Microsoft 365 security guide
Evidence for customer and supplier security questionnaires
A customer or procurement team sends a security questionnaire with a deadline. You need answers your business can support, rather than a set of reassuring statements. Keep each question linked to its scope, dated evidence and the person responsible for approving the response.
Published · Last reviewed · By CyberProva
Run your free Microsoft 365 security assessmentNo card required · Optional read-only Microsoft 365 connection
Understand what the requester is asking you to prove
Confirm which service, business unit and systems the questionnaire covers. When you are responding as a supplier, your customer's question may concern your whole service, not just Microsoft 365.
- Keep the original question and any definitions or required attachments.
- Record the requester, deadline and internal reviewer.
- Clarify questions that combine several controls or imply a wider scope than you can evidence.
Build an evidence trail for each answer
A policy describes an intended practice; a configuration report or test record can help show what is operating. Choose evidence that supports the wording of the answer.
- For access questions, gather account reviews, MFA policies and relevant exceptions.
- For recovery questions, gather backup scope and completed restore-test records.
- For process questions, request the relevant policy and records showing its use.
- Record the evidence source, review date and limitations; refresh evidence when the scope or control changes.
Use drafts as a starting point for a reviewed response
In CyberProva's Business questionnaire workflow, you can paste questions and review their mappings to assessment controls. Drafts distinguish automated findings, accepted evidence, failing controls and facts that have not been established.
- Check every suggested control mapping against the question before using the draft.
- Answer questions outside the catalogue yourself with suitable supporting evidence.
- Review incomplete or failing answers and explain the current position accurately.
- Approve the final wording and share only the evidence the requester needs.
Where to check this in Microsoft 365
Ask your authorised administrator to inspect these areas for the accounts, services and devices in scope. These are review locations, not instructions to change settings without a plan.
MFA: Conditional Access or Security Defaults
Microsoft Entra admin centre: Entra ID > Conditional Access > Policies; Entra ID > Overview > Properties > Security defaults; Authentication methods > Activity for registration reports.
Conditional Access needs Entra ID P1 or P2; Business Premium includes P1. Security Defaults is available with Entra Free and is an alternative baseline, not an additional layer to enable alongside Conditional Access.
External file access: SharePoint and OneDrive
SharePoint admin centre: Policies > Sharing for tenant settings and Active sites > selected site > Settings for site sharing. Review individual OneDrive/site permissions, sharing links and guests with the responsible owner.
Connected applications: Entra enterprise applications
Microsoft Entra admin centre: Enterprise applications and App registrations; review the application's permissions, owner and business purpose with its supplier. Inspect applicant-tracking or other service administration separately.
Recovery: Exchange/SharePoint retention and backup
Microsoft Purview: Data Lifecycle Management > Retention policies and relevant retention labels; review Exchange deleted-item and SharePoint/OneDrive recycle-bin/restore settings with the administrator. Inspect the separate backup service and its recovery records.
Retention, version history and recycle bins offer different recovery functions. Do not assume they are equivalent to an independently managed backup or satisfy the insurer's definition. Confirm the licensed recovery features and actual restore requirements.
What CyberProva can check automatically
Read-only observations depend on the selected plan, Microsoft licensing, consent and available data. Missing access is a gap, not a pass. Review the documented permissions and deployment limitations.
- MFA: Conditional Access or Security Defaults: Core: selected Conditional Access policy observations. Business and above advanced assessments: supported MFA registration, policy-coverage and Security Defaults observations. These are not proof that every sign-in is protected.
- External file access: SharePoint and OneDrive: Business and above advanced assessments can read selected tenant-wide sharing and link settings when permitted. They do not perform a file-by-file or matter-by-matter access audit.
- Connected applications: Entra enterprise applications: Core: selected application counts. Business and above advanced assessments: supported application inventory and Microsoft Graph app-only grants. Delegated consent, other APIs and a supplier's internal security are outside that inventory.
- Recovery: Exchange/SharePoint retention and backup: CyberProva does not automatically validate retention coverage, backup isolation or restore success. Recovery controls require supplied records and organisation review.
What you should request from your IT provider
Keep the source, date, scope, exceptions and reviewer with each record. Submission and acceptance are separate; your organisation decides whether the evidence supports the claim.
- MFA: Conditional Access or Security Defaults: Dated policy state, targeted users/apps, exclusions, authentication strengths and registration records; representative sign-in evidence reviewed by an administrator. Report-only policies and registration alone do not establish enforcement.
- External file access: SharePoint and OneDrive: Tenant and relevant site sharing settings, approved guest/link exceptions and sample access-review outcomes. Record who approved external access and what was removed after the review.
- Connected applications: Entra enterprise applications: An approved supplier/application register, owner and review dates, permission justifications and assurance records for services outside Microsoft 365. An enabled application is not proof it is in use or approved.
- Recovery: Exchange/SharePoint retention and backup: Retention/deletion scope, backup workload coverage and retention, administrative separation or isolation/immutability where claimed, and a dated restore test with restored data, result, failures and reviewer.
Make the answer provable
Evidence pack for this guide
- A response register retaining each original question and its agreed scope.
- Dated assessment findings and organisation-reviewed provider evidence.
- A named approver, unresolved questions and the final reviewed response.
How CyberProva helps
CyberProva helps you establish a baseline and request supporting evidence. Business and above include questionnaire drafting from mapped assessment controls, with the basis and date of each answer available for review. Free includes 3 lifetime core assessments and an on-screen summary; questionnaire workflows and report exports require a paid plan.
See what a Microsoft 365 security assessment should cover →
See exactly what CyberProva checks · Learn how CyberProva assesses security · Review Microsoft permissions
Practical example
Example question and evidence-backed draft
Illustrative wording only, not a customer result. Suppose the requester asks whether your backups are regularly tested, but you hold a backup policy and no completed restore-test record.
- Question: Do you regularly test restoration of the business data in scope?
- Draft response: Not established. Our backup policy describes the intended process, but we have not yet reviewed a completed restore-test record for this scope.
- Evidence request: Please supply the latest test date, data and systems restored, result, reviewer and any unresolved failures.
- Before submission: review the record, revise the answer to reflect what it demonstrates and identify any remaining exclusions.
What this cannot establish
- Drafts cover mapped assessment controls, not every security, privacy, contractual or sector-specific question. Your organisation approves the final response.
- An export or accepted evidence item does not certify compliance or guarantee procurement approval. Sensitive evidence should be shared only with appropriate recipients.
Common questions
Does CyberProva automatically complete any questionnaire file?
No. The current workflow lets you paste questions and review mappings to supported assessment controls. It is not a universal spreadsheet or portal completion service. Questions outside the catalogue need your own answer.
Can the same answer be reused for every customer?
Only after checking that the wording, service scope and supporting evidence still apply. A previous accepted response does not establish a new customer's requirements.
Does accepted provider evidence mean independent verification?
No. Your organisation reviews and accepts the evidence. That is distinct from an automated observation and from an independent audit.
Can we use it to assess all of our suppliers?
This workflow helps your organisation answer incoming questionnaires about its own controls. It is not a supplier-rating service or a complete third-party risk management platform.
Official guidance
Use these sources with your IT provider when reviewing the controls described above.
From assumptions to evidence
See what needs attention in your organisation
Start with a free CyberProva assessment. Review the findings, identify evidence gaps and agree priorities with your IT team.
Free includes 3 lifetime core assessments. Report exports and advanced features require a paid plan.