Quick Answer 

Yes, and the bar is above default settings. Insurers ask about phishing protection, impersonation detection, and email authentication specifically — Microsoft 365's out-of-the-box filtering doesn't usually satisfy it.

Defaults Aren't an Answer

Microsoft 365 and Google Workspace include basic filtering, and most businesses assume that covers the question. Underwriters generally mean more than that: advanced phishing detection, attachment and link scanning, and impersonation protection are typically separate features or higher licence tiers.

Worth checking what you actually have enabled rather than what your platform is capable of.

DMARC Gets Asked By Name

Email authentication comes up specifically, and this is where most applications fall down. A DMARC record set to p=none reports fraudulent email without blocking any of it — which means it isn't doing the thing the question is asking about.

If your policy isn't at quarantine or reject, the honest answer to "do you have DMARC enforcing?" is no.

Payment Verification Counts Too

Some insurers ask about the procedure, not just the technology: do you verify bank detail changes by phone before acting on them? Business email compromise is the loss type behind many email-related claims, and the emails often pass every technical check because they come from a genuinely compromised supplier account.

It costs nothing to implement and it's one of the stronger answers you can give.

Example Scenario 

A 140-person construction company was asked at renewal about its phishing and BEC defences. Microsoft 365 defaults were enabled, but there was no advanced phishing detection and no domain authentication. PureStack strengthened phishing protection, implemented SPF, DKIM and DMARC, and configured advanced policies before the application went in.

How PureStack Strengthens Your Email Security

We review what's actually enabled in your tenant, deploy advanced phishing and impersonation protection, move DMARC to enforcement without breaking legitimate mail, and help you put verification steps around payments.