Answer for the devices, accounts and services covered by this assessment, including remote work and applicable personal devices. “Yes” means every applicable check in the description is in place. Choose “Not sure” when evidence is missing; use “Not applicable” only when its stated reason is true. This questionnaire does not inspect your systems.

Question 1 of 110% Complete
User authentication

Is MFA enforced for every applicable Microsoft 365 user?

Check effective policy coverage and exclusions, not registration alone. Security Defaults or appropriately configured Conditional Access can supply baseline protection.