Cyber Essentials Plus Test 4: MFA on cloud services

What does Test 4 check?

Test 4 checks, by observing a live sign-in from an untrusted device or an incognito browser session, that users and administrators of each cloud service in scope are prompted for MFA before access is granted.

Under v3.3, authentication to cloud services must always use MFA. On the self-assessment, A7.16 (administrators) and A7.17 (all users) are auto-fail questions. Test 4 is the practical check of those answers: not a policy screenshot, but a live sign-in.

How is the test performed?

The specification gives three steps and a single pass criterion.

• Untrusted device or incognito session: this defeats cached sessions, device trust and 'remember this device' settings, so the sign-in shows what an attacker with a stolen password would meet.
• One normal user and one administrator per cloud service, from the sample of accounts agreed before the audit.
• Once per authentication service: if Microsoft 365, Azure, Dynamics and a dozen SaaS apps all federate to Entra ID, the sign-in is tested once for Entra ID. A service with its own login (for example an accounting platform with local accounts) is tested separately.

What counts as a form of MFA?

The requirements list four types of additional factor: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. Authenticator apps, hardware keys, passkeys and FIDO2 authenticators all qualify; FIDO2 is treated as MFA because user authentication is performed as part of it.

SMS codes are accepted. The NCSC notes SMS is not the most secure type of MFA but still offers a large advantage over none, and recommends alternatives where they will work. The password element of an MFA approach must be at least 8 characters with no maximum length.

What does not count: a password alone, a security question, or a trusted-device policy that skips the second factor on the device being tested. The test is run from an untrusted session precisely to expose the last of these.

Which cloud services are in scope?

Every cloud service you list in A2.9: anything provided by a third party where your organisational data or services are hosted, including SaaS applications, IaaS and PaaS consoles, mobile device management, virtual desktops and IP telephony. Cloud services cannot be excluded from scope.

A7.14 asks whether every cloud service offers MFA. If a service genuinely does not, you list it in A7.15 and it is excluded from A7.16 and A7.17. Expect the assessor to check that claim, because most business services now support MFA at least for administrators.

How do you pass Test 4?

• Enforce MFA by policy, not by user opt-in. In Microsoft 365 that means Conditional Access or security defaults covering all users, not 'per-user MFA' left in the enabled-but-not-enforced state.
• Remove exclusions. Service accounts, shared mailboxes with sign-in enabled, the 'break glass' admin and the MD's account are the usual gaps. A7.16 has no exception for emergency access accounts, so protect them with MFA too, for example a FIDO2 security key kept in a safe.
• Test from an incognito window yourself for every authentication service, as both a standard user and an administrator, and confirm you are prompted before any data is shown.
• Inventory every cloud service with its own login (accounting, HR, CRM, file transfer, DNS, domain registrar) and enable MFA on each, or use single sign-on so they inherit the enforced policy.
• Keep the A7.15 list honest and short. A service without MFA support is a reason to change supplier, not a permanent exemption.

How do assessors check this?