched and kept up to date?

• What it really checks: How quickly known vulnerabilities are closed on devices and software you control.
• Where in Microsoft 365: Intune update rings and the Windows Update for Business reports; Defender vulnerability management where licensed.
• Evidence that helps: A dated export of update compliance per device and the policy that sets the install deadline.
• Common gap: A patch policy with no proof devices follow it. Devices that are switched off, off the network or not enrolled never show up as failing. Servers and third-party software sit outside Intune, so answer for the whole estate.

Are backups in place, including Microsoft 365 data?

• What it really checks: Whether you can recover from ransomware or deletion without paying, and whether the backup would survive the same attack.
• Where in Microsoft 365: Retention and recycle bins are not backup. Microsoft's Services Agreement (read 27 October 2026) tells customers to back up their own content and data. Backup of mailboxes, SharePoint, OneDrive and Teams is normally a separate service you buy and configure.
• Evidence that helps: The backup job report showing the last successful run per workload, a dated restore test with its result, and where copies are stored and who can delete them.
• Common gap: Answering "yes" because files sync to OneDrive. Sync copies a deletion or an encrypted file as faithfully as a good one. Another gap is a backup that shares the admin identity, so an attacker who takes the tenant can delete the backups too.

NCSC's test, backups kept separate from your network or in a service built for the purpose, is a sensible one. Our cloud managed backup service covers this ground.

Is there logging, and for how long is it kept?

• What it really checks: Whether, after an incident, you could work out what happened and how far it went.
• Where in Microsoft 365: Microsoft Purview, Audit, for the unified audit log; Entra sign-in and audit logs; Defender for alerts and incidents.
• Evidence that helps: A screenshot or export showing that auditing is on, the retention period you actually have, and a sample search that returns results. Microsoft's Purview auditing documentation (updated May 2026, read 27 October 2026) states 180 days of retention for Audit (Standard), and up to one year for Entra, Exchange, SharePoint and OneDrive records with Audit (Premium).
• Common gap: A form that asks for a retention period longer than the 180 days the tenant has. Export logs to a separate store on a schedule or change the licence; do not simply tick the box.

Do you run phishing awareness training?

• What it really checks: Whether staff report a suspicious email instead of clicking it.
• Where in Microsoft 365: If licensed, attack simulation training in the Defender portal; otherwise your training provider's records.
• Evidence that helps: A dated completion report by employee and the date of the latest simulation.
• Common gap: Training run once at onboarding with no record, and nothing for contractors or new joiners.

Do you have an incident response plan?

• What it really checks: Whether people know who to call and what to do first when something happens at 2 a.m.
• Where in Microsoft 365: Mostly a document, supported by Defender alert policies (who gets told) and Purview audit (how you would investigate).
• Evidence that helps: The dated plan with an owner, the contact list including the insurer's breach hotline, and the date of the last exercise.
• Common gap: A plan that lives in one person's head, or a contact list naming someone who left.

Screenshot or dated export: which counts as evidence?

Insurers ask for different proof, and many ask for none until a claim. Preparing the stronger kind anyway costs little and makes your answers easier to defend.

Dated screenshot compared with dated export

• Dated screenshot: Quick and easy to read. It shows one view, on one day, and it is easy to crop or to take of the wrong tenant. Good for settings such as "DKIM enabled" or "Auditing on".
• Dated export (CSV, JSON or a PowerShell output with a timestamp): Shows every record, not just the first page, so it exposes the exclusion that a cropped screenshot hides. Good for MFA registration, role assignments, device inventories and sign-in logs.
• Signed client statement: Neither of the above. It is your own written declaration that the answers are accurate, and many insurers want one whatever else you attach. It is only as strong as the exports behind it.

Keep the file name, date, tenant name and who exported it. An export you cannot date is not much better than a memory.

What is the pre-renewal checklist for Microsoft 365?

Start four to six weeks before renewal, so there is time to fix problems, not only report them.

• Conditional Access: Export the policy list. Confirm every MFA and legacy-block policy is On, not Report-only. Review every exclusion group and name each member.
• MFA coverage: Export user registration details. Chase every user who is not MFA capable.
• Admins: Export role assignments. Reduce Global Administrators to the number you can justify. Confirm break-glass accounts exist, are excluded as designed, are protected and are monitored.
• Legacy authentication: Filter 30 days of sign-in logs for legacy client apps. Find and fix whatever still uses SMTP AUTH.
• Email security: Look up SPF and DMARC for every domain you own. Confirm DKIM is on. Set automatic external forwarding to Off, or document why not.
• Devices: Export the Intune and Defender device lists. Resolve unmanaged and stale devices and write down how personal devices are handled.
• Patching: Export update compliance and note the deadline your policy sets.
• Backups: Capture the last successful job per workload and run a dated restore test.
• Logging: Confirm auditing is on and write down the actual retention period.
• People and process: Date the training record and the incident response plan.
• Sign-off: The person who signs the form reads the exports first.

How does Brocent fit in, and what does it not do?

Brocent is a Hong Kong-based managed IT provider serving Asia-Pacific, the UK and Europe, and the Middle East. Our CIS Benchmark Audit reads your Microsoft 365 tenant with read-only access and checks it against the CIS Microsoft 365 Benchmark Level 1 and 2, including manual controls Secure Score cannot see. The report includes an insurer evidence section that answers the questions above and points to a dated export for each item: MFA coverage per user, the Conditional Access list with its exclusions, and the SPF, DKIM and DMARC records.

The report is designed to be used as evidence. It does not make you compliant with anything, and each insurer decides what it accepts. Many insurers also want a signed client statement; we can prepare one for your review, and you decide whether it is true before anyone signs.

Published prices are one-off and are set by headcount, in US dollars and excluding tax:

• 1 to 10 users: US$450
• 11 to 25 users: US$990
• 26 to 75 users: US$1,800
• 76 to 150 users: US$2,900
• More than 150 users: quoted

The scope is the same in every band. The report is ready 5 to 7 business days after you grant read-only access. You can see the full details on the Microsoft 365 security audit pricing page and browse a fictitious sample, including the insurer evidence pack, in the sample report. If you want continuing help rather than a single report, see our managed IT security services, or contact us to talk through your renewal.

Related how-tos

Most questionnaire gaps come down to two controls you can fix before renewal: enabling MFA for every user and the Exchange Online Protection settings that cover phishing and spoofing questions.

Frequently asked questions

What does a cyber insurance questionnaire usually ask about Microsoft 365?

MFA on email, remote access and admin accounts, privileged account control, SPF, DKIM and DMARC, endpoint protection or EDR, patching, backups, logging, staff training and an incident response plan. Wording varies by insurer, so work from your own form.

What counts as MFA evidence for cyber insurance?

Evidence is strongest when it shows coverage and enforcement together: a dated export of your Conditional Access policies with their state and exclusions, and a dated export of user registration details that shows who is MFA capable. A single screenshot of one policy rarely shows who is excluded.

Does a Conditional Access policy in report-only mode count as MFA enforced?

No. Microsoft documents that report-only policies are evaluated but not enforced, so users are not prompted for MFA or blocked. If your MFA policy is in report-only mode, the honest answer is that MFA is not yet enforced by that policy. Switch it to On after checking the impact.

Can I exclude break-glass accounts and still answer yes to MFA?

Microsoft recommends excluding emergency access accounts from Conditional Access policies that block or restrict sign-in, and protecting them with a passkey or certificate instead. Say so on the form: MFA is enforced for all accounts except two named emergency accounts, which use a phishing-resistant method and are monitored.

Does Microsoft 365 back up my data for insurance purposes?

Not in the sense insurers usually mean. Microsoft's Services Agreement tells customers to back up their own content and data, and recycle bins and retention are not a separate protected copy. Keep an independent copy and a dated restore test.

How long does Microsoft 365 keep audit logs?

Audit (Standard) keeps records for 180 days. Audit (Premium) keeps Entra, Exchange, SharePoint and OneDrive records for one year by default, and custom retention policies can extend that further with the right licensing. If your insurer asks for more than your licence provides, plan an export or a licence change.

Will my insurer accept the Brocent CIS Benchmark Audit report?

We cannot promise that. The report is designed to be used as evidence, with an insurer evidence section that points to a dated export for each item, but each insurer decides what it accepts. Ask your broker before you buy anything specifically for the renewal. We can also prepare a client statement for review.

When should I start preparing for a cyber insurance renewal on Microsoft 365?

About four to six weeks before the renewal date, so there is time to switch report-only policies on, close SMTP AUTH, enrol missing devices and run a restore test, not just document the gaps.