Cyber Essentials with Microsoft 365: the five controls, setting by setting

The short version: Cyber Essentials v3.3 (Danzell question set) applies to all new UK assessments from 27 April 2026. In a Microsoft 365 tenant the usual trouble spots are missed MFA, unmanaged personal devices and slow patching. Each of the five controls maps to specific Entra ID, Intune and Defender settings, covered below.

If you supply UK clients or the UK public sector, you will be asked for Cyber Essentials sooner or later. If you run on Microsoft 365, most of the five controls come down to settings you can inspect in the admin centres. The scheme changed in 2026, though, and some changes are unforgiving. This guide takes the five controls in questionnaire order and says where each one lives in Business Premium, Entra ID, Intune and Defender.

We read the primary sources on 27 October 2026: the NCSC Requirements for IT Infrastructure v3.3 (April 2026), the NCSC Cyber Essentials overview, and IASME's update notice for April 2026. Where a statement below is our reading of those documents rather than a quote, we say so.

Which version of Cyber Essentials is current in 2026?

Version 3.3 of the Requirements for IT Infrastructure is the current version. The NCSC resources page lists it as effective from 27 April 2026, and we found no later version published by 27 October 2026. The matching assessment questionnaire is the "Danzell" question set, which IASME published in February 2026.

In practice this means:

• New assessments: accounts created from late April 2026 are assessed against v3.3 and the Danzell question set. IASME's wording differs slightly between its pages (27 April in the November 2025 notice, "after 26 April" in the February 2026 notice), so treat the end of April as the boundary.
• Older accounts: an applicant whose assessment account was created before that date has up to six months to finish under the previous version, according to IASME.

What changed in v3.3, and what is the MFA automatic-fail rule?

The NCSC document lists a formal definition of "cloud service", FIDO2 added to passwordless authentication, a definitive statement that cloud services cannot be excluded from scope, and more emphasis on backups. IASME's notices add the assessment consequences that matter for a Microsoft 365 tenant:

• MFA is mandatory for cloud services where it is available. IASME states that if MFA is available for a cloud service, whether free, included or paid for, and you have not turned it on, the assessment fails automatically. The requirements document puts it in one line: authentication to cloud services must always use MFA.
• Two patching questions are automatic fails. A6.4 asks whether all high-risk or critical security updates for operating systems and for router and firewall firmware are installed within 14 days of release. A6.5 asks the same for applications, including associated files and extensions.
• Directors sign a wider declaration. The board member or director now acknowledges responsibility to maintain compliance with all the controls throughout the certification period, not just on the day of assessment.
• Cloud services are always in scope. Microsoft 365 is named in the NCSC document as an example of Software as a Service. You cannot carve it out.

What is in scope for a Microsoft 365 company?

Scope is where many applications go wrong, because people try to shrink it. The rules in v3.3 are fairly direct.

Are the cloud services in scope?

Yes. If your data or services are hosted in a cloud service, it is in scope and cannot be excluded. For Software as a Service such as Microsoft 365, the document says you remain responsible for configuring it securely. The table of "who implements which control" gives the cloud provider the firewall, security update and malware tasks for SaaS, and splits secure configuration between you and the provider. User access control, including MFA, is always yours.

Do personal phones and laptops count?

User-owned devices that access organisational data or services are in scope. The exception is a device used only for native voice calls, native text messages or running an MFA app. So a personal phone that only holds your authenticator app is out of scope, but a personal phone with Outlook or Teams signed in with a work account is in scope.

Home working devices, corporate or BYOD, are in scope; a router you supply to a home worker is too, while other home routers are out of scope.

There is also a table (Table 2 in the document) setting out which roles' devices are in or out of scope when you do not own them, such as employees, volunteers, contractors and MSP administrators. Read it before deciding. A scope that excludes end-user devices is not acceptable.

What about administrator accounts and your IT provider?

All accounts your organisation owns are in scope, even when a supplier or managed service provider uses them to support your tenant. If an MSP administers your environment, you must be able to confirm that the controls are met and demonstrate it in your answers.

Control 1: Firewalls. What does Microsoft 365 have to do with it?

The firewall control says every in-scope device needs a correctly configured firewall, either a boundary firewall or a software firewall on the device. For cloud services, the document says you can meet the intent through data flow policies, and in the SaaS column the provider is typically the one implementing the control.

For a Microsoft 365 company, the practical settings are:

• Windows laptops: Microsoft Defender Firewall turned on for all profiles. In Intune this is a firewall policy under Endpoint security, assigned to all Windows devices.
• Macs: the built-in macOS firewall enabled, pushed through an Intune configuration profile.
• Office router or firewall: change the default admin password, block unauthenticated inbound connections, keep a documented business reason for every inbound rule, and do not expose the admin interface to the internet without MFA or an IP allow list. This part is outside Microsoft 365, and it is on the same questionnaire.

Control 2: Secure configuration. Which tenant settings count?

Secure configuration is about removing the weak defaults: unused accounts, default passwords, unnecessary software, auto-run and unlocked devices. The document asks you to regularly remove or disable unnecessary accounts, change default passwords, remove unneeded software, disable auto-run, require authentication before access, and set device locking.

Map that to Microsoft 365 like this:

• Unused accounts: review Entra ID users for former staff, unused guest accounts and test accounts, and block sign-in for each one. Remove licences from accounts that are disabled.
• Device unlock: the document requires a credential before a device can be used, protected against brute force. It suggests no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts, and a minimum PIN or password length of 6 characters for unlock-only credentials. In Intune, a compliance policy and a Windows Hello for Business or device-lock configuration profile set these values for Windows, and a passcode policy does the same for iOS and Android.
• Passwords: the document recommends against forced expiry and complexity rules. Where a password is the only factor, it asks for at least 12 characters, or 8 characters with a deny list of common passwords. Entra ID password protection and a sensible length-based policy meet this.

Control 3: Security update management. How do you hit the 14-day rule in Intune?

The control says all in-scope software must be licensed and supported, removed once it is unsupported, have automatic updates enabled where possible, and have critical or high-risk fixes applied within 14 days. High risk means a vendor "critical" or "high" rating, or a CVSS v3 base score of 7 or above, or no severity information given by the vendor. The document also warns that a bundled update containing any critical or high fix counts.

Because A6.4 and A6.5 are now automatic fails, this control deserves more care than most teams give it.

• Windows: use Intune update rings (Windows Update for Business) with a quality update deadline well inside 14 days. A deadline of a few days leaves room for devices that were switched off. The Microsoft Learn guidance on Windows Update for Business with Intune explains rings, deadlines and grace periods.
• Windows versions: Windows 10 reached end of support in October 2025 on devices without extended security updates, and unsupported software must be removed or taken out of scope. Check every device against the supported-version list rather than trusting what users say.
• Macs, iPhones, Android: enforce a minimum OS version through Intune compliance policy and managed update settings, and make non-compliant devices lose access with Conditional Access.
• Applications: the Danzell question includes applications and their extensions, so browsers, PDF readers, Zoom, Java and plug-ins count. Microsoft 365 Apps update themselves, but third-party apps need a deployment and update path. This is where many tenants have no coverage at all.

If you want help keeping the patch cycle running, our patch management service covers it, and the Intune side is described on the Intune pricing page.

Control 4: User access control. What does the cyber essentials MFA requirement mean in Entra ID?

This is the control that decides most results. The document lists these duties: a process to create and approve accounts, unique credentials, removal of accounts when no longer needed, MFA where available (and always for cloud services), separate accounts for administrative activity, and removal of special privileges when no longer required.

How should MFA be set up?

Turn MFA on for every user and every cloud service that offers it. In Entra ID there are two routes.

• Security defaults: free, and on by default for new tenants. It requires all users to register for MFA. It is simple but it cannot express exceptions or device conditions. See Microsoft's security defaults documentation.
• Conditional Access (Business Premium): a policy that requires MFA for all users on all cloud apps, with no user or app exclusions you cannot justify. See Microsoft's guidance on requiring MFA for all users.

The NCSC notes that SMS is weaker but still far better than no MFA, and it recognises passkeys and FIDO2 keys. Coverage matters more than method.

Do not forget other cloud services. Your accounting, CRM, file-sharing and payroll apps hold company data too, and the same rule applies. An MFA option left off in any of them is a risk under the automatic-fail rule.

What about legacy authentication?

Older protocols such as POP, IMAP and SMTP basic authentication cannot do MFA. If they are still allowed, someone can sign in with just a password and bypass your policy. Block them with a Conditional Access policy; see Microsoft's guidance on blocking legacy authentication. If a scanner or an old line-of-business app needs SMTP, move it to a modern method rather than keeping the exception.

How should administrator accounts be handled?

The document says to use separate accounts for administrative tasks only, with no email or web browsing. In Entra ID that means:

• Cloud-only admin accounts, with no mailbox and no licence beyond what the role needs.
• A small number of Global Administrators; Microsoft's role best practices recommend fewer than five.
• Privileged roles assigned for the time they are needed (Privileged Identity Management is available with Entra ID P2, which Business Premium does not include, so many small tenants simply review the role list monthly).
• Phishing-resistant MFA for every admin.

Control 5: Malware protection. Is Defender enough?

Each in-scope device needs either anti-malware software or application allow listing. If you use anti-malware, the document says it must be updated according to the vendor, prevent malware from running, prevent execution of malicious code, and prevent connections to malicious websites.

Microsoft Defender for Business, included in Business Premium, covers Windows, macOS, iOS and Android. In Intune, the settings to check are:

• Real-time protection and tamper protection on, with automatic signature updates.
• Web protection (SmartScreen or network protection) on, so connections to malicious sites are blocked.
• Defender onboarded for Macs and managed mobile devices, with no conflicting second antivirus.

The control also applies to in-scope phones; the document accepts application allow listing, such as only signed apps from the official store, as a route on mobile devices.

How do Cyber Essentials and Cyber Essentials Plus differ?

Cyber Essentials versus Cyber Essentials Plus

• Method: Cyber Essentials is a verified self-assessment questionnaire, marked externally. Cyber Essentials Plus covers the same controls and adds a hands-on technical audit.
• Technical test: for Plus, an assessor tests a representative sample of your devices (servers, desktops, laptops, tablets, phones) and runs vulnerability scans, on site or remotely, to confirm software is supported and critical patches are in.
• Timing: IASME says Plus must be completed within three months of the basic Cyber Essentials certification.
• Failure: under Plus, IASME describes a 30-day window to fix issues. The April 2026 update adds a random device sample on retest, and a second failure revokes the VSA certificate.
• Who does it: both are assessed by an IASME-licensed certification body, and the NCSC says Plus is the route that adds independent testing of systems.

For Cyber Essentials Plus on Microsoft 365, the assessor looks at real devices, so a policy that has not reached every laptop will show up. Fix the devices before you book the test.

What are the typical failure points in a Microsoft 365 tenant?

These are the issues we would look for first, in roughly the order they cost people the pass. They follow directly from the v3.3 text.

• MFA exclusions. Conditional Access policies with a long list of excluded users, groups or apps, often for service accounts, shared mailboxes with sign-in enabled, or "temporary" exceptions that nobody removed.
• Legacy authentication left on. POP, IMAP or SMTP basic authentication still allowed for a printer or old app.
• Unsupported operating systems. A Windows 10 machine without extended support, an old Mac that cannot take current macOS, or a forgotten server.
• Unmanaged personal devices. Staff reading company mail on personal phones and laptops with no policy, no minimum OS and no screen lock. They are in scope.
• Admin accounts used daily. The owner's main mailbox account is also Global Administrator.
• Patching without a deadline. Updates are "on", but no ring deadline exists and offline laptops sit months behind. Third-party applications are not updated at all.
• Cloud apps outside Microsoft. MFA on in Microsoft 365 but not in the accounting or CRM app.

Who certifies you, and where does Brocent fit?

Certification is issued by an IASME certification body; we prepare your tenant and your answers. You choose the certification body, agree your scope with them before the assessment, and they mark the questionnaire. For Cyber Essentials Plus, they also run the technical audit.

Brocent is a Hong Kong-based managed service provider serving Asia-Pacific, the UK and EU, and the Middle East. We offer a Microsoft 365 CIS Benchmark Audit that covers the Microsoft 365 controls the Cyber Essentials questionnaire asks about, including MFA coverage, administrator accounts, device compliance and email security. It is designed to be used as evidence and to support the answers you give. It does not certify you, and it does not replace the assessment. Cyber Essentials also covers things the audit does not, such as your office router, firewall rules and servers outside Microsoft 365.

What you get, in practice:

• A read-only audit against the CIS Microsoft 365 Benchmark Level 1 and 2, including manual controls.
• A prioritised roadmap with effort estimates, a debrief call, and evidence for the Cyber Essentials and insurer questions.
• The report 5 to 7 business days after you grant read-only access.

Published prices, one-time, by number of users (US dollars, excluding tax):

• 1 to 10 users: US$450
• 11 to 25 users: US$990
• 26 to 75 users: US$1,800
• 76 to 150 users: US$2,900
• Over 150 users: quoted

Fixing the findings is separate from the audit; your own IT team can work from the roadmap, or we can quote the remediation. The audit pricing page has the detail. You can see what the output looks like in the public sample report, which uses a fictitious 14-person UK firm, Acme Capital, and includes a Cyber Essentials readiness section. There is also a sample Intune device audit. If you want to discuss your case, contact us.

Related how-tos

The three controls most tenants fail first have their own step-by-step guides: MFA for every user, baseline Conditional Access policies and a password policy template.

Frequently asked questions

Does Cyber Essentials require MFA on Microsoft 365?

Yes. The v3.3 requirements say authentication to cloud services must always use MFA, and IASME says an assessment fails automatically if MFA is available for a cloud service and is not enabled. That covers every user, not only administrators.

Is Cyber Essentials v3.3 the latest version?

As of 27 October 2026, yes. The NCSC lists v3.3 as effective from 27 April 2026, and the matching question set is Danzell. We found no later version. Check the NCSC resources page again when you apply, because the scheme is reviewed every year.

Does Cyber Essentials cover Intune and device management?

The scheme does not name Intune, but it requires firewall, secure configuration, patching and malware protection on every in-scope device. Intune is the usual way to enforce and evidence that on Microsoft 365; other tools can also meet the requirements.

Do personal phones with Outlook count as in scope?

Yes, if they access organisational data or services. A device used only for calls, texts or an MFA app is out of scope. A phone with Outlook, Teams or OneDrive signed in with a work account is in scope, so it needs the controls or you need to stop it from connecting.

What is the difference between Cyber Essentials and Cyber Essentials Plus for a Microsoft 365 firm?

Cyber Essentials is a questionnaire marked externally. Cyber Essentials Plus adds a technical audit of a sample of your real devices by a certification body, normally within three months of the basic certificate. Plus tests whether your Intune and Defender settings actually reached the machines.

Can we exclude Microsoft 365 or some devices from scope?

Not Microsoft 365: cloud services cannot be excluded, and end-user devices must be in scope. A justified sub-set of the network can be agreed with the certification body.

Can Brocent certify us for Cyber Essentials?

No. Certification is issued by an IASME certification body. We prepare your tenant and your answers, and our audit is designed to be used as evidence for the Microsoft 365 part of your questionnaire.

Why would a Hong Kong or Singapore firm need Cyber Essentials?

Because UK customers and public bodies use it as a supplier requirement. UK customers and public bodies often write it into supplier requirements, and some insurers ask about it. Check the tender or contract wording. If you supply into the UK, your tenant is assessed the same way as a UK firm's, wherever your office is.