Cyber Essentials Plus for Microsoft 365: What the Technical Verification Actually Tests, and How to Prepare

The short version: Cyber Essentials Plus adds a hands-on technical audit to the Cyber Essentials self-assessment. For a Microsoft 365 and Intune estate, the assessor scans your public IP addresses, takes a random sample of your devices and servers, checks that every piece of software on them is supported and patched within 14 days for high and critical fixes, confirms malware protection works, and watches users sign in to your cloud services to see a multi-factor prompt. Under the v3.3 requirements (the "Danzell" question set, from 27 April 2026), missing MFA on a cloud service where it is available is an automatic fail. Preparation is mostly about evidence: reports that show the whole estate, not just the devices the assessor happens to pick.

If your organisation already holds Cyber Essentials, the step to Cyber Essentials Plus on Microsoft 365 can feel like a small one. It is the same five technical controls. What changes is who checks them. The basic certificate rests on answers that a board member signs; Plus puts an assessor in front of your actual devices and your actual sign-in prompts, and that is where gaps that nobody wrote down tend to surface.

This article covers only that technical verification as it applies to a Microsoft 365 / Intune estate: what is tested, what the April 2026 changes mean, which Microsoft 365 reports serve as evidence, and where organisations commonly come unstuck. For the five controls themselves and how they map onto Microsoft 365, start with our Cyber Essentials and Microsoft 365 controls guide; this piece picks up where its "Cyber Essentials vs Cyber Essentials Plus" section ends.

One thing to be clear about from the outset. Brocent is not a Cyber Essentials certification body and does not issue or assess certificates. In the UK, certification is delivered through IASME, the scheme's delivery partner for the NCSC, and its licensed certification bodies and assessors. What we do is help you prepare and produce evidence before the assessor arrives.

What is Cyber Essentials Plus, and how is it different from Cyber Essentials?

Cyber Essentials is a UK government-backed scheme, owned by the National Cyber Security Centre (NCSC), that sets five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The basic certificate is a verified self-assessment: you answer the question set, a senior person signs it, and an assessor reviews the answers.

Cyber Essentials Plus uses the same requirements but adds a technical audit. IASME describes it as an audit, carried out on site or remotely, that includes vulnerability scans of your in-scope infrastructure and hands-on checks of a sample of devices. Two practical points from IASME's own guidance shape the timeline:

• Order: the Plus audit must be completed within three months of your most recent Cyber Essentials certification (the two can also be done at the same time).
• Same scope: what the assessor tests is drawn from the scope you declared in the self-assessment. A scope that was drawn generously on paper becomes the scope the assessor samples from.

The requirements document in force for new assessments is Cyber Essentials: Requirements for IT Infrastructure v3.3, published by the NCSC, with the matching IASME question set named "Danzell". IASME states that it applies to assessment accounts created from 27 April 2026; accounts created earlier under v3.2 ("Willow") continue on that version. Check the NCSC Cyber Essentials resources page on the day you start, because the scheme is updated roughly once a year.

What does the Cyber Essentials Plus assessor actually test?

Based on the IASME guidance and the NCSC test specification, the technical verification falls into five checks. The wording below is ours; the assessor works from the current test specification, which is the document to read in full before your audit.

Check 1: External vulnerability scan

The assessor scans each of your public IP addresses using a tool from an IASME-approved scanning vendor. In a cloud-first Microsoft 365 estate this is often a short list: the office router or firewall, any VPN gateway, and anything you host yourself. What fails here is usually forgotten: a remote-management interface left open on the firewall, an old remote desktop port forwarded for one supplier, a NAS published to the internet years ago.

Check 2: A random sample of devices and servers

The assessor takes a representative sample of your end-user devices (IASME says typically around 10 per cent), plus all internet gateways and all servers that offer services to unauthenticated internet users. On each sampled device they check, by authenticated vulnerability scan or manual inspection, that:

• All installed software is supported by its vendor. An unsupported browser extension, an old PDF reader or a runtime nobody remembers installing counts.
• High and critical security updates were applied within 14 days of release, which is the Cyber Essentials security update management requirement.

Check 3: Malware protection

The test specification includes checks that the malware protection you declared actually works on the sampled devices, for example that Microsoft Defender Antivirus is running, up to date and acting on test files delivered by email and web.

Check 4: MFA on cloud services

This is the check that matters most in a Microsoft 365 estate. The assessor observes users signing in to each cloud service with their organisation accounts, from an untrusted device or a private browser session, and confirms they receive a multi-factor challenge. The published Cyber Essentials Plus test specification (v3.2) states that the sample is at least one standard user and one administrator for each cloud service, and that services sharing one identity provider are tested once for that identity provider; a v3.3-specific test specification was not located at the time of writing, so check whether one has been issued before your assessment. If all of your SaaS applications sign in through Microsoft Entra ID, that is one test, and its result covers all of them.

Check 5: Account separation and administrative privileges

The assessor checks that users do not work day to day with administrative rights, and that administrative accounts are used only for administration, not for email and web browsing. On Windows endpoints that means looking at local administrator membership on the sampled devices; in Microsoft 365 it means looking at who holds Global Administrator and the other privileged roles.

What changed for Cyber Essentials Plus in April 2026 (v3.3, "Danzell")?

Three changes from the April 2026 update matter for a Microsoft 365 organisation preparing for Plus. All three are stated in IASME's announcements and the NCSC v3.3 requirements.

• Cloud MFA is an automatic fail. IASME states that MFA is mandatory for all cloud services where it is available, whether it is free, included or a paid option, and that an organisation that does not implement it now fails automatically. "We have MFA for most staff" is no longer a partial answer.
• Cloud services cannot be excluded from scope. v3.3 adds a definition of cloud services, and they are in scope. Microsoft 365, the accounting package, the HR system and the CRM are all in.
• Sample failures now trigger a wider retest. If the initial random sample fails, you remediate and the assessor retests both the original sample and a new random sample of devices. IASME explains the reason plainly: some organisations had patched only the sampled devices. IASME's certification-body schedule also states that a Plus assessment which fails because of unpatched software leads to the associated Cyber Essentials certificate being revoked where the assessment uses the Danzell question set.

The third change is the one that turns preparation into an estate-wide exercise. Before, fixing what the assessor found on ten laptops could be enough. Now the fix has to be real across every device in scope, because the next ten will be different.

How do the tests map onto Microsoft 365 and Intune?

Each test has a natural home in the Microsoft 365 admin tooling. This is where we look when preparing evidence, and where an assessor's findings usually trace back to.

• MFA on cloud services → Microsoft Entra ID. Conditional Access policies (or security defaults on very small tenants) that require MFA for all users and all cloud apps; the authentication methods registration report showing who has actually registered a method; and the sign-in logs showing MFA being satisfied. Watch for legacy authentication still allowed, break-glass accounts without a documented exception, and third-party SaaS that signs in with its own username and password rather than through Entra.
• Patching within 14 days → Intune and Windows Update for Business. Update rings and feature/quality update policies, plus the Windows update reports that show which devices are behind. Third-party applications are the common gap: Windows updates are on time, while a browser, Java runtime or PDF reader on the same laptop is months out of date.
• Supported software → Intune discovered apps. The discovered apps inventory is the quickest way to find software that is no longer supported, before the assessor's scan does.
• Malware protection → Microsoft Defender. Antivirus policy in Intune endpoint security, and device health reports showing real-time protection on and signatures current on every enrolled device.
• Account separation → Entra roles and Intune local admin policy. A list of privileged role assignments with named owners, separate admin accounts for administrators, and an Intune policy that controls local administrator membership on Windows devices.
• Secure configuration → Intune compliance and configuration profiles. Device compliance policies (encryption, firewall, minimum OS version) and the compliance report that shows which devices meet them.

Our Intune device audit article walks through these Intune reports in more detail, and the Intune audit sample report shows the format they come out in.

What evidence should you prepare before the Plus audit?

The assessor tests a sample, but the April 2026 retest rule means you need to know the state of the whole estate. A useful evidence folder, prepared in the fortnight before the audit, contains:

1. A scope statement that matches the self-assessment: which offices, which devices, which cloud services, and the reason for anything excluded (cloud services cannot be).
2. A device inventory exported from Intune, with OS version, last check-in and compliance state, reconciled against the asset list so that devices outside Intune are visible.
3. An MFA coverage export: the Conditional Access policies, the registration report and a list of every account excluded from MFA with its reason.
4. Patch status for operating systems and third-party applications, showing anything outside the 14-day window and what is being done about it.
5. A privileged access list: every account with an admin role in Microsoft 365 and on endpoints, and the separate account each administrator uses for daily work.
6. Malware protection status from Defender for every device in scope.
7. External exposure: the list of public IP addresses, and what each one exposes.

None of this is a Plus certificate. It is the material that tells you, before the assessor does, whether the sample will pass.

Cyber Essentials Plus readiness: three ways UK organisations prepare

Organisations we speak to tend to prepare in one of three ways. Each is legitimate; they differ in how much of the risk they leave to the audit day.

• Go straight to the assessor: lowest preparation effort. The audit itself becomes the discovery exercise. With the retest rule, a failed sample now means remediation across the estate and a second sample, under time pressure, with the certificate at stake.
• Internal pre-check: your own IT team runs the reports above. Works well when that team owns Entra, Intune and patching end to end; the common weakness is third-party application patching and cloud apps that sit outside the Entra sign-in.
• Independent pre-assessment of the Microsoft 365 view: someone outside the day-to-day team reviews the tenant and devices against the v3.3 controls and hands back dated evidence and a fix list. It costs money up front, and it does not replace the assessor or certify anything; its value is finding the gaps while there is still time to close them across the whole estate.

Where Brocent fits, and where it does not

Our Microsoft 365 security audit is a fixed-price, one-off review of your tenant and Intune-managed devices. It is priced by headcount, from US$450 for up to 10 users, with fixed bands up to 150 users, and the report is delivered in 5–7 business days. The report includes a Cyber Essentials v3.3 readiness table for the Microsoft 365 view (MFA on cloud services, administrative accounts, legacy authentication and secure configuration), with each row pointing to a dated export.

To be precise about what that is: it is preparation evidence, designed to be used as evidence in your Cyber Essentials assessment. It is not a Cyber Essentials Plus audit, it does not certify anything, and the certification body and its assessor make their own decision on the day. It also covers only the Microsoft 365 and Intune view; the external vulnerability scan of your office internet connection and devices outside Intune need their own checks.

For UK organisations, contracts are with Brocent's Hong Kong company or our Singapore headquarters, and on-site work in the UK is carried out through our coordinated network of vetted local engineers; the UK IT support page sets out exactly what is delivered where. If you are unsure whether a pre-assessment is worth it for your estate, ask a consultant before booking anything.

Common reasons Microsoft 365 estates fail the Plus sample

From the controls themselves, these are the gaps most likely to show up when an assessor samples a Microsoft 365 / Intune estate:

• A cloud service outside Entra. One SaaS tool still uses its own password login with MFA available but switched off. Under v3.3 that is an automatic fail on its own.
• An MFA exclusion that grew. A Conditional Access exclusion group created for a migration that still contains a dozen users.
• Third-party apps out of date. Windows is patched, but a browser or runtime on the sampled laptop is not.
• Devices that never enrolled. A director's personal laptop used for work email, or a device enrolled once and not checked in for months.
• Daily-use admin accounts. An administrator who reads email and browses from the Global Administrator account.
• Forgotten exposure. A port forward or management interface on the office firewall that appears in the external scan.

Our cyber insurance MFA requirements article covers the MFA exclusion problem in more depth; insurers and Cyber Essentials ask the same question in slightly different words.

Frequently asked questions

Does Microsoft 365 need MFA for every user to pass Cyber Essentials Plus?

Under v3.3, IASME states that MFA is mandatory on all cloud services where it is available, and that not implementing it is an automatic fail. The assessor's test samples at least one standard user and one administrator per cloud service (per identity provider where services share sign-in). In practice that means every user, because you cannot predict which accounts will be sampled and the declaration covers all of them.

Is Intune required for Cyber Essentials Plus?

No. Cyber Essentials does not require any particular product. Intune is simply where a Microsoft 365 organisation usually gets the evidence for secure configuration, patching, malware protection and admin rights on its devices. Devices not managed by Intune are still in scope and still need the same controls by other means.

What does "patched within 14 days" mean for the Plus test?

The Cyber Essentials requirement is that high and critical security updates are applied within 14 days of release. On each sampled device the assessor checks installed software against that rule, and checks that all software is still supported by its vendor. It applies to operating systems and to applications, browser extensions and firmware.

Can a Microsoft 365 security audit replace Cyber Essentials Plus?

No. Only a licensed certification body can award Cyber Essentials Plus, after its assessor has carried out the technical audit. A Microsoft 365 security audit like ours is preparation evidence, designed to be used as evidence in your assessment and to show you the gaps beforehand.

What happens if we fail the device sample?

Under the April 2026 rules you remediate and the assessor retests the original sample plus a new random sample of devices. IASME's certification-body schedule states that a Plus assessment which fails because of unpatched software leads to the associated Cyber Essentials certificate being revoked under the Danzell question set, so the fix needs to be applied across the whole scope, not only to the sampled devices.

How long before the audit should we start preparing?

That depends on how many gaps there are. A review that finds a few MFA exclusions and some out-of-date applications can be closed in days; one that finds devices outside Intune or a cloud service without MFA support may need a longer change. Starting a few weeks before your Plus window, and remembering it must fall within three months of your Cyber Essentials certification, leaves room for both.

Does Brocent provide on-site help in the UK?

Yes, within the limits on our UK IT support page: UK clients contract with Brocent's Hong Kong company or Singapore headquarters, and on-site visits are carried out by vetted local engineers we coordinate. The Microsoft 365 security audit itself is done remotely.

Sources

Requirements and scheme rules in this article are taken from the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3, the NCSC Cyber Essentials Plus test specification (v3.2) and IASME's published guidance on the April 2026 changes and on the difference between Cyber Essentials and Cyber Essentials Plus, as available on 31 October 2026. Scheme documents change; the current versions on ncsc.gov.uk and iasme.co.uk take precedence over anything summarised here.