Notes · November 2026
The five Microsoft 365 questions on a cyber-insurance renewal, in plain English
Cyber-insurance applications have grown from one page to five or six, and most of the new questions are about your email and file system, which for a small firm means Microsoft 365. The questions are written for IT people. The person filling in the form is usually the owner or the office manager, at 6 p.m., with the renewal due Friday. Here is what the five most common ones are actually asking, and what a truthful “Yes” looks like.
1. “Is multifactor authentication enforced for all users, including administrators and remote access?”
What it's asking: when someone signs in to your Microsoft 365, is a password alone enough? If it is, a stolen password (and passwords are stolen every day, in bulk) opens the mailbox.
What Yes looks like: every account, with no exceptions besides one sealed emergency admin account, has to approve sign-ins with the Authenticator app or a code. In Microsoft 365 this is either “security defaults” switched on, or a Conditional Access policy that requires it for everyone. “Most people have it” is a No on the form, and underwriters weigh this question more than any other.
2. “How many users have global administrator privileges? Are admin accounts separate from daily-use accounts?”
What it's asking: how many master keys exist, and are they kept in the same pocket as the phone that gets phished all day?
What Yes looks like: two to four global administrators, each a dedicated admin account that does not receive email, with the people who need admin rights day to day holding narrower roles. At most small firms the owner's everyday mailbox is a global admin, which means one convincing email to the owner is one convincing email to the whole company.
3. “Is automatic forwarding of email to external addresses disabled?”
What it's asking: if an attacker gets into one mailbox for an afternoon, can they set a rule that quietly copies every future message to themselves and keep reading after the password is changed? This is the mechanic behind most invoice and wire fraud.
What Yes looks like: the tenant-wide setting that blocks automatic forwarding to outside domains is on. It takes an administrator about fifteen minutes and almost never breaks anything a small firm relies on. It is also one of the settings Microsoft ships open.
4. “Do you use SPF, DKIM and DMARC for your email domain?”
What it's asking: if someone sends an email that claims to be from your firm, will the receiving mail server reject it, or deliver it? This is the question behind the fake “updated wiring instructions” email your clients may one day receive in your name.
What Yes looks like: three small records on your domain. SPF and DKIM say which servers may send as you; DMARC tells everyone else what to do with mail that fails, and a DMARC policy of quarantine or reject is the part that protects your clients. Many firms have the first two and a DMARC policy of “none,” which monitors and blocks nothing. This one is public: anyone, including the insurer, can look it up in seconds.
5. “Are audit logs enabled and retained for at least 90 days?”
What it's asking: if there is an incident, can you show who signed in, who read what, and who deleted what? Without a log, every claim starts with “we don't know.”
What Yes looks like: the Microsoft 365 audit log is switched on and has been for a while. Current Microsoft plans keep it for 180 days once it is on; the catch is that on some tenants it was never turned on, and a log you start today has nothing in it about last month.
Try it on your own firm. The 60-second check asks these five questions in plain words and tells you which answers an underwriter would flag. It runs in your browser; nothing is sent to us unless you ask for the guide.
What the form doesn't ask, but the adjuster will
Applications ask whether these controls exist. Claims ask for proof they existed on the day of the incident. The difference is evidence: a report showing the setting, its value and the date it was checked. That is what an assessment produces, and why firms that have had one answer the next renewal in twenty minutes instead of an evening.