Microsoft 365 security guide
Microsoft 365 Cyber Insurance Renewal Checklist: What Your Insurer May Ask
Your cyber insurance renewal asks whether important controls are in place. Before signing, connect each answer to current evidence for your business. Start with the insurer's actual questions, establish what Microsoft 365 checks can show and ask your IT provider to fill the remaining gaps.
Published · Last reviewed · By CyberProva
Run your free Microsoft 365 security assessmentNo card required · Optional read-only Microsoft 365 connection
Turn the questions into an action summary
The free browser questionnaire has nine questions: one about insurer wording and business scope, followed by the eight control questions in this guide. Record self-reported answers and evidence gaps. It does not determine insurance cover or eligibility.
Try the insurance readiness checkerDownload the renewal checklist
Eight illustrative questions, an evidence register and a worked example. Adapt it to your insurer's wording; it is not a universal insurance standard.
Download the renewal checklist (PDF)No email or account required. Read the accessible HTML checklist.
Start with the renewal questions and the business scope
Keep the original wording, definitions and deadline. A question about all remote access or all business data may extend well beyond your Microsoft 365 tenant.
- Identify the accounts, devices, applications and locations covered by each question.
- Ask your broker or insurer to clarify wording you cannot answer confidently.
- Compare last year's answers with current evidence and changes to your environment.
Gather evidence for the controls in your answers
Use this as a preparation list to adapt to your renewal form. Each record should identify the source, date, scope, exceptions and person who reviewed it.
- MFA: registration plus applicable enforcement policies and exclusions; registration alone does not establish coverage.
- Administrator access: role assignments, provider accounts and a dated access review.
- Email: relevant protection and forwarding settings supplied by your IT team.
- Recovery: backup coverage, retention and a restore-test record showing what was restored and the outcome.
- Wider controls: device protection, software updates and incident response evidence where the form asks for them.
Resolve gaps before sending the renewal response
Keep a control that has not been established separate from one that has been checked and found to need action. A planned fix does not establish that a control is already operating.
- Ask your provider for missing evidence and review whether it answers the actual question.
- Record exclusions and unresolved issues with a named owner.
- Have the responsible person review the final answers and clarify uncertainty with the broker or insurer.
Where to check this in Microsoft 365
Ask your authorised administrator to inspect these areas for the accounts, services and devices in scope. These are review locations, not instructions to change settings without a plan.
MFA: Conditional Access or Security Defaults
Microsoft Entra admin centre: Entra ID > Conditional Access > Policies; Entra ID > Overview > Properties > Security defaults; Authentication methods > Activity for registration reports.
Conditional Access needs Entra ID P1 or P2; Business Premium includes P1. Security Defaults is available with Entra Free and is an alternative baseline, not an additional layer to enable alongside Conditional Access.
Administrator access: Entra roles and PIM
Microsoft Entra admin centre: Entra ID > Roles & admins for current assignments; ID Governance > Privileged Identity Management for eligible access and activation settings where licensed.
PIM needs Entra ID P2 or Entra ID Governance for relevant users. It is not included simply because a tenant has Business Premium/P1. Emergency-access readiness needs human review.
Endpoint protection and updates: Defender for Business and Intune
Microsoft Defender portal: Assets > Devices and relevant endpoint/security reports. Microsoft Intune admin centre: Devices and Endpoint security > Device compliance; inspect the assigned update policies and deployment reports for each platform.
Defender for Business is included in Business Premium or can be bought separately. Intune and device/OS entitlements must also fit the deployment. Advanced device observations can be unavailable if required consent is missing; inspect the permissions page and reported gaps.
External email forwarding: Exchange Online
Exchange admin centre: Recipients > Mailboxes > mailbox forwarding, plus Mail flow > Rules and remote-domain settings. Review inbox rules separately. In Microsoft Defender, inspect outbound anti-spam policies and their external-forwarding settings.
Recovery: Exchange/SharePoint retention and backup
Microsoft Purview: Data Lifecycle Management > Retention policies and relevant retention labels; review Exchange deleted-item and SharePoint/OneDrive recycle-bin/restore settings with the administrator. Inspect the separate backup service and its recovery records.
Retention, version history and recycle bins offer different recovery functions. Do not assume they are equivalent to an independently managed backup or satisfy the insurer's definition. Confirm the licensed recovery features and actual restore requirements.
Incident monitoring: Defender alerts and response ownership
Microsoft Defender portal: Incidents & alerts, applicable alert policies and the provider's monitoring service. Inspect the incident-response procedure and escalation contacts alongside the portal.
CyberProva Professional scheduled checks are periodic assessments, not a substitute for a security operations or incident-response service.
Connected applications: Entra enterprise applications
Microsoft Entra admin centre: Enterprise applications and App registrations; review the application's permissions, owner and business purpose with its supplier. Inspect applicant-tracking or other service administration separately.
What CyberProva can check automatically
Read-only observations depend on the selected plan, Microsoft licensing, consent and available data. Missing access is a gap, not a pass. Review the documented permissions and deployment limitations.
- MFA: Conditional Access or Security Defaults: Core: selected Conditional Access policy observations. Business and above advanced assessments: supported MFA registration, policy-coverage and Security Defaults observations. These are not proof that every sign-in is protected.
- Administrator access: Entra roles and PIM: Core: current directory-role assignments and Global Administrator principals. Advanced: supported standing-access observations when the required sources are available. Core counts do not resolve group membership or all eligible PIM access.
- Endpoint protection and updates: Defender for Business and Intune: Advanced assessments support selected Intune inventory, compliance, encryption and classic policy observations when permissions/licences allow. Policy presence is not effective deployment; CyberProva does not establish Defender EDR onboarding or sensor health automatically.
- External email forwarding: Exchange Online: CyberProva's basic Graph connection does not enumerate Exchange inbox rules, mailbox forwarding or transport rules. These are evidence-based controls, not automatic mailbox-content checks.
- Recovery: Exchange/SharePoint retention and backup: CyberProva does not automatically validate retention coverage, backup isolation or restore success. Recovery controls require supplied records and organisation review.
- Incident monitoring: Defender alerts and response ownership: Core directory-audit availability is a limited observation, not proof of active Defender monitoring. CyberProva does not independently verify alert triage, response coverage or a provider's monitoring service.
- Connected applications: Entra enterprise applications: Core: selected application counts. Business and above advanced assessments: supported application inventory and Microsoft Graph app-only grants. Delegated consent, other APIs and a supplier's internal security are outside that inventory.
What you should request from your IT provider
Keep the source, date, scope, exceptions and reviewer with each record. Submission and acceptance are separate; your organisation decides whether the evidence supports the claim.
- MFA: Conditional Access or Security Defaults: Dated policy state, targeted users/apps, exclusions, authentication strengths and registration records; representative sign-in evidence reviewed by an administrator. Report-only policies and registration alone do not establish enforcement.
- Administrator access: Entra roles and PIM: Role assignments, separate admin-account records, PIM activation and approval requirements where used, and reviewed emergency-access custody, monitoring and test records. A named role does not establish business need.
- Endpoint protection and updates: Defender for Business and Intune: Reconciled device inventory, Defender onboarding/health and EDR coverage, assigned compliance/update policies, deployment outcomes and vulnerability-management records. Include devices absent from Intune and any third-party protection tools.
- External email forwarding: Exchange Online: A dated forwarding/rule inventory with destinations and exceptions, applicable outbound spam and mail-flow policies, and an administrator's review of suspicious or unexpected changes.
- Recovery: Exchange/SharePoint retention and backup: Retention/deletion scope, backup workload coverage and retention, administrative separation or isolation/immutability where claimed, and a dated restore test with restored data, result, failures and reviewer.
- Incident monitoring: Defender alerts and response ownership: Redacted alert/triage examples, monitored service scope, hours and escalation arrangements, named responders and an exercised incident procedure. Ask what happens outside the provider's support hours.
- Connected applications: Entra enterprise applications: An approved supplier/application register, owner and review dates, permission justifications and assurance records for services outside Microsoft 365. An enabled application is not proof it is in use or approved.
Illustrative cyber insurance renewal questions
These are preparation prompts, not universal policy requirements. Keep the insurer's definitions and clarify ambiguous wording with your broker or insurer.
Worked example: three different evidence states
Fictional preparation example, not a customer result or insurer-approved response. Keep the source and review state with each proposed answer.
- Automatically observed: the core read-only collector retrieved current Entra role assignments. This supports an inventory statement; it does not establish that the assignments are justified or that MFA always applies.
- Evidence supplied: the IT provider uploaded a dated Defender onboarding report. It remains supplied evidence until your organisation reviews its scope, device reconciliation and exceptions; upload alone is not verification.
- Not yet confirmed: no completed restore-test record is held. Keep recovery unconfirmed, request the result and clarify the final answer with the responsible reviewer and insurer rather than turning it into a pass.
Make the answer provable
Evidence pack for this guide
- The renewal questionnaire with its definitions and scope.
- Dated Microsoft 365 findings and supporting MFA and access records.
- Provider-supplied recovery and wider-control evidence, with a record of unresolved answers.
How CyberProva helps
CyberProva combines selected read-only Microsoft 365 checks with evidence requests to your IT team. Your organisation reviews submitted evidence and sees the remaining gaps. Free includes 3 lifetime core assessments and an on-screen summary. Business and above add report exports and questionnaire drafting; those drafts still need your review before submission.
See what a Microsoft 365 security assessment should cover →
See exactly what CyberProva checks · Learn how CyberProva assesses security · Review Microsoft permissions
Practical example
Example renewal evidence request
Adapt this request to the exact wording and scope of your insurer's form. It is a preparation template, not a statement that the controls are present.
- For our renewal, please supply dated MFA policy and coverage evidence for the accounts in scope, including administrator and provider access and all exclusions.
- Please supply the current privileged-role review and explain any outstanding access-removal actions.
- For the data named in the form, confirm backup coverage and provide the latest restore-test record, including the data restored, date and result.
- List anything not established, outside your service scope or awaiting remediation so we can review it before submitting our answers.
What this cannot establish
- A Microsoft 365 assessment does not establish that every policy requirement is met. Devices, other services and business procedures may require separate evidence.
- CyberProva does not decide cover, premiums or claims, and does not guarantee insurer acceptance. Review policy questions and obligations with your broker or insurer.
Common questions
Is Microsoft 365 retention the same as a backup?
No. Retention policies, recycle bins and version history offer different functions and limits. Do not assume they provide an independently managed backup, isolation or the recovery capability described by your insurer. Ask for the actual backup scope, access separation and completed restore-test evidence.
Will an assessment satisfy our insurer?
The insurer decides what evidence it accepts for your policy. Use the findings to support your answers and check the requirements with your broker or insurer.
Can we answer yes if MFA is registered for everyone?
Registration alone does not show that MFA is enforced for every relevant account and access path. Ask your administrator for the applicable policies, exclusions and supporting records.
Can we start without connecting Microsoft 365?
Yes. You can start with evidence-based controls and provider requests. The optional Microsoft 365 connection adds selected read-only checks; it does not automatically check every renewal question.
Is the renewal report free?
Free includes on-screen findings and a summary. Exportable reports and questionnaire drafting require Business or above. You can read this evidence request example without an account.
Official guidance
Use these sources with your IT provider when reviewing the controls described above.
From assumptions to evidence
See what needs attention in your organisation
Start with a free CyberProva assessment. Review the findings, identify evidence gaps and agree priorities with your IT team.
Free includes 3 lifetime core assessments. Report exports and advanced features require a paid plan.