Microsoft 365 security audit checklist for insurance

Summary

This guide helps you troubleshoot and resolve: Microsoft 365 security audit checklist for insurance. Follow the steps below to fix the issue.

Common Causes

Cyber insurance providers across Australia are tightening their requirements for small business coverage. Whether you are applying for a new policy or renewing an existing one, insurers often request documented evidence of your IT security posture before offering coverage. Common requests include proof of Multi-Factor Authentication (MFA), conditional access policies, antivirus deployment, and application patch management. Microsoft 365 Business Premium includes the tools needed to meet these requirements, but you need to know where to find the reports and how to present them. This checklist helps Brisbane and Australian small business owners prepare for cyber insurance audits without last-minute panic.

Quick Fix Steps

1. Log in to the Microsoft 365 admin centre using an account with Global Administrator or Security Administrator privileges.
2. Confirm MFA is enabled for all user accounts, especially privileged administrator accounts.
3. Review Conditional Access policies in Microsoft Entra ID to ensure sign-in risk requirements are enforced.
4. Verify Microsoft Defender for Business is active and devices are reporting healthy status.
5. Export the Secure Score report and save it as a PDF for your insurance provider.
6. Document your patch management process for operating systems and Microsoft 365 apps.
7. Map your current controls to the ACSC Essential Eight maturity model.
8. Attach the exported reports and policy documents when responding to your insurer’s questionnaire.

Detailed Instructions

1. Verify Multi-Factor Authentication (MFA)

Insurers typically require MFA for all users, particularly those with administrative access. In Microsoft 365 Business Premium, you can check this through the Microsoft Entra admin centre.

1. Go to https://entra.microsoft.com and sign in with an administrator account.
2. In the left navigation, select Identity, then choose Users.
3. Select All users and review the MFA status column.
4. For any user showing as Disabled, select the user and choose Enable multi-factor auth.
5. Prioritise enabling MFA for Global Administrator, Exchange Administrator, and SharePoint Administrator accounts first.

2. Review Conditional Access Policies

Conditional Access allows you to require MFA based on sign-in risk, location, or device compliance. This is often specifically requested by cyber insurers.

1. In the Microsoft Entra admin centre, select Security from the left menu.
2. Choose Conditional Access.
3. Review existing policies to ensure they apply to all cloud apps and require MFA for high-risk sign-ins.
4. If no policies exist, select New policy and create a baseline policy requiring MFA for all users.
5. Set the policy to Report-only initially to analyse sign-in impact before enforcing it.

3. Check Microsoft Defender for Business Status

Managed antivirus and endpoint protection are standard insurance requirements. Microsoft Defender for Business is included with Microsoft 365 Business Premium.

1. Go to the Microsoft 365 Defender portal at https://security.microsoft.com.
2. Select Endpoint from the left navigation, then choose Device inventory.
3. Confirm that all business devices are listed and show a healthy onboarding status.
4. Review Incidents & alerts to ensure there are no unresolved critical threats.
5. Export the device health report as a PDF to attach to your insurance application.

4. Export Your Microsoft Secure Score

Secure Score provides a measurable snapshot of your security posture and is useful evidence for insurers.

1. In the Microsoft 365 Defender portal, select Secure score from the left menu.
2. Review your current score compared to the average for organisations of your size.
3. Select Download or Export to save the report as a CSV or PDF.
4. Note any improvement actions marked as Planned or In progress and document expected completion dates.

5. Document Patch Management

Insurers want to see that operating systems and applications are kept up to date. Microsoft 365 Business Premium includes update management capabilities through Microsoft Intune.

1. Go to the Microsoft Intune admin centre at https://intune.microsoft.com.
2. Select Devices, then choose Updates.
3. Review update rings for Windows 10/11 and Microsoft 365 Apps.
4. Confirm that feature updates and quality updates are deployed within a defined timeframe (for example, within 14 days of release).
5. Export the update compliance report for your records.

6. Align With the ACSC Essential Eight

The Australian Cyber Security Centre (ACSC) Essential Eight is frequently referenced by Australian insurers. Use it as a framework to document your controls.

• Application control: Restrict unauthorised applications using AppLocker or Windows Defender Application Control.
• Patch applications: Patch security vulnerabilities in applications within 48 hours where an exploit exists.
• Configure Microsoft Office macro settings: Block macros from the internet and only allow vetted macros in trusted locations.
• User application hardening: Disable Flash, ads, and Java in web browsers where possible.
• Restrict administrative privileges: Limit admin accounts and require MFA for all privileged access.
• Patch operating systems: Patch OS security vulnerabilities within 48 hours where an exploit exists.
• Multi-factor authentication: Enforce MFA for all remote access and privileged actions.
• Regular backups: Ensure daily backups of important data are tested and retained for at least three months.

Troubleshooting

MFA Is Not Showing as Enabled for Some Users

If MFA appears disabled for certain accounts, check whether those users are excluded from security defaults or Conditional Access policies. Review exclusions under Conditional Access > Named locations and Users in the Microsoft Entra admin centre. Re-enable MFA at the user level if necessary, then re-export the report.

Devices Are Not Appearing in Defender for Business

Devices missing from the device inventory are likely not onboarded to Intune or Defender for Business. Confirm that the user’s device is enrolled in Intune and that the device compliance policy is assigned. Reinstall the Microsoft Defender for Endpoint agent if the device remains offline after 24 hours.

Secure Score Has Not Updated After Changes

Secure Score can take up to 24 hours to reflect configuration changes. If you have just enabled MFA or created a Conditional Access policy, wait and refresh the report the following day before exporting it for your insurer.

Insurance Questionnaire Asks for Evidence You Cannot Find

If your insurer requests documentation not available in the admin portals, such as a written incident response plan or staff security awareness training records, create these documents internally. You can use the Microsoft 365 compliance portal to export training completion records if you have assigned awareness training through Microsoft Defender or a third-party provider. For assistance configuring Microsoft 365 security controls or gathering the correct evidence, Open a Ticket.

Still Having Issues?