NIS2 doesn't mention Microsoft 365. Your auditor will

The NIS2 Directive doesn't mention Microsoft 365 once. It talks about "cybersecurity risk-management measures", "incident handling" and "basic cyber hygiene practices". Very abstract.

Until the auditor sits down and asks: "Show me every account with admin rights, who approved them, and when they last used MFA."

And that's where the abstract becomes very concrete, because for most companies the answer lives in one place: the Microsoft 365 tenant.

What does NIS2 actually require?

Article 21 lists the minimum measures every entity in scope must apply. In short:

Two more articles change the conversation. Article 20 says the management body approves these measures, oversees them, can be held liable and must receive training. Article 23 sets the reporting clock: early warning in 24 hours, notification in 72 hours and a final report within a month of that notification.

What does that look like in Microsoft 365?

This is how we translate the most tenant-related points:

Access control (i) and MFA (j)

• Who has admin roles, who approved them and whether they still need them. Global Administrator should be a handful of accounts, not half of IT.
• MFA enforced with Conditional Access, for everyone, with no forgotten exceptions. "Enabled" in the user list isn't the same as "required on every sign-in".
• Phishing-resistant methods (passkeys, FIDO2 keys, Windows Hello for Business) at least for admin roles.
• Emergency access accounts documented, excluded from policies on purpose and monitored.

Incident handling (b)

• Audit logs turned on and retained for long enough to investigate.
• Someone who actually looks at Defender alerts and a written procedure for what to do with them, including who notifies the regulator within 24 hours.

Cryptography and data (h)

• Sensitivity labels applied to what matters, with encryption where it makes sense.
• DLP for the most obvious data (IDs, bank details, health data).
• A clear view of where files are shared, internally and externally.

Continuity (c)

• The Microsoft 365 shared responsibility model: Microsoft keeps the service running; the protection of your data against deletion, ransomware or mistakes is your responsibility. Retention policies or a backup solution, and a tested restore.

Hygiene and training (g)

• Devices managed with Intune and kept up to date.
• Training that people remember. Attack simulation (included with Defender for Office 365 Plan 2) turns it into something measurable.

Do you need to buy more licences?

Usually not to start. With Business Premium, E3 or E5 most of the tools are already in the box: Conditional Access, Defender, Intune, Purview and audit logging. The problem is rarely the licence. It's that the tools are in the box and nobody has taken them out, configured them and kept evidence that they work.

That evidence matters. NIS2 is about proving, not just doing: a screenshot of a policy in report-only mode doesn't count as a control.

A five-minute test

Before any audit, try to answer these questions from the tenant, without asking anyone:

1. Which accounts have admin roles right now, and who approved each one?
2. Is there any account that can sign in without MFA? Why?
3. How long are audit logs kept?
4. Who receives Defender alerts, and what did they do with the last one?
5. Which sites hold the most sensitive data, and are they labelled?

If you can answer all five, congratulations. If not, you already know where to start.

Our take

NIS2 is often presented as a legal project. In practice, a good part of it is tenant work that should have been done anyway. The difference is that now someone will ask for evidence, and the management body signs off on it.

Transposition timelines differ between countries, so check the status in yours. If you want an outside view of how your Microsoft 365 tenant would stand up to those first questions, tell us in three lines.