A7.17: Has MFA been applied to all users of your cloud services?
Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A7.17 every user of every cloud service that offers MFA must have it enforced, with a password of at least 8 characters. Services in A7.15 with no MFA option are the only exceptions. A No is an automatic fail. SMS, passkeys and FIDO2 all count, and Cyber Essentials Plus test case 4 checks it live.
Is A7.17 an automatic fail?
Yes. A7.17 is one of the four questions in the 2026 Danzell question set that fail automatically on a No answer (A6.4, A6.5, A7.16 and A7.17): answering No fails the whole Cyber Essentials assessment, whatever the other answers say.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- All users of your cloud services must use MFA in conjunction with a password of at least 8 characters. Please note that the assessment will fail if the answer is no.
- Requirement enforced
Your organisation must implement MFA, where available – authentication to cloud services must always use MFA.
- Outcome if non-compliant
- Automatic fail on a No answer under the Danzell question set
- Related questions
- A7.16AUTO-FAILA8.1Back to the user access control control
What does A7.17 ask?
A7.17 asks: “Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?”
A7.17 asks whether MFA has been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it. The guidance says all users of your cloud services must use MFA in conjunction with a password of at least 8 characters, and that the assessment will fail if the answer is no.
The requirement is the same as for administrators: implement MFA, where available; authentication to cloud services must always use MFA. Users means everyone with an account: staff, volunteers, contractors, shared mailboxes that someone signs into, and any external users you have issued accounts to.
The requirements recognise four types of additional factor: a managed or enterprise device, an app on a trusted device, a physically separate token, and a known or trusted account. FIDO2 authenticators are regarded as MFA because user authentication is performed. SMS is accepted, though the NCSC recommends alternatives where they work for you. See passkeys, FIDO2 and Cyber Essentials and how CE Plus test case 4 checks MFA.
What must be true to answer Yes to A7.17?
You can answer Yes to A7.17 only when all of the following are true today, across every device, user and cloud service in scope.
- MFA is enforced, not optional, for every user account on every cloud service in A2.9 that offers it.
- The policy has no exclusions for departments, part-time staff, volunteers or 'low risk' users.
- Legacy authentication that bypasses MFA is blocked.
- Every service outside single sign-on has MFA turned on in the service itself, including social media accounts.
Why do applicants fail A7.17?
A common reason applicants fail A7.17: MFA enforced for administrators but left optional for users, or rolled out to 'most' staff.
- Conditional access that only applies off the corporate network, leaving on-site logins with password only.
- Single sign-on covering Microsoft 365 while finance, HR and marketing tools use their own passwords without MFA.
- Shared mailboxes or kiosk accounts that someone signs into interactively without MFA.
How do you fix a failing A7.17 answer?
If your answer to A7.17 would not pass today, fix the control first and then write the answer. In order:
- Enforce MFA for all users on every service that offers it, not just administrators.
- Remove exclusions for groups, locations or the office network, and block legacy authentication.
- Turn on MFA in each service outside single sign-on, including social media.
- Test each service from a private browser as a standard user.
How do assessors check A7.17?
What evidence should you keep for A7.17?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.17:
- The MFA registration and enforcement report for all users.
- For each service outside single sign-on, the MFA enforcement setting.
Where to go next
- Microsoft 365 and Entra ID setupSetup guide
- Google Workspace setupSetup guide
- Passkeys, FIDO2 and Cyber EssentialsWhich factors count
- SMS verification codesGlossary
- CE Plus test 4: MFA on cloud servicesHow MFA is tested live
- User Access Control requirementsThe control this question tests
- All A7 questionsUser access control
- Cyber Essentials checklistThe evidence to gather for every question
Other A7 questions
- A7.13A7.13Yes/NoDo you have a process for when you believe the passwords or accounts have been compromised?Yes/No
- A7.14A7.14Yes/NoDo all of your cloud services have multi-factor authentication (MFA) available as part of the service?Yes/No
- A7.15A7.15Conditional auto-failIf you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Conditional auto-fail
- A7.16A7.16Auto-failHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?Auto-fail
Frequently asked questions
A7.17 in the 2026 Danzell Cyber Essentials question set asks: "Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?" It is a Yes/No question.
To answer Yes to A7.17 every user of every cloud service that offers MFA must have it enforced, with a password of at least 8 characters. Services in A7.15 with no MFA option are the only exceptions. A No is an automatic fail. SMS, passkeys and FIDO2 all count, and Cyber Essentials Plus test case 4 checks it live.
Yes. The guidance states that the assessment will fail if the answer is no, in line with A7.16. A7.15 is the related conditional fail: listing a cloud service there that does offer MFA is also an automatic fail.
Yes. The requirements say SMS is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all. Where an alternative such as an authenticator app or passkey works for your users, the NCSC recommends it instead.
Yes. v3.3 states that FIDO2 authenticators are considered passkeys and are regarded as MFA because user authentication is performed. A tenant that signs in with passkeys meets the requirement without a separate second factor.
Yes. Any account your organisation owns is in scope, whoever uses it. If you issue a volunteer or contractor an account on a cloud service that offers MFA, it must be enforced.
Test case 4.1: users of sampled devices log in to each cloud service with their organisation-issued account on an untrusted device or in an incognito browser while the assessor watches. A prompt for MFA before access is a Pass; no prompt is a Fail.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh