Conditional Access and MFA for Cyber Essentials

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Security Defaults versus Conditional Access

Microsoft gives you two ways to enforce Multi-Factor Authentication (MFA) across your tenant, and you must use one or the other (never both at once, and never legacy per-user MFA toggles):

• Security Defaults (included in Business Basic and Business Standard): A single on/off switch in Microsoft Entra ID. It requires all users to register for MFA with Microsoft Authenticator, challenges users when needed, requires MFA every time an administrator signs in, and blocks legacy authentication protocols. For a micro-business on Business Standard, Security Defaults meets the Cyber Essentials MFA rule for Microsoft 365 itself.
• Conditional Access (included in Microsoft 365 Business Premium / Entra ID P1): Granular if-then policies that let you require MFA on every sign-in, demand phishing-resistant FIDO2 passkeys for admins, block sign-ins from outside the UK, and restrict unmanaged BYOD devices.

The minimum four-policy Conditional Access baseline for Cyber Essentials

1. CA01 — Require MFA for all users on all cloud apps: Targets All Users, All Cloud Apps; Grant control = Require multi-factor authentication. Exclude only your two emergency break-glass accounts.
2. CA02 — Require phishing-resistant MFA for administrative roles: Targets all directory admin roles (Global Admin, Exchange Admin, Security Admin, Intune Admin, User Admin); Grant control = Require authentication strength: Phishing-resistant MFA (FIDO2 security key, passkey or Windows Hello for Business).
3. CA03 — Block legacy authentication: Targets All Users, Client apps = Exchange ActiveSync clients and Other clients; Grant control = Block access.
4. CA04 — Require compliant device or App Protection Policy on mobile/desktop: Stops staff downloading company data onto unmanaged home PCs or out-of-support personal phones.

Break-glass accounts done right under v3.3

In previous years, some admins excluded their emergency “break-glass” account from MFA and relied on a 20-character password. Under Cyber Essentials v3.3, every cloud account must use MFA where available — an excluded break-glass account with only a password risks failing your assessment. Instead, register two physical FIDO2 hardware security keys (such as YubiKeys stored in separate safes) on your break-glass accounts so they satisfy MFA without depending on a mobile phone network or Microsoft Authenticator push service.

Testing in Report-only mode and what to screenshot

Before switching a new Conditional Access policy to On, set it to Report-only for 48 hours and check Entra ID → Monitoring → Sign-in logs (Conditional Access tab) to confirm no legitimate service or printer scanner breaks. When preparing your Cyber Essentials evidence folder, screenshot your active policy list and the Authentication methods → User registration details view.