Compliance / By country / SecNumCloud

ANSSI SecNumCloud and Microsoft 365

France's qualification standard for trusted cloud providers. Siemserva by Senserva maps 197+ Microsoft 365 and Entra ID checks to the areas SecNumCloud emphasizes, so a scan of your tenant doubles as evidence.

FranceSovereign and public-sector cloud197+ mapped checks

What SecNumCloud is

SecNumCloud is the French national cybersecurity agency (ANSSI) qualification for cloud providers, and it surfaces in sovereign-cloud and public-sector deals that involve Microsoft 365 tenants. Its access-control and logging expectations map to Entra ID identity and audit findings.

Official reference: ANSSI SecNumCloud

How Siemserva maps to SecNumCloud

SecNumCloud asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:

Identity and access management (60 checks)
At Risk With High Risk User Break Glass Account Disabled User Break Glass Account Is Not Highly Privileged User Break Glass Account Last Password Change User Break Glass User Not Enabled User High Risk User
Conditional Access (60 checks)
Conditional Access Admin Portal Missing MFA Conditional Access Break Glass Account Covered By Policy Conditional Access Group Critical Coverage Gap Conditional Access MFA Policy Bypassed Conditional Access User Critical Coverage Gap Conditional Access Block Legacy Exchange Active Sync Not Found
Privileged access (PIM) (34 checks)
PIM Alerts No MFA On Activation Alert PIM Policy Expiration Required PIM Policy Missing For User Role Ai Administrator Assigned Role Standing High Privilege Assignment PIM Alerts License Suspended
Logging and audit (43 checks)
Log Blocked Signin Bad IP Or Too Many Invalid Attempts Log Flagged For Review Log Legacy Auth Protocol Audit CA Change Audit CA Failed Conditional Access Change Audit Failed Authorization Change

See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.

SecNumCloud and Microsoft 365: common questions

Does SecNumCloud apply to Microsoft 365?

ANSSI SecNumCloud does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.

How does Siemserva map to SecNumCloud?

Siemserva runs 197+ Microsoft 365 and Entra ID checks across the areas SecNumCloud emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.

Is this an official SecNumCloud certification?

No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.

More: the frameworks crosswalk, Microsoft 365 compliance by country, and the audit evidence guide.

ANSSI SecNumCloud and Microsoft 365

What SecNumCloud is

How Siemserva maps to SecNumCloud

Identity and access management (60 checks)

Conditional Access (60 checks)

Privileged access (PIM) (34 checks)

Logging and audit (43 checks)

SecNumCloud and Microsoft 365: common questions