What does Cyber Essentials need from your Microsoft 365?

Microsoft 365 is in scope for Cyber Essentials, and so is every laptop, desktop and phone that signs in to it. Most of the five technical controls are configured in two places: Microsoft Entra ID, which handles who can sign in and how, and Microsoft Intune, which handles the devices. Microsoft runs the service, but how your tenant and devices are set up is your job, and that’s what the assessor looks at.

Since April 2026, the control that matters most is MFA. If any account can sign in to Microsoft 365 without it, the assessment fails.

Below, each control is mapped to the Microsoft 365 settings that meet it, with the licence you need. The requirements come from the NCSC’s Cyber Essentials: Requirements for IT Infrastructure v3.3, which has applied since 27 April 2026. If you’re new to the scheme itself, start with Paul’s Cyber Essentials guide for UK small businesses.

Who does what: you, or Microsoft?

The NCSC classes Microsoft 365 as Software as a Service (SaaS), and for SaaS it expects the controls to be split like this:

Control	Who typically implements it for SaaS
Firewalls	The cloud provider
Secure configuration	Both you and the cloud provider
Security update management	The cloud provider
User access control	You
Malware protection	The cloud provider

That table covers the service only. The devices your staff use to reach it are entirely yours, and the requirements say a scope without end-user devices isn’t acceptable. Microsoft’s shared responsibility model agrees: for Microsoft 365, your data, identities, accounts, access management and configuration settings are always yours.

The five controls, mapped to Microsoft 365

1. Firewalls

Microsoft runs the network for the Microsoft 365 service. You need a correctly configured firewall in front of every device in scope. Office routers count. Home routers you didn’t supply don’t, which means laptops need their own software firewall turned on.

Requirement	Where in Microsoft 365	Licence
Software firewall on every laptop and desktop	Intune > Endpoint security > Firewall (Windows Firewall and macOS firewall profiles)	Business Premium (Intune Plan 1)
Unauthenticated inbound connections blocked by default	Same Intune firewall policy, inbound default set to block	Business Premium
Default admin password changed on the office router or firewall	On the device itself, not in Microsoft 365	Any
Router admin interface not reachable from the internet (unless documented and protected by MFA or an IP allow list)	On the device itself	Any
Inbound rules approved, documented with a business need, and removed when no longer needed	On the device itself, plus a written record	Any

Without Intune, you can turn the firewall on by hand on each machine. With it, Intune’s firewall reports show which managed devices have it off.

2. Secure configuration

Remove what you don’t need, and make sure nobody gets in without authenticating. This applies to laptops, desktops, phones, tablets, thin clients, servers and cloud services.

Requirement	Where in Microsoft 365	Licence
Remove or disable unused accounts	Entra admin centre > Users (disable leavers and unused accounts promptly)	Any
Change default or guessable passwords	Entra for cloud accounts; Windows LAPS through Intune for the built-in local admin account	Any; LAPS through Intune needs Business Premium
Remove unnecessary software	Intune app inventory to find it, then remove it, or by hand	Business Premium for Intune
Disable auto-run of files	Intune configuration profile (settings catalog)	Business Premium
Device lock with a PIN, password or biometric, protected against guessing	Intune compliance and configuration policies (screen lock, minimum PIN length)	Business Premium

For a credential that only unlocks a device, the NCSC sets a minimum of six characters, plus throttling (no more than 10 guesses in 5 minutes) or a lockout after no more than 10 failed attempts. Where the vendor doesn’t let you change this, its default is accepted.

3. Security update management

All software on in-scope devices must be licensed and supported, have automatic updates on where possible, and have critical or high-risk fixes installed within 14 days of release. “High risk” means a CVSS v3 base score of 7 or above, or the vendor calling it critical or high. If the vendor doesn’t say how severe an update is, it falls under the 14-day rule too. Microsoft patches the service; you patch the devices.

Requirement	Where in Microsoft 365	Licence
Windows updates installed within 14 days	Intune > Devices > Windows update rings, with deadline settings on	Business Premium
Automatic updates on	Update ring automatic update behaviour	Business Premium
Phones and tablets on a supported, patched OS	Intune compliance policy with a minimum OS version or build	Business Premium
Unsupported software removed	Intune device and app inventory to find it; then upgrade, remove, or move to a segregated sub-set	Business Premium
Apps, browsers and router firmware patched	Automatic updates on for Microsoft 365 Apps, browsers and other apps; a separate process for router firmware	Any

Intune’s update ring settings let you set a quality update deferral of 0 to 30 days, a deadline of 2 to 30 days, and a grace period of 0 to 7 days before a forced restart. The deadline counts from when the device first discovers the update, not from Microsoft’s release date, so keep deferral, deadline and grace period together well inside 14 days.

Windows 10 reached end of support on 14 October 2025. The NCSC defines supported software as software whose vendor has committed to providing regular vulnerability fixes, with a published date when those fixes stop. A Windows 10 machine getting no security updates fails that test.

4. User access control

This is where assessments now succeed or fail. The NCSC requirements say you must:

• have a process to create and approve user accounts
• give everyone unique credentials
• remove or disable accounts when they’re no longer needed
• implement MFA where available, and always use MFA for cloud services
• use separate accounts for admin work, with no email or web browsing on them
• remove admin privileges when they’re no longer needed

Requirement	Where in Microsoft 365	Licence
MFA on every account	Security defaults (Entra > Overview > Properties), or a Conditional Access policy requiring MFA for all users	Security defaults: any. Conditional Access: Business Premium (Entra ID P1)
Legacy sign-in blocked, so MFA can’t be bypassed	Security defaults, or a Conditional Access policy blocking legacy authentication	As above
Separate admin accounts	Entra > Users: create dedicated admin accounts with no mailbox use; assign roles to those only	Any
Staff aren’t local admins on their laptops	Entra device settings, Windows Autopilot profiles or Intune account protection policy	Business Premium for the Intune options
Joiners and leavers handled	A written process, plus Entra user management	Any
Third-party and MSP accounts included	Entra: review guest and partner accounts, and any MSP admin access	Any

Two details catch people out.

First, security defaults require all users to register for MFA and require admins to use it at every sign-in. For everyone else, Microsoft prompts “when necessary”, based on factors like location, device and role. Security defaults also block legacy authentication. On Business Premium, Conditional Access gives you control over exactly when MFA is required, and Microsoft says security defaults are probably not right for organisations that have Entra ID P1. Either way, the test is whether a sign-in from a new browser session gets an MFA prompt.

Second, by default the person who joins a Windows device to Entra ID is added to that device’s local administrators group. If staff set up their own laptops, they’re probably all admins. You can change this in the device registration settings, through a Windows Autopilot profile, or with bulk enrolment. Then use Windows LAPS through Intune to manage the built-in local administrator account’s password.

On passwords: if MFA is on, it satisfies both the NCSC’s brute-force protection and password quality requirements. Any password used as part of MFA must be at least 8 characters, with no maximum length. FIDO2 security keys and passkeys count as MFA under v3.3.

5. Malware protection

The NCSC gives two options for each device: anti-malware software (for Windows and macOS), or application allow listing (for any device). Anti-malware software must be kept up to date, prevent malware from running, prevent malicious code executing, and block connections to malicious websites.

Requirement	Where in Microsoft 365	Licence
Anti-malware on Windows laptops and desktops, kept up to date	Microsoft Defender Antivirus, managed through Intune endpoint security or Defender for Business	Business Premium for central management
Block connections to malicious websites	Microsoft Defender SmartScreen in Edge, and network protection in block mode for other browsers	Business Premium
Anti-malware on Macs	A product meeting the same four conditions, deployed through Intune	Business Premium for Intune
Phones and tablets	Application allow listing: apps from the official store only, no sideloading, jailbroken devices blocked through an Intune compliance policy	Business Premium for the Intune policy
Malware filtering on email	Built-in protection in every Exchange Online mailbox; Safe Attachments and Safe Links add more	Built-in: any. Safe Attachments and Links: Business Premium (Defender for Office 365 Plan 1)

Microsoft’s network protection only blocks malicious sites in non-Edge browsers in block mode, and needs Defender Antivirus running with real-time protection. Audit mode logs but doesn’t block.

Which licence covers what

Cyber Essentials doesn’t require any particular Microsoft licence. What changes is how much you can do centrally and prove. This is how the three Microsoft 365 for business plans compare, from Microsoft’s security overview for Microsoft 365 for business:

	Business Basic	Business Standard	Business Premium
Microsoft Entra ID	Free (includes security defaults)	Free (includes security defaults)	Plan 1 (adds Conditional Access)
Built-in email protection against malware, spam and spoofing	Yes	Yes	Yes
Defender for Office 365 (Safe Attachments, Safe Links)	No	No	Plan 1
Basic Mobility and Security (a limited subset of Intune)	Yes	Yes	Yes
Microsoft Intune	No	No	Plan 1
Microsoft Defender for Business	No	No	Yes

The plans are for organisations of up to 300 users.

On Basic or Standard, security defaults covers MFA, but firewalls, updates, screen locks and admin rights are set and checked by hand on each device. That works for three or four people. Beyond that, Business Premium usually pays for itself in time saved, and its Conditional Access can stop a device reaching company data when it falls out of line.

What an assessor checks on Cyber Essentials Plus

Standard Cyber Essentials is a self-assessment that an assessor reviews. Cyber Essentials Plus tests the same controls on your actual kit. The NCSC’s Cyber Essentials Plus Test Specification v3.2 sets out five tests:

1. Remote vulnerability scan. The assessor scans every internet-facing IP address you use, looking for services an opportunist attacker could get into.
2. Authenticated vulnerability scan. Each sampled device is scanned for missing patches. A critical or high-risk fix that has been available for more than 14 days is a fail.
3. Malware tests. The assessor emails test files to a sampled user and has them download test files in the browser. Malware test files must be blocked. Executable test files must not run without a prompt asking the user whether to proceed.
4. MFA tests. The assessor watches users sign in to each cloud service from an untrusted device or an incognito browser session, and expects an MFA prompt before access is granted. This is done for at least one normal user and one admin per cloud service. Services that share a sign-in, like everything in Microsoft 365, are tested once per authentication service.
5. Account separation. On each sampled device, a standard user tries to run an admin task. It passes only if they’re asked for a separate admin login and the task doesn’t run under their own account.

Before testing, the assessor checks the scope matches your Cyber Essentials certificate and works out a representative sample; a standard build means fewer devices to test. A single fail in any test fails the assessment, unless the issues are small enough for the certification body’s delivery partner to allow an exception.

In Microsoft 365 terms, tests 2 and 3 check update rings and Defender, test 4 checks MFA, and test 5 checks local admin rights.

Scope gotchas

Personal phones and laptops. User-owned devices that access organisational data or services are in scope. A phone used only for calls, texts and an MFA app is out. A phone with Outlook or Teams on it is in. Intune app protection policies keep company data inside managed apps, but the phone itself still needs a supported OS, updates within 14 days and a screen lock.

Admin accounts. A global admin who also reads email every day fails user access control, as does a laptop whose everyday user is a local admin. Accounts used by an MSP or IT supplier are in scope too.

Legacy authentication. Older sign-in methods, such as IMAP, POP3 and SMTP, can’t do MFA, so while they’re allowed, MFA isn’t really enforced. Security defaults blocks them. On Business Premium, use the Conditional Access block legacy authentication policy, in report-only mode first. To find what still depends on it, filter the Entra sign-in logs by Client App, on both the interactive and non-interactive tabs. It’s usually a scanner or an old line-of-business app.

Thin clients and unsupported operating systems. Thin clients are named in the secure configuration control, so they’re in scope. Anything running an unsupported OS, whether a Windows 10 PC no longer getting security updates, an out-of-support Mac or a phone that no longer gets updates, has to be upgraded, removed, or moved to a separate sub-set that has no traffic to or from the internet. The Plus test specification says virtual patching isn’t accepted as a long-term fix for unsupported operating systems.

Cloud services beyond Microsoft 365. From v3.3, cloud services can’t be left out of scope. If your accounting software, CRM or file-sharing service holds company data, it’s in, and it needs MFA too.

What changed in April 2026

Assessment accounts created from 27 April 2026 use v3.3 of the requirements and the Danzell question set. IASME’s summary of the changes is blunt: MFA is mandatory for all cloud services, and organisations that don’t implement it now automatically fail. That applies whether MFA comes free, is included in your plan, or is a paid add-on.

I covered the wider change, and how Cyber Essentials fits alongside Plus, IASME Cyber Assurance and ISO 27001, in What is cyber assurance, and does a small business need it?.

Where to start

If you’re doing this yourself, start with MFA and legacy sign-in, because that’s the automatic fail. Then separate admin accounts and remove local admin rights, set update rings with deadlines, and write down your scope: every device and every cloud service. Our Microsoft 365 security checklist covers the same settings from a general security angle, plus the email protections Cyber Essentials doesn’t ask about but attackers do.