Revision note: this article maps the Microsoft stack to NIST SP 800-171 Rev. 2, the baseline most DoD contracts (and CMMC assessments) still incorporate. Rev. 3, final since May 2024, restructures the requirement set into 17 families with Organization-Defined Parameters; the engineering below still applies, but the mapping targets shift. See the Rev. 2 vs. Rev. 3 executive guide and the Rev. 3 transition service. As always, the revision incorporated into your contract governs.
Configure before you buy more
The most common opening move we see from contractors staring down NIST SP 800-171 is a procurement spreadsheet: a point product for MFA, another for device management, a third for log aggregation. Meanwhile the Microsoft tenant they already pay for is sitting there with the equivalent capability switched off, half-configured, or configured and never evidenced.
The 800-171 families map onto the Microsoft security stack more cleanly than most vendors would like you to know. Identity and authentication live in Entra ID and Conditional Access. Device baselines live in Intune. Threat detection lives in Defender XDR, the audit trail lives in Sentinel, and the labels and loss-prevention rules that keep CUI where it belongs live in Purview. Here's the family-level view of what each product actually addresses when it's deployed with intent.
The family-level map
| Product | 800-171 family | What it actually covers |
|---|---|---|
| Microsoft Entra ID + Conditional Access | 3.1 / 3.5 | Access Control and Identification & Authentication: who gets in, under what conditions, with MFA (requirement 3.5.3) enforced at the front door |
| Microsoft Intune | 3.4 | Configuration Management: baselines, device compliance, application control |
| Microsoft Defender XDR | 3.14 | System & Information Integrity: malicious code protection, monitoring, alerting |
| Microsoft Sentinel | 3.3 | Audit & Accountability: log collection, retention, alerting, review |
| Microsoft Purview (sensitivity labels, DLP) | 3.1.3 / 3.8 | CUI flow enforcement and support for protecting CUI on media and storage |
One platform note before the map makes anyone complacent: if your environment touches ITAR or other export-controlled data, the products above need to live in the right cloud. GCC High is the platform variant built for those environments. We cover it separately in GCC High vs. commercial, because getting the tenant wrong undoes everything the mapping gets right.
Licensing E5 is not implementing E5
The first caveat is what separates a real compliance posture from an expensive one: a control counts only when it is configured, enforced, and evidenced. Owning the license for Conditional Access satisfies nothing. An assessor will ask to see the policy, watch it block a non-compliant sign-in, and read the log that proves it's been doing so all year. What you license doesn't come up.
- Configured means the policy exists and is scoped to the right users, devices, and data, instead of sitting in report-only mode since the pilot.
- Enforced means it actually blocks, quarantines, labels, or alerts in production, and exceptions are documented instead of piling up.
- Evidenced means screenshots, exports, and logs show the control operating over time, and they're ready before anyone asks.
The second caveat matters just as much: some 800-171 requirements are procedural or physical, and no Microsoft product covers them. Policies, security awareness training, and physical protection of facilities and media have no license SKU; you can't buy a locked server room or a trained workforce. Any mapping exercise that claims full coverage from software alone is wrong before it starts.
And the third: the SSP still has to explain how each requirement is met. The System Security Plan ties products, configurations, and procedures into an answer for every requirement: this control is met by this Conditional Access policy, scoped this way, evidenced here. A beautifully configured tenant with a silent SSP is still an assessment problem.
Where to start
Start with an inventory of the tenant you have, before any purchase order: which of the five products above you already pay for, which policies exist, which are enforced, and which have evidence behind them. In most environments we walk into, the honest answer is a mix of all four states: a Conditional Access policy that's real, an Intune baseline that's half-assigned, a Sentinel workspace collecting logs nobody reads, Purview labels published but not enforced. That mix is your actual gap list, and closing it almost always costs less than the procurement spreadsheet would have.
Then map each control honestly: is it configured, enforced, and evidenced, or merely owned? The free CMMC Calculator will show you what each open requirement costs in score terms, which makes prioritizing the configuration backlog much less abstract. If your roadmap puts AI on top of that CUI, our compliant AI offering covers doing it without breaking the boundary you just built, and the rest of our solutions cover the stack end to end.
Want to know what your tenant already covers?
A practitioner will map your existing Microsoft licensing against the 800-171 families, flag what's configured versus merely owned, and hand you the configuration backlog in priority order. Or email rj@indirectit.com directly.