Cyber insurance applications now ask detailed questions about how a business protects its accounts and email. For most small businesses, the true answers sit inside Microsoft 365. This guide covers what insurers ask, where the proof lives in the tenant, and how to hand it to your client in a form they can use.

Why insurers ask these questions

Most ransomware and business email compromise claims start with a stolen password or a spoofed email. So applications have moved from "Do you have security in place?" to specific yes-or-no questions about controls. A confident wrong answer can be worse than an honest gap: if the form says MFA is enforced for everyone and a claim shows it wasn't, the insurer may question the claim.

The questions usually cover:

  • Multi-factor authentication for every user, and especially for admins
  • Whether older sign-in methods that skip MFA are still allowed
  • How many people hold admin rights, and whether admins use separate accounts
  • How quickly leavers lose access
  • Email protection: SPF, DKIM, DMARC and advanced phishing filtering

Where the evidence lives

Almost every one of those answers can be proved from the tenant rather than from memory. The authentication methods reports in the Microsoft Entra admin center show who has registered MFA. Conditional Access policies show whether MFA is actually required or only registered. Sign-in logs, filtered by client app, show whether legacy protocols are still in use. Role assignments show who holds admin rights, and each account's last sign-in shows the ones nobody uses. DMARC records sit in public DNS for every domain.

Collecting this by hand across several portals takes time for every client, and the result is a folder of screenshots that is out of date by the next renewal. The Cyber Insurance Readiness Check reads the same data through Microsoft Graph with read-only access and answers 14 questions in one report, with the accounts and settings behind each answer.

An honest "partly, and here's the plan" is a better answer than a confident "yes" the tenant can't back up.

Five controls to fix first

  1. Register MFA for every account. Look for people who never set it up, and for shared accounts such as scanners and front desks. Replace shared sign-ins with scan-to-email or a shared mailbox, then block sign-in for them.
  2. Block legacy sign-in. Older sign-in methods that don't support MFA let an attacker in with a password alone. Block legacy authentication with a Conditional Access policy, running it in report-only mode for a week first so you can see what would break.
  3. Disable accounts nobody uses. Enabled accounts with no sign-in for 90 days are often leavers. Confirm with the client, block sign-in and reclaim the licence.
  4. Move admins off text-message codes. Admins should use the Authenticator app or a security key. Text-message codes can be redirected through a SIM swap.
  5. Stop your client's domain being spoofed. Publish SPF and DKIM, then move DMARC from p=none towards quarantine or reject. A policy of none only monitors; it doesn't stop spoofed mail.

Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Tenants without it can turn on Security Defaults, which requires MFA registration and blocks legacy sign-in for everyone.

Sharing the report

Give the client the report before they fill in the application, not after. Walk through every answer marked No or Partly, agree which ones you'll fix before renewal, and put dates on the plan.

Remind them the report is evidence, not an answer sheet: the applicant is responsible for what goes on the form. Run the check again once the fixes are in, so the final answers match the tenant on the day they sign.

Run this check in minutes. Get a branded Cyber Insurance Readiness report with evidence behind every answer.