diff --git a/ui/changelog.d/cis-profile-level-filter-m365.fixed.md b/ui/changelog.d/cis-profile-level-filter-m365.fixed.md
new file mode 100644
index 0000000000..d6a07fd36f
--- /dev/null
+++ b/ui/changelog.d/cis-profile-level-filter-m365.fixed.md
@@ -0,0 +1 @@
+CIS Level 1 and Level 2 compliance filters now match profiles prefixed with a license tier (e.g. "E3 Level 1"), so M365 CIS requirements are no longer hidden
diff --git a/ui/lib/compliance/cis.tsx b/ui/lib/compliance/cis.tsx
index cf7b9f8841..d52c89dc81 100644
--- a/ui/lib/compliance/cis.tsx
+++ b/ui/lib/compliance/cis.tsx
@@ -38,8 +38,11 @@ export const mapComplianceData = (
     const attrs = metadataArray?.[0];
     if (!attrs) continue;
 
-    // Apply profile filter
-    if (filter === "Level 1" && attrs.Profile !== "Level 1") {
+    // Apply profile filter.
+    // Most CIS benchmarks use "Level 1"/"Level 2" as the Profile, but some
+    // (e.g. M365) prefix it with the license tier: "E3 Level 1", "E5 Level 2".
+    // Match by suffix so the Level 1 filter works across all CIS variants.
+    if (filter === "Level 1" && !attrs.Profile?.endsWith("Level 1")) {
       continue; // Skip Level 2 requirements when Level 1 is selected
     }
 
diff --git a/ui/types/compliance.ts b/ui/types/compliance.ts
index 0ce94b2d17..94a2486369 100644
--- a/ui/types/compliance.ts
+++ b/ui/types/compliance.ts
@@ -127,7 +127,7 @@ export interface ISO27001AttributesMetadata {
 export interface CISAttributesMetadata {
   Section: string;
   SubSection: string | null;
-  Profile: string; // "Level 1" or "Level 2"
+  Profile: string; // "Level 1"/"Level 2" (M365 prefixes the tier: "E3 Level 1", "E5 Level 2")
   AssessmentStatus: string; // "Manual" or "Automated"
   Description: string;
   RationaleStatement: string;