ISO 27001 Annex A controls in Microsoft 365

What ISO/IEC 27001:2022 is

Annex A controls of ISO/IEC 27001:2022 (including Amendment 1:2024), to control level (for example A.8.5 Secure authentication).

Who asks for it: Organisations certified to, or working towards, ISO 27001.

What Microsoft 365 can show

30 controls evidenced by 179 checks. A check maps to a control only where its result is genuine evidence for it, so a control is listed only when a tenant setting can show it.

Outside Microsoft 365

The management system clauses (4 to 10) and people and physical controls (A.6 and A.7) are outside Microsoft 365.

Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.

Every control and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

ISO/IEC 27001:2022: each of the 30 controls and the checks that evidence it
Control	Checks that evidence it
A.5.5 Contact with authorities	How to set security notification contacts in Microsoft 365
A.5.9 Inventory of information and other associated assets	How to find unused apps that still hold permissions How to clean up stale devices in Entra ID How to find unmanaged devices in Entra ID Device end of life: find devices due for replacement How to block personal devices enrolling in Intune 6 more checks for A.5.9 How to find Teams and groups with no owner How to set a Microsoft 365 group expiration policy How to find unassigned Microsoft 365 licences How to find licences on dormant Microsoft 365 accounts How to find overlapping Microsoft 365 subscriptions How to set a usage location on Microsoft 365 accounts
A.5.11 Return of assets	How to find licences on disabled accounts in Microsoft 365 Microsoft 365 offboarding checklist for leavers
A.5.12 Classification of information	How to apply sensitivity labels to Teams, groups and sites How to publish sensitivity labels in Microsoft Purview How to create sensitivity labels for documents and email How to limit Exchange calendar sharing with other domains How to restrict who can create shared Bookings pages
A.5.13 Labelling of information	How to apply sensitivity labels to Teams, groups and sites How to publish sensitivity labels in Microsoft Purview How to create sensitivity labels for documents and email
A.5.14 Information transfer	SharePoint and OneDrive external sharing: the safe setting How to stop guests resharing SharePoint files How to limit SharePoint sharing to approved domains How to turn off third-party cloud storage in Teams How to turn off email into Teams channels 28 more checks for A.5.14 Teams external access: who your staff can chat with How to block Teams chat with personal Microsoft accounts How to stop personal Teams accounts messaging your staff How to block Teams contact with trial-only tenants How to turn off Teams meeting chat for anonymous users Teams meeting chat with untrusted organisations How to turn off Teams meeting recording by default The SPF record for Microsoft 365, and how to check it How to set up and enforce DMARC for Microsoft 365 How to check DKIM keys are published for each mail domain How to set up MTA-STS for Microsoft 365 How to find inbox rules forwarding mail outside the company Cross-tenant access settings: the safe defaults SharePoint guests: require the invited account to accept How to tag external emails in Outlook How to limit Exchange calendar sharing with other domains How to block automatic email forwarding in Microsoft 365 Block Dropbox and Google Drive in Microsoft 365 on the web How to limit guest invitations to approved domains How to turn off external calendar sharing in Microsoft 365 How to restrict who can create shared Bookings pages How to set up anti-phishing impersonation protection How to turn on DKIM signing in Microsoft 365 How to turn on MailTips in Exchange Online How to block third-party storage in Outlook on the web How to reject Direct Send in Exchange Online Impersonation protection in the preset security policies How to move DMARC to p=reject, with report addresses
A.5.15 Access control	Conditional Access policies left in report-only mode How to stop users consenting to third-party apps in Entra ID How to stop users registering applications in Entra ID How to restrict what guests can see in Entra ID How to find apps with high-privilege Graph permissions 28 more checks for A.5.15 How to review tenant-wide app consent grants in Entra ID How to find risky apps with access to Microsoft 365 data How to find apps users have allowed to read mail and files How to require a compliant device with Conditional Access SharePoint and OneDrive external sharing: the safe setting How to restrict who can invite guests in Entra ID How to find public Teams and groups open to everyone How to limit SharePoint sharing to approved domains Teams external access: who your staff can chat with How to block Teams chat with personal Microsoft accounts How to stop personal Teams accounts messaging your staff How to block Teams contact with trial-only tenants How to stop anonymous users joining Teams meetings Stop anonymous and dial-in callers starting Teams meetings Teams meeting lobby: who should bypass it How to make dial-in callers wait in the Teams lobby How to turn off Teams meeting chat for anonymous users Who can present in Teams meetings: the safe default How to stop external users controlling Teams screen shares How to set up named locations for Conditional Access Conditional Access for workload identities: how to set it up How to turn on the admin consent workflow in Entra ID How to stop group owners consenting to apps in Entra ID How to stop users creating security groups in Entra ID How to restrict who can join devices to Entra ID How to require a managed device for every sign-in How to block or limit client secrets on Entra ID apps How to turn on Customer Lockbox in Microsoft 365
A.5.16 Identity management	How to turn off self-service sign-up in Microsoft 365 How to review guest accounts in Microsoft 365 How to restrict who can invite guests in Entra ID How to check directory synchronisation is still running SharePoint guests: require the invited account to accept 4 more checks for A.5.16 How to create a dynamic group of all guest users How to limit guest invitations to approved domains How to set up access reviews for guest users How to block sign-in to shared mailboxes
A.5.17 Authentication information	How to find users without MFA in Microsoft 365 How to set up self-service password reset for all users Should Microsoft 365 passwords expire? The current advice How to find expiring app secrets and certificates in Entra How to turn on Windows LAPS with Intune and Entra ID 9 more checks for A.5.17 How to protect MFA registration with Conditional Access How to turn on LAPS in Entra ID device settings How to stop users reading their own BitLocker recovery keys How to set up the user risk policy in Conditional Access Require a managed device to register MFA in Entra ID How to set up a custom banned password list in Entra ID Entra password protection for on-premises Active Directory How to block or limit client secrets on Entra ID apps How to limit application certificate lifetime in Entra ID
A.5.18 Access rights	How to restrict what guests can see in Entra ID How to turn off self-service sign-up in Microsoft 365 How to use PIM for just-in-time admin roles Disabled and dormant accounts that still hold admin roles How to find unused apps that still hold permissions 8 more checks for A.5.18 How to review guest accounts in Microsoft 365 How to find inactive users in Microsoft 365 Microsoft 365 offboarding checklist for leavers How to create a dynamic group of all guest users How to stop users creating security groups in Entra ID Require approval to activate Global Administrator in PIM How to set up access reviews for guest users How to set up access reviews for privileged roles
A.5.19 Information security in supplier relationships	How to stop users consenting to third-party apps in Entra ID How to review tenant-wide app consent grants in Entra ID How to find risky apps with access to Microsoft 365 data How to find apps users have allowed to read mail and files How to control which Teams apps people can install 5 more checks for A.5.19 How to turn on the admin consent workflow in Entra ID How to stop group owners consenting to apps in Entra ID How to block the Office Store and self-service trials How to turn on Customer Lockbox in Microsoft 365 How to stop users installing Outlook add-ins
A.5.24 Information security incident management planning and preparation	How to let users report suspicious Teams messages How to set security notification contacts in Microsoft 365
A.5.25 Assessment and decision on information security events	How to let users report suspicious Teams messages How to deal with ageing Microsoft 365 security alerts How to get notified about outbound spam in Exchange Online
A.5.26 Response to information security incidents	How to investigate and remediate risky users in Entra ID
A.5.29 Information security during disruption	How to set up break-glass accounts in Entra ID
A.5.33 Protection of records	How to turn off Teams meeting recording by default Teams live events set to always record: how to change it How to keep email and files with Purview retention policies How to fix retention policies that were not applied How to publish retention labels in Microsoft Purview How to set up retention labels in Microsoft Purview
A.5.36 Compliance with policies, rules and standards for information security	How to improve Microsoft Secure Score
A.6.5 Responsibilities after termination or change of employment	Microsoft 365 offboarding checklist for leavers
A.8.1 User endpoint devices	How to set up Intune compliance policies for every platform How to raise your Intune device compliance rate How to require a compliant device with Conditional Access How to find unmanaged devices in Entra ID How to find devices without disk encryption in Intune 10 more checks for A.8.1 Mark devices with no compliance policy as not compliant How to block personal devices enrolling in Intune How to restrict OneDrive sync to managed devices How to require BitLocker, firewall and antivirus in Intune How to restrict who can join devices to Entra ID How to limit the number of devices per user in Entra ID Stop Global Admins becoming local admins on joined devices How to stop users becoming local admin on devices they join How to require a managed device for every sign-in Intune enrolment: require MFA and sign-in every time
A.8.2 Privileged access rights	How to require phishing-resistant MFA for administrators How to find administrators without MFA in Microsoft 365 How many Global Admins should a Microsoft 365 tenant have? Why admin accounts should be cloud-only in Microsoft 365 How to use PIM for just-in-time admin roles 15 more checks for A.8.2 How to set up break-glass accounts in Entra ID Disabled and dormant accounts that still hold admin roles How to find apps with high-privilege Graph permissions How to find risky apps with access to Microsoft 365 data How to turn on Windows LAPS with Intune and Entra ID Why admin accounts should not have Microsoft 365 licences Stop Global Admins becoming local admins on joined devices How to stop users becoming local admin on devices they join How to turn on LAPS in Entra ID device settings How to require MFA for administrator roles in Entra ID How to set sign-in frequency for administrators Require approval to activate Global Administrator in PIM How to get alerts when admin roles are assigned in PIM How to set up access reviews for privileged roles How to protect priority accounts with the strict preset
A.8.3 Information access restriction	How to find public Teams and groups open to everyone
A.8.5 Secure authentication	How to find users without MFA in Microsoft 365 How to require MFA for every user with Conditional Access How to block legacy authentication in Microsoft 365 Security defaults vs Conditional Access: which to use? How to require phishing-resistant MFA for administrators 19 more checks for A.8.5 How to find administrators without MFA in Microsoft 365 How to turn off text message and voice call MFA MFA fatigue: show app name and location in Authenticator How to block device code sign-in with Conditional Access How to protect MFA registration with Conditional Access How to require phishing-resistant MFA for every user Block legacy authentication to SharePoint and OneDrive How to turn off SMTP AUTH in Exchange Online How to set an idle session timeout for Microsoft 365 How to require MFA for administrator roles in Entra ID How to set sign-in frequency for administrators How to set up the sign-in risk policy in Conditional Access How to block medium and high-risk sign-ins Require a managed device to register MFA in Entra ID Intune enrolment: require MFA and sign-in every time How to turn on system-preferred MFA in Entra ID How to complete the authentication methods migration How to block sign-in to shared mailboxes How to check modern authentication is on in Exchange Online
A.8.7 Protection against malware	How to stop external users controlling Teams screen shares Defender for Office 365: check the protections are on How to require BitLocker, firewall and antivirus in Intune How to tag external emails in Outlook How to empty the connection filter IP allow list 14 more checks for A.8.7 How to block dangerous attachment types in Exchange Online How to turn on phishing protection in Microsoft Forms How to set up Safe Links for email, Teams and Office apps How to get alerted when an internal user sends malware How to set up a Safe Attachments policy Safe Attachments for SharePoint, OneDrive and Teams How to set up anti-phishing impersonation protection Comprehensive attachment filtering in Exchange Online How to remove allowed domains from anti-spam policies How to protect priority accounts with the strict preset How to turn on zero-hour auto purge for Microsoft Teams How to find mail flow rules that skip spam filtering How to apply preset security policies to everyone Impersonation protection in the preset security policies
A.8.8 Management of technical vulnerabilities	Device end of life: find devices due for replacement How to find devices on unsupported operating systems
A.8.9 Configuration management	Security defaults vs Conditional Access: which to use? Conditional Access policies left in report-only mode How to stop users registering applications in Entra ID How to set up Intune compliance policies for every platform Mark devices with no compliance policy as not compliant 14 more checks for A.8.9 How to turn off email into Teams channels How to control which Teams apps people can install Exchange Online hardening: the Secure Score settings How to add and verify a custom domain in Microsoft 365 How to turn off SMTP AUTH in Exchange Online How to empty the connection filter IP allow list How to turn off POP and IMAP for new mailboxes How to block the Office Store and self-service trials How to complete the authentication methods migration How to remove allowed domains from anti-spam policies How to find mail flow rules that skip spam filtering How to stop users installing Outlook add-ins How to reject Direct Send in Exchange Online How to apply preset security policies to everyone
A.8.12 Data leakage prevention	How to turn off third-party cloud storage in Teams How to switch a DLP policy from test mode to enforced How to turn on DLP for Microsoft Teams chats and channels DLP across email, SharePoint, OneDrive, Teams and devices How to make DLP rules block sharing, not just report it 7 more checks for A.8.12 How to turn on DLP policy tips and user notifications How to find inbox rules forwarding mail outside the company How to set up data loss prevention (DLP) in Microsoft 365 How to block automatic email forwarding in Microsoft 365 Block Dropbox and Google Drive in Microsoft 365 on the web How to set outbound spam limits in Exchange Online How to block third-party storage in Outlook on the web
A.8.15 Logging	How to check the unified audit log is on in Microsoft 365 How long does Microsoft 365 keep audit logs? How to make sure mailbox auditing is on in Exchange Online How to configure mailbox audit actions in Exchange Online How to find accounts bypassing mailbox auditing
A.8.16 Monitoring activities	How to set up user risk and sign-in risk policies How to turn on alert policies for compromised mailboxes How to investigate and remediate risky users in Entra ID How to deal with ageing Microsoft 365 security alerts How to set up the user risk policy in Conditional Access 6 more checks for A.8.16 How to set up the sign-in risk policy in Conditional Access How to block medium and high-risk sign-ins How to get alerts when admin roles are assigned in PIM How to get alerted when an internal user sends malware How to get notified about outbound spam in Exchange Online How to set outbound spam limits in Exchange Online
A.8.23 Web filtering	Defender for Office 365: check the protections are on How to set up Safe Links for email, Teams and Office apps
A.8.24 Use of cryptography	How to find devices without disk encryption in Intune How to set up MTA-STS for Microsoft 365 How to stop users reading their own BitLocker recovery keys How to limit application certificate lifetime in Entra ID How to turn on DKIM signing in Microsoft 365

Microsoft Cloud Security Benchmark: Microsoft’s own baseline for securing its cloud services.
Zero Trust: Microsoft’s Zero Trust deployment pillars, from identities to data.
Microsoft Secure Score: Microsoft’s own score for a tenant, read beside the checks.
PCI DSS 4.0.1: The card industry’s data security standard.

ISO 27001:2022 Annex A controls in Microsoft 365

What ISO/IEC 27001:2022 is

What Microsoft 365 can show

Outside Microsoft 365

Every control and the checks behind it

Run the ISO 27001:2022 report on every tenant.

What ISO/IEC 27001:2022 is

What Microsoft 365 can show

Outside Microsoft 365

Every control and the checks behind it

Related frameworks

Run the ISO 27001:2022 report on every tenant.