CNCS Compliance for Microsoft 365 and Entra ID

What CNCS is

The Portuguese National Cybersecurity Centre (CNCS) issues guidance aligned with the EU NIS2 transposition and cloud identity controls. It maps to Microsoft 365 and Entra ID identity, access, and logging findings.

Official reference: CNCS guidelines

How Siemserva maps to CNCS

CNCS asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:

Identity and access management (60 checks)
At Risk With High Risk User Break Glass Account Disabled User Break Glass Account Is Not Highly Privileged User Break Glass Account Last Password Change User Break Glass User Not Enabled User High Risk User
Conditional Access (60 checks)
Conditional Access Admin Portal Missing MFA Conditional Access Break Glass Account Covered By Policy Conditional Access Group Critical Coverage Gap Conditional Access MFA Policy Bypassed Conditional Access User Critical Coverage Gap Conditional Access Block Legacy Exchange Active Sync Not Found
Multi-factor authentication (42 checks)
Auth User Not MFA Registered Auth Microsoft Authenticator Authentication Method In Use But Not Allowed By User Auth Password Authentication Method In Use But Not Allowed By Senserva Security Manager Auth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By User Auth Require Passwordless But Its Not Used By User Auth Software Oath Authentication Method In Use But Not Allowed By User
Logging and audit (43 checks)
Log Blocked Signin Bad IP Or Too Many Invalid Attempts Log Flagged For Review Log Legacy Auth Protocol Audit CA Change Audit CA Failed Conditional Access Change Audit Failed Authorization Change

See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.

CNCS and Microsoft 365: common questions

Does CNCS apply to Microsoft 365?

CNCS guidelines does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.

How does Siemserva map to CNCS?

Siemserva runs 205+ Microsoft 365 and Entra ID checks across the areas CNCS emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.

Is this an official CNCS certification?

No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.

CNCS guidelines and Microsoft 365

What CNCS is

How Siemserva maps to CNCS

Identity and access management (60 checks)

Conditional Access (60 checks)

Multi-factor authentication (42 checks)

Logging and audit (43 checks)

CNCS and Microsoft 365: common questions