The 60-second insurer check

Could you answer your insurer's Microsoft 365 questions today, from evidence?

Five questions, the kind cyber-insurance applications and client security forms ask about Microsoft 365. Answer Yes, No or Not sure. The page scores them here in your browser; nothing is sent to us unless you ask for the guide at the end.

  1. Does every person, including owners and anyone with admin rights, have to approve sign-ins with a phone app or code?

    Multifactor authentication, including for admins. The most common question on every application.

  2. Are there no more than two people who can change everything in your Microsoft 365, and do they use a separate account for it?

    Global admin count, and whether the admin account is also the mailbox that gets phished all day.

  3. Is email automatically forwarding to outside addresses blocked?

    The mechanism behind most business email compromise: a quiet rule that copies every message out.

  4. If someone sends an email pretending to be from your company, will other mail servers reject it?

    Email authentication (DMARC at quarantine or reject). Without it, a fake invoice from “you” lands in your clients' inboxes.

  5. Could you show who accessed or deleted email and files in the last 90 days if your insurer asked?

    Audit logging, switched on and kept. The first thing an insurer asks for after a claim.

Answer all five to see your result.

This is a self-check, not an assessment. Your answers are what you believe to be true; only a scan of the tenant proves them. These are the kinds of questions cyber-insurance applications ask, not the wording of any particular insurer. Legal notes.