Is multi-factor authentication enforced on all email access?

What the carrier is actually asking

The carrier is not asking whether multi-factor authentication is available on your mail platform, or whether most people use it. It is asking whether every path into a mailbox requires a second factor, including the paths nobody thinks about: legacy protocols, service accounts, shared mailboxes accessed interactively, contractors, executives who were granted an exclusion, and the break-glass accounts your identity team keeps for emergencies.

A carrier that later reviews this answer will not measure your intent. It will pull the sign-in log for the compromised account and ask whether that specific sign-in required a second factor. One excluded account is enough to turn a yes into a misstatement.

Why it is underwritten

Business email compromise remains the highest-frequency cyber claim by a wide margin, and it is the cheapest for a carrier to prevent. Mailbox access is the pivot point for invoice fraud, payroll diversion, and the reconnaissance that precedes ransomware. Because the control is inexpensive and its absence is so strongly correlated with loss, most markets now treat email MFA as a condition of quoting rather than a rating factor. Answering no often ends the submission; answering yes inaccurately moves the exposure from underwriting into the claim.

Where the answer lives in Microsoft 365, Entra ID, and Azure

In a Microsoft 365 estate this answer is settled by configuration, not by policy documents. Three things have to line up: a Conditional Access policy that requires multi-factor authentication for the population that reaches mail, the absence of legacy authentication paths that bypass that policy, and an exclusion list you can actually defend.

What a defensible yes requires

• Every account that can open a mailbox is in scope of an enforced multi-factor requirement, including shared, service, and administrative accounts.
• Legacy authentication is blocked at the tenant, not merely deprecated, so no protocol reaches mail without evaluating the policy.
• Break-glass accounts are excluded deliberately, documented, alerted on, and cannot read mail; an emergency access account with a mailbox is an unguarded path.
• Guest and external identities that receive shared mailbox or delegate access are covered by the same requirement.
• You can produce a dated report of coverage rather than a screenshot of a policy, because the policy proves intent and the report proves state.

How this answer goes wrong

The three failures we see most often are all honest ones. The first is answering from the policy: a Conditional Access policy named "Require MFA for all users" exists, so the answer is yes, without checking the exclusion group that grew by six accounts over two years. The second is report-only mode. A policy sitting in report-only enforces nothing, and it looks identical to an enforced policy in a screenshot of the policy list. The third is legacy authentication: MFA is genuinely enforced for interactive sign-in while SMTP AUTH remains enabled for a scan-to-email device, and that path never sees the policy.

The consequence is not that the carrier declines the claim on a technicality. It is that the representation was material to the underwriting decision, which is the ground on which a carrier argues for rescission or for a reduced settlement. Several carriers apply that argument per-insured; some apply it to the policy as a whole.

Frequently asked

Does "all email access" include shared and service mailboxes?

Yes, wherever a person can sign in to reach the mailbox. Shared mailboxes accessed through delegation inherit the delegating user's authentication, which is fine, but a shared mailbox with a licensed, sign-in-enabled account and a known password is a direct path into mail and must be covered or blocked from sign-in entirely.

Do break-glass accounts have to be excluded from the answer?

Excluding one or two emergency access accounts from Conditional Access is standard practice and carriers accept it when the accounts are documented, monitored, and cannot read mail. The problem arises when emergency accounts are mailbox-enabled, because they then become an email access path with no second factor.

Is security defaults enough to answer yes?

For a tenant that has security defaults enabled and no per-user MFA overrides, yes. Security defaults require registration and multi-factor for all users and block legacy authentication, which is exactly what the question asks. The risk is a tenant that turned security defaults off to build Conditional Access and never finished.

What if some users are still on per-user MFA rather than Conditional Access?

Per-user MFA and Conditional Access can coexist and often conflict. What matters for the answer is enforced coverage of every account, not which mechanism delivers it. Mixed estates are worth reconciling before renewal because they are where excluded accounts hide.

How recent does the evidence need to be?

Recent enough that it reflects the state on the day you sign. Controls drift: exclusions are added for a migration and not removed, a new hire is provisioned outside the standard group. A measurement taken at renewal time and a measurement taken continuously are both defensible; a measurement taken last year is not.

Related questions