NIS2 and identity: turning the directive's requirements into Entra ID and Microsoft 365 controls

What the directive says, and where France stands

Directive (EU) 2022/2555 requires essential and important entities to take appropriate and proportionate cybersecurity risk-management measures. The listed measures include access control policies, asset management, human resources security, basic cyber hygiene and training, incident handling, business continuity, and the use of multi-factor or continuous authentication where appropriate. The directive also makes management bodies accountable: they must approve and oversee these measures.

In France, transposition is carried by a bill whose passage through Parliament has stretched over time, with implementing texts then specifying the requirements. The timetable and the details of the obligations keep evolving: check the current status with ANSSI, which publishes the reference information and supports the entities concerned. The measures described here are worthwhile whatever the timetable.

Multi-factor authentication: aim for phishing resistance

In Entra ID, the strong authentication requirement translates into Conditional Access, not per-user MFA. The expected baseline:

• MFA required for all users and all applications, with documented exclusions limited to emergency access accounts;
• legacy authentication blocked, since it cannot support MFA;
• phishing-resistant methods (FIDO2, Windows Hello for Business, certificates) required through an authentication strength for administrators, then gradually for other populations;
• SMS and voice phased out.

Privileged access and access control

Access control and asset management policies take a very concrete form: knowing who holds which rights, and why. In Entra ID, this means dedicated administrator accounts separate from day-to-day accounts, Privileged Identity Management to remove standing assignments, periodic access reviews, and a joiner, mover and leaver process tied to HR. On the Active Directory side, isolating privileged accounts (the tiering model) remains essential, because an on-premises compromise often spreads to the cloud through synchronisation.

The directive also covers supply chain security, including relationships with suppliers. In Microsoft 365, this has a direct translation: provider access. Partner delegated administration should rely on granular, time-limited privileges (GDAP) rather than old blanket rights; guest accounts for external contributors should be reviewed and expire; third-party applications granted broad permissions should be inventoried, with their publisher and justification. In our audits, this third-party access is often the least documented, even though it offers a direct path into the tenant.

Logging and detection

Handling an incident requires having its traces. Points to check: the Microsoft 365 unified audit log is enabled, retention of Entra ID sign-in and audit logs (often too short by default, hence export to a Log Analytics workspace or a SIEM), mailbox auditing, and alerts on sensitive events such as privileged role assignment, application consent, creation of forwarding rules and risky sign-ins. Retention periods depend on licences and change regularly; check your own tenant's position.

Incident handling and notification

The directive provides for staged notification of significant incidents to the competent authority or CSIRT, with an early warning within 24 hours, a notification within 72 hours and a final report. Those deadlines can only be met if procedures are ready: who revokes a compromised account's sessions, who resets its authentication methods, who decides to disable an application, where the logs are. An exercise based on a Microsoft 365 account compromise scenario quickly exposes the gaps.

What an audit checks

• Actual MFA coverage through Conditional Access and the blocking of legacy authentication.
• Use of phishing-resistant methods for privileged accounts.
• Privileged role assignments, PIM, access reviews and account lifecycle.
• Log retention and export, and the alerts configured.
• Identity incident response procedures and whether they fit the notification deadlines.