Prepare for cyber insurance reviews with evidence.
An evidence-backed technical assessment of the Microsoft 365 controls insurers ask about, down to named accounts, with the gaps and fixes to close them.
14 questions insurers ask most.
MFA for every user
Who has a second factor, and which admins rely on SMS.
MFA enforced by policy
Whether Conditional Access or Security Defaults require it.
Legacy sign-in blocked
Old protocols that skip MFA entirely.
Admins kept separate
Admin roles held by everyday accounts.
Inactive accounts
Leavers, unused accounts and stale guests.
Email spoofing
SPF, DKIM and DMARC on every domain.
External sharing
How freely files leave the organisation.
Unsupported Windows
Devices that no longer get security updates.
Yes, Partly or No, with proof.
Every answer shows the evidence and a plain-English fix, branded with your logo.
- Not covered by this check: backups, EDR, training and incident response are listed clearly, never guessed.
- A point-in-time technical check, not insurance advice.
- Reads users, MFA methods, admin roles, licences, policies, sharing settings, app access, domains, device versions and Secure Score. Changes nothing.
About this check
Is this insurance advice?
No. We show evidence and gaps; we never say a business is "insurable" or "compliant".
Which Microsoft 365 plans does it work with?
Any business or enterprise plan. Every check uses data all plans provide.
Who approves access?
A Global Administrator of the client's tenant, on Microsoft's consent screen. Access can be removed at any time.