For IT and management, in essential and important entities
NIS2 in Microsoft 365: we configure the technical controls.
The national rules that transpose the NIS2 Directive set out the risk-management measures for the entities in scope. Some of them are configured directly in Microsoft 365: multi-factor authentication, admin accounts, audit logs, information classification. These are the ones we configure and document. The audit, the policies and the legal advice stay with your auditor and your lawyer.
- SharePoint governance since 2010SharePoint governance: permissions, retention, audit
- Identity in Entragoverned in partner portals, with two-factor authentication
- Entra and Purview in the same tenantidentity, permissions, retention and audit log
What we configure in Microsoft 365 for NIS2
Each control linked to the requirement it supports, with the documentation handed over.
Multi-factor authentication
Conditional Access for all users, with risk and location rules.
Admin accounts
Dedicated accounts and just-in-time rights, through PIM.
Audit logs
Purview Audit switched on, with retention and log search.
Information classification
Sensitivity labels on documents and emails.
Sharing and access
External access and sites open to everyone, identified and restricted.
Control documentation
What is configured, where and why, for your auditor.
How we configure the controls, step by step
We start from what is already in the tenant and from the licence you have.
- 01
Current state
Which controls are active and what the licence allows.
Microsoft 365
- 02
Identity
MFA, Conditional Access, admin accounts.
Entra ID
- 03
Logs
Audit switched on, retention, who reviews them.
Purview
- 04
Data
Labels, sharing, external access.
- Purview
SharePoint
- 05
Handover
The control documentation, for the audit.
Teams
Questions about NIS2 and Microsoft 365
Will you make us NIS2 compliant?
No. Compliance is established by the audit, and the measures also include policies, incident response and training. We configure and document the Microsoft 365 part.
What does NIS2 require in Microsoft 365?
Among the measures: multi-factor authentication, separate admin accounts, logs that are retained and reviewed, information classification. All of them have a counterpart in Entra and Purview.
Which Microsoft 365 licence do we need?
For Conditional Access and manual labels, Business Premium or E3 is usually enough. PIM needs Entra ID P2, included in E5. We tell you exactly before you buy.
Do you also respond to incidents?
No. Reporting to the national authority and incident response belong to your team or to a SOC provider. The audit logs we configure record the activity needed to investigate the incident.
Related solutions
Data protection with Purview
We configure sensitivity labels, DLP policies, retention and audit in Microsoft 365.
Microsoft 365 for business
You already have the licences. We configure document routing and the archive, metadata-based search and group permissions, before Copilot starts answering from the documents in your tenant.
Support and DevOps with an SLA
Monthly DevOps packages for your solutions on Microsoft 365, Power Platform and Azure.
Show us your tenant. We will tell you which controls are missing.
In 30 minutes we go through the process and agree what to prepare before the project.
Thank you.
We will reply within one business day.