Revision note: this article maps the Microsoft stack to NIST SP 800-171 Rev. 2 — the baseline most DoD contracts (and CMMC assessments) still incorporate. Rev. 3, final since May 2024, restructures the requirement set into 17 families with Organization-Defined Parameters; the engineering below still applies, but the mapping targets shift. See the Rev. 2 vs. Rev. 3 executive guide and the Rev. 3 transition service. As always, the revision incorporated into your contract governs.
Stop shopping. Start configuring.
The most common opening move we see from contractors staring down NIST SP 800-171 is a procurement spreadsheet: a point product for MFA, another for device management, a third for log aggregation. Meanwhile the Microsoft tenant they already pay for is sitting there with the equivalent capability switched off, half-configured, or configured and never evidenced.
The 800-171 families map onto the Microsoft security stack more cleanly than most vendors would like you to know. Identity and authentication live in Entra ID and Conditional Access. Device baselines live in Intune. Threat detection lives in Defender XDR, the audit trail lives in Sentinel, and the labels and loss-prevention rules that keep CUI where it belongs live in Purview. Here's the family-level view — what each product actually addresses when it's deployed with intent.
The family-level map
| Product | 800-171 family | What it actually covers |
|---|---|---|
| Microsoft Entra ID + Conditional Access | 3.1 / 3.5 | Access Control and Identification & Authentication — who gets in, under what conditions, with MFA (requirement 3.5.3) enforced at the front door |
| Microsoft Intune | 3.4 | Configuration Management — baselines, device compliance, application control |
| Microsoft Defender XDR | 3.14 | System & Information Integrity — malicious code protection, monitoring, alerting |
| Microsoft Sentinel | 3.3 | Audit & Accountability — log collection, retention, alerting, review |
| Microsoft Purview (sensitivity labels, DLP) | 3.1.3 / 3.8 | CUI flow enforcement and support for protecting CUI on media and storage |
One platform note before the map fools anyone into complacency: if your environment touches ITAR or other export-controlled data, the products above need to live in the right cloud. GCC High is the platform variant built for those environments — we've written up GCC High vs. commercial separately, because getting the tenant wrong undoes everything the mapping gets right.
Licensing E5 is not implementing E5
Here is the caveat that separates a real compliance posture from an expensive one: a control counts only when it is configured, enforced, and evidenced. Owning the license for Conditional Access satisfies nothing. An assessor doesn't ask what you license; they ask to see the policy, watch it block a non-compliant sign-in, and read the log that proves it's been doing so all year.
- Configured — the policy exists, scoped to the right users, devices, and data, not sitting in report-only mode since the pilot.
- Enforced — it actually blocks, quarantines, labels, or alerts in production, with exceptions documented rather than accumulated.
- Evidenced — screenshots, exports, and logs exist that show the control operating over time, ready before anyone asks.
The second caveat is just as important: some 800-171 requirements are procedural or physical, and no Microsoft product covers them. Policies, security awareness training, physical protection of facilities and media — there is no license SKU for a locked server room or a trained workforce. Any mapping exercise that claims full coverage from software alone is wrong before it starts.
And the third: the SSP still has to narrate how each requirement is met. The System Security Plan is where products, configurations, and procedures get woven into an answer for every requirement — this control is met by this Conditional Access policy, scoped this way, evidenced here. A beautifully configured tenant with a silent SSP is an assessment problem, not an assessment answer.
Where to start
Not with a purchase order. Start with an inventory of the tenant you have: which of the five products above are you already paying for, which policies exist, which are enforced, and which have evidence behind them. In most environments we walk into, the honest answer across the table is a mix of all four states — a Conditional Access policy that's real, an Intune baseline that's half-assigned, a Sentinel workspace collecting logs nobody reads, Purview labels published but not enforced. That mix is your actual gap list, and it's almost always cheaper than the procurement spreadsheet was.
Then map it honestly: configured, enforced, evidenced — or merely owned? The free CMMC Calculator will show you what each open requirement costs in score terms, which makes prioritizing the configuration backlog considerably less abstract. If your roadmap includes AI on top of that CUI, our compliant AI offering covers doing it without breaking the boundary you just built, and the rest of our solutions cover the stack end to end.
Want to know what your tenant already covers?
A practitioner will map your existing Microsoft licensing against the 800-171 families, flag what's configured versus merely owned, and hand you the configuration backlog in priority order. Or email rj@indirectit.com directly.