Usually, yes. There is no single rule, but most cyber insurance applications ask about MFA, and an inaccurate answer can cause problems at claim time. Here is what to check before you sign.
Key Takeaways
- There is no universal rule, but MFA questions are now a standard part of cyber insurance underwriting.
- Applications commonly ask about email, remote access, and admin accounts separately.
- “Available” isn’t the same as “enforced”. Answer based on what your settings actually require.
The short answer
Usually, yes. Requirements vary by insurer and policy, and no law says every policy needs MFA. But MFA has become a standard underwriting question, and missing it can affect whether you’re offered coverage and on what terms.
Your application and policy decide what applies to you, so read those rather than a general article, including this one. Your broker or counsel can answer questions about coverage. We can tell you what your systems actually do.
Where insurers commonly ask about MFA
- Email: is MFA required for all users, including contractors and shared mailboxes?
- Remote access: is it required for VPN, remote desktop, and any other route into your systems?
- Admin accounts: is it required for every privileged account, including vendor and service accounts?
- Backups and key cloud apps: is access to backups and important SaaS tools protected too?
Why accurate answers matter
Your application is part of what the insurer relied on when it issued your policy. If it says MFA is enforced everywhere and an investigation shows otherwise, that can create a dispute when you file a claim. How that plays out depends on your policy and the facts, so ask your broker or attorney what your wording means.
The practical problem is that the person filling in the form often believes the answer is yes. These are the usual gaps:
- MFA is available, but users can skip it
- Legacy authentication is still allowed, and can bypass MFA
- One admin, service, or “temporary” account was excluded and forgotten
- A vendor’s account has access without MFA
- Non-Microsoft apps are outside your single sign-on
How to check before you sign
In Microsoft 365, review your Conditional Access policies and their exclusions. Check the Entra sign-in logs for sign-ins that used only one factor, and list every admin account with its registered methods. Do the same for your VPN, remote access tools, and backups.
If you find gaps, close them before you sign, or describe them accurately on the application. Start with our Microsoft 365 Security Scorecard, or ask for a cybersecurity review. We can show you what’s enforced, but we don’t give insurance or legal advice.