Common questions
- Is MFA required for all email access, including on phones?
- Is MFA required for remote access and for admin accounts?
- Are admin accounts separate from everyday accounts?
- Is legacy authentication blocked?
- Do you use SPF, DKIM and DMARC?
- How would you detect and respond to a compromised account?
Answer with evidence
The safest answer is one you can back up. Export MFA registration and enforcement from Microsoft 365 or Google Workspace, list your admins, and record when policies were turned on. Keep that evidence with the application.
Doing it with TenantWard
TenantWard shows MFA coverage for every person and admin, flags legacy authentication and checks email authentication. Comply produces an evidence pack from your live configuration and alerts you if a control drifts after renewal.
See where your company stands
Check a domain for free, then connect Microsoft 365 or Google Workspace for the full checkup. Every new workspace gets a 7-day trial, no card needed.