Cyber insurance applications ask specific technical questions. Most of them are answerable from a Microsoft 365 tenant, and most businesses answer from memory rather than from the tenant.
The questions are technical, the answers are a declaration, and the person signing is usually not the person who could verify them. That gap is the risk, and it is entirely fixable before the form goes back.
Almost all of these can be answered from your Microsoft 365 tenant. Not from what somebody remembers configuring, from what the tenant reports today.
Read each one carefully. Several are worded so that a confident yes is easy to give and hard to support.
Ideally before the deadline rather than the evening it is due.
Not against what was configured at setup. Configuration drifts.
Every "yes, except" is worth recording, because that is what an insurer would examine later.
Some of these are an afternoon. MFA exclusions and dormant admin accounts usually are.
A truthful no is a manageable conversation with a broker. An inaccurate yes is a problem at claim time.
We can tell you what is true about your Microsoft 365 environment, in writing, so that whoever signs the form is answering from fact rather than hope. The answers themselves are yours to give, because you are the one making a declaration.
That distinction matters. An inaccurate answer is a problem for your business at exactly the moment you least want one.
It depends what "yes" meant. Many tenants have multi-factor authentication available and enabled for some people, with exclusions that have quietly grown, and no enforcement on the accounts that matter most.
The honest version of that answer is usually "for most users, with these exceptions", and it is worth knowing which exceptions before somebody signs.
No. We do not run a twenty-four hour help desk, a security operations centre or a managed detection and response service, and we will not present ourselves as one.
If a form requires continuous monitoring, that is a different kind of provider and we will say so rather than blur it.
We have no idea, and anybody who tells you otherwise is guessing about somebody else's underwriting. Pricing is the insurer's decision and it takes in far more than your Microsoft 365 configuration.
What we can do is make the technical answers true. What that is worth to your policy is between you and your broker.
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
MFA, access reviews, joiners and leavers, and devices that are managed rather than just handed out.
Devices enrolled, encrypted and updated, and new laptops that configure themselves.
The review checks each of these and writes down what is actually configured, so the form is filled in from evidence.