Example, read only. A sample account that shows what finished CMMC looks like.
Safeguard 5 of 15 · IA.L1-b.1.v
IA.L1-3.5.1 · FAR 52.204-21 (b)(1)(v) · NIST SP 800-171 3.5.1
Identification
Identify information system users, processes acting on behalf of users, or devices
What it means
Every login is tied to a specific, identifiable user, no generic 'office@company.com' shared accounts.
Why it matters
Shared accounts make it impossible to say who did what, which voids the rest of your compliance story. One login per person is the floor; cleaning this up usually takes an afternoon.
How to do it, Microsoft 365
- 1Go to admin.microsoft.com → Users → Active users
- 2Confirm every account has an individual display name and UPN (no 'office', 'reception', 'shared')
- 3If shared mailboxes exist, confirm they are configured as shared mailboxes, not user accounts
- 4Screenshot the user list
Capture: Screenshot of the user list showing individual accounts only.
The narrative on file
Every user has a unique named account in Microsoft Entra ID. Shared or generic logins are not permitted. Devices are enrolled in Intune and identified by the company before they are allowed to connect.
You answer in plain English; Charlie writes the official narrative for your System Security Plan.
What makes it pass
- Every account is tied to a named individual, no 'office', 'reception', 'admin' shared accounts
- If shared mailboxes exist they are configured as shared mailboxes (not user accounts), visible in the screenshot
- Service / integration accounts named with a documented owner
- Date of capture visible (system clock or filename)
Assessment objectives, NIST SP 800-171A
This is one of 15
Answer in plain English, drop the proof, confirm it MET.
Cedar Ridge Machine Works, LLC walked all 15 the same way. The platform explains each one in plain English, tells you exactly what to grab, checks it, and writes the paperwork, and you confirm each one MET. The self assessment stays your act. Start free, or book a call.