Cyber insurance: evidencing insurer requirements with Microsoft 365
Key takeaways
- Cyber insurers’ risk questionnaires typically ask about MFA, EDR, patch management, backups, privileged access, logging and email protection. The exact requirements differ by insurer and policy.
- In a Microsoft environment, each of these answers can be evidenced with a specific report, for example from Conditional Access, Defender for Endpoint, Intune, Privileged Identity Management or Azure Backup.
- Questionnaire answers are pre-contractual disclosures. Answer them the way they can actually be evidenced in the tenant, including all exceptions.
- Patch deadlines such as “critical within 72 hours” are examples from individual questionnaires. The deadlines that count are the ones in your own policy.
Anyone taking out or renewing cyber insurance completes a risk questionnaire. For management, this is more than a formality: the answers form the basis of the contract, and an answer that turns out to be inaccurate after a claim can put cover at risk. For IT, the question is which report evidences each answer. In Microsoft 365 and Azure, these reports usually exist already. You just need to know where.
What do cyber insurers typically ask, and how do you evidence it with Microsoft?
Questionnaires differ, but a core set of topics recurs. The following overview maps each topic to the Microsoft implementation and the matching evidence.
| Typical requirement | Microsoft implementation | Evidence |
|---|---|---|
| MFA for all users, external access and administrators | Microsoft Entra Conditional Access, blocking legacy authentication | Policy export including exclusions, authentication methods report |
| EDR on all endpoints and servers | Microsoft Defender for Endpoint | Device inventory with onboarding and sensor status |
| Patch management with defined deadlines | Microsoft Intune with update rings, Microsoft Defender Vulnerability Management | Update ring reports, open vulnerabilities per device with age |
| Protected, tested backups | Microsoft 365 Backup, Azure Backup with an immutable vault | Backup policies, immutability status, restore test logs |
| Control of privileged access | Microsoft Entra Privileged Identity Management (PIM) | List of eligible role assignments, activation history, access reviews |
| Logging and monitoring | Unified audit log in Microsoft Purview, Microsoft Sentinel | Retention settings, active data connectors and analytics rules |
| Email protection and sender authentication | Microsoft Defender for Office 365, SPF, DKIM and DMARC | Status of protection policies, DMARC record with policy |
| Incident response plan | Microsoft Defender XDR as the central incident view | Documented plan, record of the last exercise |
Which details matter for each requirement?
MFA. A typical point is whether MFA applies without exception. The honest answer lies in the exclusions of your Conditional Access policies. Emergency access accounts are a justified exception; service accounts with interactive sign-in usually are not. Which methods are actually in use is shown by the authentication methods activity report in the Entra admin center. How to roll out Conditional Access without locking users out is covered in a separate article.
EDR. This means a solution that detects attacks on endpoints and enables a response, so more than traditional antivirus. With Defender for Endpoint, the evidence is coverage: how many devices are onboarded, and on which does the sensor not report a healthy state?
Patching. Some questionnaires name specific deadlines, for example critical patches within 72 hours and others within 30 days. Define your deadlines in writing and evidence them with the Intune update ring reports and the open vulnerabilities in Defender Vulnerability Management.
Backup. The question is usually about a copy that is protected against ransomware. Microsoft 365 Backup stores backups append-only within the Microsoft 365 service boundary; they are immutable unless deliberately deleted through offboarding. Azure Backup stores backups in a Microsoft-managed tenant, separate from the production environment, and can be further protected with an immutable vault and multi-user authorisation. Whether this matches the wording “offline” or “air gap” in your questionnaire is best clarified with the insurer in advance.
Privileged access. With PIM, administrator rights are activated only when needed and for a limited time. PIM requires Entra ID P2 or Entra ID Governance licences.
Logging. Audit (Standard) retains events for 180 days, Audit (Premium) for one year for Entra ID, Exchange and SharePoint. For longer retention and automated detection, the data is ingested into Microsoft Sentinel.
Email. Typical questions concern phishing protection and sender authentication. Defender for Office 365 provides Safe Links, Safe Attachments and anti-phishing policies, while DMARC with a “quarantine” or “reject” policy protects your domain from misuse. We summarise the basics in our article on SPF, DKIM and DMARC.
Where does evidence fail in practice?
Rarely because technology is missing, more often because of details: MFA is active, but individual accounts are excluded. Backups run but have never been test-restored. An incident response plan exists but is unknown to the people involved. For decision-makers who pass the questions on to their IT team or service provider, the overview above is a factual checklist: every answer in the questionnaire should be backed by the corresponding report.
How do you approach this pragmatically?
Insurer requirements and the measures that actually improve your security largely overlap. Use the questionnaire as a work list: produce the evidence answer by answer, close the gaps, and file the reports together with the questionnaire. Allow enough time for this before your next renewal.
Our Gap Assessment reviews your Microsoft environment at a fixed price against typical insurance requirements and delivers the current state with evidence for each point.
Frequently Asked Questions
Which EDR solution do cyber insurers accept?
Insurers generally require a solution that detects threats on endpoints and enables a response. Microsoft Defender for Endpoint fulfils this function. What matters for the evidence is that all devices are onboarded and that alerts are actually handled.
What does “demonstrated patch management” mean?
A documented process with defined deadlines and reports showing that the deadlines are met. Which deadlines apply is determined by your policy; figures such as 72 hours for critical patches are examples. In Microsoft environments, the Intune update ring reports and Defender Vulnerability Management serve as evidence.
What happens if an answer in the questionnaire is wrong?
In Germany, the insurer’s questions are part of the pre-contractual duty of disclosure under Section 19 of the Insurance Contract Act (VVG). Depending on fault, inaccurate answers can lead to withdrawal, termination or an adjustment of the contract. Answer the questions the way they can be evidenced, and disclose known exceptions.
Do insurers verify the answers technically?
This differs by insurer and policy. Ask before taking out or renewing cover whether and how answers are verified. If you can produce the matching report from the tenant for every answer, you are well prepared either way.