Cyber Essentials for Microsoft 365: every setting that matters
Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).
1. Microsoft 365 is itself a cloud service in scope
Under Section D(iv) of the NCSC Requirements for IT Infrastructure v3.3 (page 10), Microsoft 365 is a Software-as-a-Service (SaaS) platform. Microsoft manages the physical datacentres, boundary firewalls and Exchange/SharePoint server patching, but your organisation is responsible for configuring the tenant securely and controlling user access.
If one user account in your Microsoft 365 tenant does not have Multi-Factor Authentication (MFA) enforced, or if a director uses their everyday email login as a Global Administrator, your Cyber Essentials application will fail — regardless of how secure Microsoft’s datacentres are.
2. Master mapping table: Cyber Essentials v3.3 to Microsoft 365 settings
Across the ~60 Microsoft 365 tenants we manage at Alphabyte IT, we use this mapping to prepare clients and gather assessor evidence.
| Cyber Essentials requirement (v3.3) | Where it lives in Microsoft 365 | Licence needed | How to evidence it |
|---|---|---|---|
| Cloud MFA on all accounts (Auto-fail) | Entra admin centre → Protection → Conditional Access (or Identity → Overview → Properties → Security defaults) | Security Defaults: Basic / Standard Conditional Access: Business Premium (or Entra ID P1) |
Conditional Access policy list + Authentication methods → User registration details report showing 100% MFA registered |
| Separate admin accounts (no email/browsing) | Entra admin centre → Roles & admins → Global Administrator (assign only to unlicensed admin-* accounts) |
Any M365 licence (unlicensed cloud-only accounts are free) | Export of Global Administrator role members showing dedicated admin-* accounts with no Exchange mailbox |
| Local admin removal & password rotation | Intune admin centre → Endpoint security → Account protection (Local user group membership + Windows LAPS) | Business Premium (includes Intune) | Intune Account Protection profile assignment status + LAPS policy summary |
| Password quality, no expiry & lockout | M365 Admin Centre → Org settings → Password expiration policy (Never expire) + Entra Smart Lockout & Password Protection | Never expire & Smart Lockout: Basic / Standard Custom banned list: Business Premium |
Screenshot of Password expiration policy + Authentication methods policy |
| Device unlock (6+ char PIN / biometric, 10-guess lockout) | Intune → Devices → Compliance policies & Configuration profiles (Windows Hello for Business, macOS, iOS, Android) | Business Premium | Intune Device Compliance summary report |
| 14-day OS security updates (Auto-fail) | Intune → Devices → Windows → Update rings (Quality deferral 0d, Deadline ≤5–7d, Grace 2d) or Windows Autopatch | Business Premium | Intune Windows Update ring configuration + Per-ring deployment status report |
| 14-day app & browser updates (Auto-fail) | Intune → Apps (M365 Apps update channel, Edge auto-update) + Defender Vulnerability Management software inventory | Business Premium (third-party apps via Intune Enterprise App Mgmt or RMM) | Defender Vulnerability Management → Weaknesses report showing zero overdue critical/CVSS 7+ app vulnerabilities |
| Unsupported software check | Microsoft Defender portal → Vulnerability management → Inventories (filter by End-of-support) | Business Premium (includes Defender for Business) | Export of Device & Software inventory with zero EoL items |
| Software firewall on all laptops | Intune → Endpoint security → Firewall (Windows Defender Firewall & macOS Firewall enabled, inbound blocked) | Business Premium | Intune Firewall policy compliance chart |
| Auto-run / Auto-play disabled | Intune → Devices → Configuration → Settings Catalog (‘Turn off Autoplay’ = Enabled for All drives) | Business Premium | Settings Catalog profile summary |
| Anti-malware + malicious website blocking | Intune → Endpoint security → Antivirus (Defender Antivirus + SmartScreen + Defender for Business on Mac) | Windows Defender: built-in Central mgmt & Mac Defender: Business Premium |
Defender portal → Endpoints → Device health & Antivirus status report |
| BYOD personal phone controls | Intune → Apps → App protection policies (iOS/Android MAM requiring 6+ PIN, minimum OS version, block jailbreak) | Business Premium | App Protection Policy configuration + Conditional Access policy requiring compliant/protected app |
3. Recommended deployment order for a small firm
When we onboard or harden a 10 to 50-person Microsoft 365 tenant for Cyber Essentials, we roll changes out in five steps so staff aren’t disrupted:
- Identity first: Create dedicated cloud-only
admin-*accounts, register FIDO2 passkeys or Authenticator MFA across all staff, disable legacy authentication, and switch off 90-day password expiry. - Enrol company laptops and Macs into Intune: Join Windows 11 machines to Microsoft Entra ID and enrol macOS devices so policies push silently over the internet.
- Deploy Defender for Business and Firewall profiles: Turn on real-time anti-malware, SmartScreen web protection and host firewalls across all profiles.
- Enforce 14-day Update Rings and remove EOL software: Configure Windows Update rings with a 5-day deadline and 2-day grace period, and use Defender Vulnerability Management to uninstall any forgotten Office 2016, 2019 or 2021 installs or unpatched utilities.
- Lock down BYOD and local admin rights: Apply Intune App Protection Policies for Outlook/Teams on personal phones and enable Windows LAPS while removing everyday users from the local Administrators group.
4. What Microsoft 365 does NOT cover on its own
Even with Microsoft 365 Business Premium configured properly, three Cyber Essentials areas sit outside Microsoft’s portals:
- Your office router and boundary firewall: Changing default router passwords, disabling WAN admin access, and patching router firmware within 14 days must be done on your router or firewall management console.
- Third-party cloud apps not linked to Entra SSO: If staff log into Xero, Sage or a payroll portal with an email and password rather than “Sign in with Microsoft”, you must enforce MFA inside each of those portals individually.
- Some third-party desktop applications: While Edge and Microsoft 365 Apps update automatically, standalone third-party tools (such as older PDF editors, CAD tools or utilities) need Intune packaging, Winget/Enterprise App Management, or an RMM agent to guarantee 14-day patching.
5. Why Microsoft Secure Score is not the same as Cyber Essentials
Microsoft Secure Score (in security.microsoft.com) is a genuinely helpful benchmark, and raising it improves your posture. However, a tenant with an 80% Secure Score can still auto-fail Cyber Essentials if one user lacks MFA on a third-party cloud app, one laptop is still on unpatched Windows 10, or an office router has an unpatched firmware flaw. If you want a tenant check built specifically around Cyber Essentials and real-world risks, request our free 28-point Microsoft 365 security audit at alphasec.uk.
Run the Auto-fail checker (select Microsoft 365 in Question A5 for tailored paths)
Answer 25 quick questions to see whether any of the April 2026 Danzell rules would fail your assessment outright, with the exact fix for each.
Check if you'd auto-fail in 10 minutes →