TL;DR: Cyber insurance underwriters scrutinize your cloud tenant before issuing or renewing coverage. Meeting the baseline Microsoft 365 security controls commonly required for cyber insurance means implementing phishing-resistant MFA, conditional access policies, extended audit logging, external email tagging, and independent cloud backup solutions.
- Underwriters now require multifactor authentication across all user accounts, not just administrative portals.
- Legacy protocol deprecation and mailbox forwarding restrictions protect against unauthorized external diversion.
- Independent, immutable SaaS backups are necessary because native Microsoft retention policies do not guard against deliberate destruction or ransomware.
- Attesting to controls you have not verified can jeopardize claim payouts if an incident occurs.
Securing cyber liability coverage is no longer a simple questionnaire exercise. Today, the microsoft 365 security controls commonly required for cyber insurance represent a rigorous technical hurdle for small and mid-sized businesses. Because Microsoft 365 is the dominant productivity platform and prime target for email compromise, underwriters expect verified, active configurations across identity, access, logging, and recovery before they write a policy.
Why Underwriters Focus Heavily on Microsoft 365
Business email compromise remains one of the leading causes of cyber insurance financial losses. When threat actors compromise a corporate cloud tenant, they can intercept invoices, alter banking details, exfiltrate confidential trade secrets, and launch phishing campaigns from legitimate domains. As reported by The Hacker News, account takeover schemes increasingly bypass static perimeter defenses by abusing misconfigured cloud tokens.
Consequently, insurance carriers evaluate your Microsoft 365 environment as an extension of your primary attack surface. Rather than offering lower premiums based simply on company size, underwriters use strict security questionnaires to gauge how resilient your tenant is against automated account abuse, session hijacking, and credential stuffing. To align your tenant with modern operational baselines, implementing systematic Microsoft 365 Services ensures that default settings are hardened to carrier expectations.
Core Microsoft 365 Security Controls Commonly Required for Cyber Insurance
While requirements vary by underwriter, industry, and policy limits, several core controls appear across nearly every insurance questionnaire. Ensuring these controls are active, monitored, and documented is crucial to obtaining coverage.
1. Universal Multifactor Authentication (MFA) via Microsoft Entra ID
MFA is mandatory across 100 percent of active user accounts, third-party contractor logins, and administrative identities. In years past, underwriters permitted basic SMS verification or allowed organizations to restrict MFA only to administrators. That is no longer acceptable. Carriers now insist on modern authentication apps, such as Microsoft Authenticator, and push notifications with number matching.
Furthermore, underwriters are increasingly inquiring about token theft defenses. As we detailed in our guide on why MFA alone does not stop business email compromise, attackers utilize adversary-in-the-middle phishing kits to steal session tokens. Implementing phishing-resistant FIDO2 keys or certificate-based authentication satisfies the most rigorous carrier standards.
2. Conditional Access Policies and Disabling Legacy Protocols
Legacy authentication protocols, such as POP3, IMAP, and older SMTP configurations, do not support modern MFA. Underwriters routinely ask whether legacy authentication is completely disabled across the tenant. Implementing Microsoft Entra ID Conditional Access policies allows your organization to:
- Block legacy authentication requests tenant-wide.
- Restrict logins to managed, compliant devices.
- Require MFA challenges when risk factors change, such as unfamiliar locations or impossible travel times.
- Enforce geographic boundaries that restrict access from jurisdictions where your firm has no legitimate operations.
3. Role-Based Access Control and Dedicated Admin Accounts
Underwriters look closely at credential hygiene. Day-to-day work, like managing spreadsheets or checking standard email, should never occur from an account with global administrator privileges. Insurance carriers expect organizations to implement dedicated administrative accounts without active email licenses, reducing the risk of administrative compromise through spear-phishing.
4. Purview Audit Logging and Extended Log Retention
In the event of an account compromise, forensic investigators must review historical log data to determine if sensitive data was viewed, exfiltrated, or downloaded. By default, standard Microsoft 365 subscriptions provide basic audit log retention, but carriers frequently demand 180 to 365 days of searchable activity records.
Enabling Unified Audit Logging in Microsoft Purview and ingesting those events into Managed Detection & Response platforms gives security operations teams the visibility required to trace unauthorized access. Without historical logs, forensic analysts cannot confirm whether data was stolen, often forcing underwriters to pay for costly mass-notification procedures.
A signed cyber insurance application is an attestation of technical fact. If your configuration does not match your application during a forensic claim investigation, your coverage may be contested.
5. External Forwarding Restrictions and Anti-Spoofing Protocols
Threat actors who gain unauthorized access frequently create auto-forwarding inbox rules, sending all incoming company communications to an external attacker-controlled inbox. Insurers specifically ask whether automated external forwarding is blocked at the tenant level. Disabling external forwarding prevents data leakage even if a single mailbox credential is leaked.
Similarly, carriers check whether your domain has published valid email authentication records: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These records stop attackers from spoofing your domain when sending fake invoices to customers and vendors.
6. Independent Third-Party SaaS Backups
A common misconception among business leaders is that Microsoft 365 inherently backs up all company files and mailboxes. Microsoft operates under a shared responsibility model, maintaining platform availability and hardware redundancy, but the subscriber remains responsible for long-term retention and recovery from internal errors, malicious insiders, or ransomware.
Carriers require an air-gapped, isolated, third-party copy of Exchange Online, SharePoint, OneDrive, and Teams data. Implementing independent Backup & Disaster Recovery guarantees that if a bad actor deletes files or corrupts an entire tenant, clean copies exist that cannot be compromised by the same administrative credentials.
How to Verify and Harden Your Microsoft 365 Tenant
Meeting underwriting requirements requires ongoing maintenance. Default Microsoft 365 configurations prioritize user convenience over maximum protection, leaving standard vulnerabilities unpatched. You can read our complete operational breakdown on how to harden a Microsoft 365 tenant to learn how baseline tenant settings differ from insurance standards.
To confirm that your tenant meets underwriting standards:
- Check Microsoft Secure Score: Review your administrative score inside the Microsoft Defender portal. While insurers do not always require a specific numeric score, reviewing the recommended actions highlights misconfigurations.
- Audit Active Conditional Access Policies: Verify that policies are set to "On" rather than "Report-Only" mode. Ensure policies enforce MFA across every active user profile, including shared resource mailboxes and service accounts.
- Perform Regular Access Reviews: Remove stale accounts, revoke administrative permissions for departed personnel, and delete unused guest accounts.
- Conduct Independent Audits: Third-party Cybersecurity Assessments identify configuration blind spots and verify that your real-world architecture matches the answers provided on insurance applications.
Frequently Asked Questions
Can an insurer deny a claim if a control was not active?
Yes. If an organization attests on an insurance questionnaire that multifactor authentication was enforced for all users, but a post-breach forensic investigation reveals the breached account had MFA disabled, the carrier may deny coverage, reduce payment, or cancel the policy based on material misrepresentation.
Is Microsoft Security Defaults enough for cyber insurance?
For very small organizations, Security Defaults provides baseline protection, but it lacks the flexibility required by larger or regulated businesses. Security Defaults cannot exempt specific service accounts, enforce geographic restrictions, or support granular conditional access rules that carriers increasingly require for elevated coverage limits.
Does Microsoft 365 backup our data automatically?
Microsoft maintains high platform availability and provides short-term retention via the Recycle Bin and version history, but it does not provide an independent, immutable backup. If a malicious actor compromises your administrative account and deletes tenant data, Microsoft cannot guarantee recovery. Carriers expect a dedicated third-party backup platform.
What Microsoft 365 license tier do we need for insurance?
While basic controls like standard MFA are available across most plans, advanced controls like Conditional Access, Entra ID P1, Defender for Office 365, and extended Purview audit logs typically require Microsoft 365 Business Premium or enterprise tiers such as E3/E5.
Next Steps
If you are preparing for a cyber insurance application or renewal, Cyber Solutions can help verify that the controls you are attesting to are actually deployed, functioning, and configured to meet underwriter scrutiny. Contact Us today to schedule a tenant review and ensure your cloud security controls keep your business protected and insurable.
