How to Set Employee Security Terms in Entra ID Terms of Use

ISO 27001 control 6.2 requires employment contractual agreements to state both the employee’s and the organization’s information-security responsibilities. Microsoft Entra ID Terms of Use can satisfy the acknowledgement and enforcement portion of that requirement by presenting approved security terms at sign-in, requiring consent, and retaining acceptance records; configured correctly, entra id terms of use employee security terms give an auditor evidence that assigned personnel received and accepted those obligations.

What must entra id terms of use employee security terms include for ISO 27001 control 6.2?

For ISO 27001:2022 control 6.2, the underlying employment agreement must identify responsibilities on both sides. Your Terms of Use PDF should therefore not be a generic acceptable-use policy alone. It should state the employee’s duties, such as protecting credentials, reporting incidents, using approved systems, and returning organizational information, as well as the organization’s duties, such as providing security guidance, protecting personal data, and supplying approved tools.

For an audit-ready implementation, use Entra Terms of Use as the controlled acknowledgement layer for a security terms document that has already been approved by HR, Legal, and the information security owner. Apply it through Conditional Access to the employee population and relevant Microsoft 365 services. Do not assign it to service accounts, emergency access accounts, or external identities until you have separately assessed the operational impact.

How do you configure employee security terms in Microsoft Entra ID?

Before making the change, confirm that your tenant has Microsoft Entra ID P1 or a Microsoft 365 license that includes Conditional Access capabilities. Use an account with the Global Administrator, Conditional Access Administrator, or an appropriate Identity Governance administration role. Keep at least two emergency access accounts excluded from Conditional Access policies and document those exclusions.

1. Prepare the approved document. Create a PDF named Employee-Information-Security-Terms-v1.0.pdf. Include the document owner, approval date, effective date, version number, review frequency, employee responsibilities, organizational responsibilities, incident reporting instructions, and consequences or escalation routes for non-compliance. Have HR and Legal retain the employment-contract version separately.
2. Create an employee assignment group. In the Microsoft Entra admin center, go to Identity > Groups > All groups > New group. Select Security as the group type, name it CA-Employees-Security-Terms, and add active employee accounts. If your HR-driven provisioning process supports it, use a dynamic membership rule that includes employees and excludes contractors and guests.
3. Create the Terms of Use object. In the Microsoft Entra admin center, go to Identity governance > Terms of use > New terms. Enter Employee Information Security Terms v1.0 for Name and Employee Information Security Terms for Display name.
4. Upload the controlled PDF and language version. Under the document section, select Upload document, upload Employee-Information-Security-Terms-v1.0.pdf, and select the applicable language, such as English. If your workforce requires additional languages, add approved translations. Each translation must communicate the same obligations and retain the same document versioning approach.
5. Set acceptance controls. Turn Require users to expand the terms of use to On. Turn Require users to consent to the terms of use to On. If your privacy office requires it, also turn Require users to consent to the privacy statement to On. The security terms acknowledgement should not be replaced by a privacy notice; they serve different obligations.
6. Set expiry and reacceptance. In the expiration settings, turn Expire terms to On. Set the initial expiration date to the next policy review date and set the frequency to Annually. When the terms change materially, publish a new PDF and update the terms configuration so affected users must accept the revised version.
7. Create the Conditional Access policy. Go to Protection > Conditional Access > Policies > New policy. Name the policy CA-Require Employee Security Terms. Under Users, select Include > Users and groups, then choose CA-Employees-Security-Terms. Under Exclude, exclude your documented emergency access accounts.
8. Assign the policy to Microsoft 365 access. Under Target resources, select Cloud apps, then choose All cloud apps. This is normally the strongest setting for an employee-wide acknowledgement because it prevents bypass through a less commonly used Microsoft 365 application. If operational constraints require a phased deployment, begin with Office 365 and expand after testing.
9. Require the specific terms. Under Access controls > Grant, select Grant access, then select Require terms of use. Choose Employee Information Security Terms v1.0. Select Select, then Create.
10. Deploy safely. Set Enable policy to Report-only first. Review the resulting Conditional Access reporting for affected users, workload identities, and unexpected exclusions. When results are acceptable, edit the policy and change Enable policy to On.

How do you verify that Entra Terms of Use enforcement worked?

Test with a non-administrator employee account that belongs to the assigned group. Start a fresh browser session or private browsing window, then sign in to a covered cloud application such as Outlook on the web or Microsoft Teams. The user should be prompted to open the security terms document and select the acceptance option before access is granted.

Next, verify the policy decision in the Microsoft Entra admin center. Go to Protection > Conditional Access > Monitoring > Sign-in logs, open the test user’s sign-in event, and review the Conditional Access tab. Confirm that CA-Require Employee Security Terms shows as applied and that the grant control requiring Terms of Use was satisfied.

Then return to Identity governance > Terms of use, select Employee Information Security Terms v1.0, and open its reporting or acceptance information. Confirm that the test account has an acceptance record associated with the correct document and version. Repeat the test after changing the PDF to a new approved version in a non-production validation process to ensure reacceptance behavior is understood before policy updates are released.

What evidence should you capture for an ISO 27001 assessor?

An assessor will usually want evidence of design, operation, and governance. Capture evidence immediately after implementation and retain it according to your audit evidence retention schedule. Do not rely only on screenshots; export records where the portal supports export and preserve the approved source document outside Entra as a controlled record.

Where does Microsoft Entra ID fall short of ISO 27001 control 6.2?

Entra Terms of Use records an electronic acknowledgement at authentication time; it does not create, negotiate, or legally validate an employment contractual agreement. It also cannot prove that every worker received onboarding training, understood the terms, or has an employment contract containing the organization’s commitments. For that reason, employee security terms in Entra ID should supplement, not replace, the HR-managed employment agreement, signed onboarding package, security awareness training record, and disciplinary or incident-management process.

Close the control gap by maintaining an HR checklist that requires a signed employment agreement before the account is enabled, references the same security responsibilities in the agreement and Terms of Use, and triggers identity removal when employment ends. Establish a documented annual review involving HR, Legal, and the information security manager so the Entra document, employment terms, and training materials remain aligned.

Next step: schedule a short control-owner review with HR and Legal, approve the security terms PDF, and deploy the Conditional Access policy in report-only mode before your certification evidence collection begins.