Free tool · about 2 minutes
Does your Microsoft 365 licence cover the hardening CMMC Level 2 needs?
For most steps, yes: Business Premium, E3 and E5 include most of the features the Microsoft 365 Hardening steps use. Pick your tenant and licence to see which steps yours covers, which to confirm first, and whether this tenant is the right home for your controlled unclassified information (CUI).
Your answers stay in your browser. The map is drawn on this page. Nothing is sent unless you ask for the full result and the PDF report.
Your tenant
Right home for CUI?
Your answers stay in this browser tab. Nothing is sent unless you ask for the full result below.
The hardening map for your licence
Pick your tenant and licence above and the map fills in.
Licence facts behind the map · as of Nov 4, 2026
What Microsoft includes, in plain terms
The map uses only what Microsoft publishes. Where its pages don't settle a feature for a plan, the step says to confirm it in the pre-flight checklist rather than guess.
- Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5.
- Microsoft 365 Business Premium is for organizations with up to 300 users, and includes Defender for Business.
- Defender for Office 365 Plan 1 is included in Business Premium and, since July 1, 2026, in Office 365 E3 and Microsoft 365 E3.
- Automatic sensitivity labelling and endpoint data loss prevention need E5-class licensing or a Purview add-on. Manual labels and DLP for email and files are in Business Premium and E3, and they are what this engagement uses.
- Audit (Standard) keeps 180 days of records. Keeping them longer needs Audit (Premium) or an add-on, or an export your admin runs on a schedule.
- Microsoft lists Office 365 commercial and GCC among the services that use FIPS 140-2 validated cryptographic modules. Whether your configuration and endpoints meet requirement 3.13.11 is still a question for your settings and your assessment.
Sources
- Microsoft Entra licensing (Conditional Access, Entra ID P1 and P2)
- Microsoft Intune licensing
- Defender for Business overview (Business Premium, up to 300 users)
- Defender for Office 365 service description
- Exchange Online Protection overview
- Microsoft Purview service description (labels, DLP)
- Audit log retention policies
- Azure and Microsoft 365 US Government feature availability (GCC High statement)
Questions
Microsoft 365 licensing and CMMC Level 2, answered
Which Microsoft 365 licence do I need for CMMC Level 2?
- No licence makes you ready on its own: CMMC Level 2 is about how 110 NIST SP 800-171 requirements are met, mostly through configuration, policy and evidence. What the licence decides is which built-in features you can use. For example, Conditional Access needs Microsoft Entra ID P1, which Microsoft includes in Business Premium, E3 and E5. The check above shows, step by step, what your licence gives you.
Is a Microsoft 365 commercial or GCC tenant enough for CUI, or do I need GCC High?
- It depends on your data and your contracts. Microsoft states that the Office 365 GCC High and DoD environments support customers who need compliance with DoD IL4/5, DFARS 7012, NIST 800-171 and ITAR. If your controlled information includes ITAR or export-controlled data, or a contract points to GCC High, settle the right home for it before hardening the tenant you have. The check flags this.
What does “Confirm in pre-flight” mean?
- Microsoft's own licensing pages, as we checked them, don't settle whether your plan includes that step's feature. Microsoft 365 Hardening starts with a pre-flight checklist your admin completes a week before the first session; it confirms licences, roles and feature presence so gaps surface before the paid sessions.
Does this check tell me whether I meet NIST SP 800-171?
- No. It maps which licence features the hardening steps use. Each step supports specific NIST SP 800-171 Rev. 2 requirements, but no setting on its own means a requirement is met: that's decided against all its assessment objectives, usually with policy, procedure and evidence. It isn't an assessment or an SPRS score.
What happens to my answers?
- They stay in your browser tab and the map is drawn there. If you ask for the full result, ForgePoint keeps your name, work email, company, platform, the suggested next step and the date in its CRM. Your licence, seat count and other answers aren't stored, and the PDF report is drawn on request and not kept.
We use Google Workspace, AWS or Google Cloud. Is this for us?
- Not yet. Microsoft 365 Hardening covers Microsoft 365 commercial and GCC tenants. On other platforms the Level 2 Readiness Assessment is the first paid step, because it's platform-neutral and confirms your boundary first.
Where it leads
Microsoft 365 Hardening
Four guided sessions in which your own admin switches these settings on in the right order and keeps the evidence. We never log in. See Microsoft 365 Hardening → Not sure where you stand overall? Take the Level 2 Self-Check →