Cloud tenant
A cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data. Cyber Essentials treats it as a cloud service, and cloud services cannot be excluded from scope. List it at A2.9 and apply MFA to every user and administrator (A7.16, A7.17).
- Term
- Cloud tenant
- Also known as
- Tenant, Microsoft 365 tenant, Google Workspace account, Cloud subscription
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A2.9A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term cloud tenant mean in Cyber Essentials?
A cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
How does cloud tenant apply to Cyber Essentials?
In plain terms
A tenant is like a flat in a large apartment block. The building, its lifts and its wiring are shared and run by the landlord, but your flat has its own front door, keys and furniture. In the same way, Microsoft or Google runs the servers, while your tenant holds your staff accounts, your settings and your data.
What Cyber Essentials asks
The NCSC requirements define a cloud service as one "accessed via an account" that will "store or process data for your organisation", and state: "Cloud services cannot be excluded from scope." A2.9 asks you to list all the cloud services your organisation uses.
The requirements also set out who does what in the cloud. For user access control, the table gives the answer "Your organisation" for infrastructure, platform and software services alike. The provider looks after the building; you are responsible for who holds the keys to your flat. That means inside your tenant:
- MFA for every administrator (A7.16) and every user (A7.17). A No to either is an automatic fail.
- Separate accounts for admin work (A7.6).
- Only accounts that are needed (A5.2), with leavers removed (A7.3).
Common mistakes
- A second, forgotten tenant, such as a trial set up years ago that still holds data or accounts.
- Guest or supplier accounts in the tenant that nobody reviews.
- Treating the provider's security certificates as covering your own settings. They cover the provider's part, not your users and MFA.
See who is responsible for user access control in cloud services and the Microsoft 365 and Entra ID setup guide. Related: cloud service, global administrator, scope.
Related terms
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- Conditional accessConditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
- Credential stuffingCredential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
Frequently asked questions
A cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
In the 2026 Danzell question set, cloud tenant comes up at A2.9, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Cloud tenant relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.