Check your readiness
Identity and productivity · Microsoft

Microsoft 365 and Entra ID settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Microsoft 365 Business Premium with Entra ID P1 (paths checked against Microsoft Learn).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

Cyber Essentials v3.3 requires MFA for every user and administrator of Microsoft 365, separate admin accounts that are not used for email, and Microsoft 365 Apps kept on a supported update channel. In Entra ID this is Conditional Access, dedicated admin accounts, blocked legacy authentication and the Current or Monthly Enterprise channel.

Key facts
Platform
Microsoft 365 and Entra ID (Microsoft)
Applies to
Microsoft 365 Business Premium with Entra ID P1 (paths checked against Microsoft Learn)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
18 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Microsoft 365 and Entra ID for firewalls?

Apply 3 settings in Microsoft 365 and Entra ID: block legacy authentication, turn off SMTP AUTH for the tenant and require MFA to reach the admin portals. Together they provide evidence for A7.17, A7.16 and A5.1.

Microsoft 365 has no boundary firewall you manage. The equivalent controls are the authentication and connection rules that stop unauthenticated access to the service. List the tenant as a cloud service in A2.9. See the firewalls requirements for what the control asks.

  1. Block legacy authentication

    A7.17AUTO-FAILA7.16AUTO-FAIL
    Entra admin center > Entra ID > Conditional Access > Policies > New policy > Users: All users > Target resources: All resources > Conditions > Client apps: Exchange ActiveSync clients, Other clients > Grant: Block access

    Legacy protocols cannot present a second factor, so leaving them on is a route around MFA.

  2. Turn off SMTP AUTH for the tenant

    A5.1A7.17AUTO-FAIL
    Exchange admin center > Settings > Mail flow > Turn off SMTP AUTH protocol for your organization

    Re-enable per mailbox only for a device that genuinely needs it, and document the reason.

  3. Require MFA to reach the admin portals

    A7.16AUTO-FAIL
    Entra admin center > Entra ID > Conditional Access > Policies > New policy > Target resources: Microsoft Admin Portals > Grant: Require multifactor authentication

A5: how do you configure Microsoft 365 and Entra ID for secure configuration?

Apply 4 settings in Microsoft 365 and Entra ID: remove or block unused accounts, stop users consenting to apps, turn on password protection and smart lockout and switch off password expiry. Together they provide evidence for A5.2, A7.3, A5.1, A7.10, A7.11 and A7.12.

Remove unused accounts, stop users consenting to third-party apps, and protect passwords against brute force. See the secure configuration requirements for what the control asks.

  1. Remove or block unused accounts

    A5.2A7.3
    Entra admin center > Entra ID > Users > Manage view > Edit columns > Add column: Last interactive sign-in time > Add filter (on or before a date) > select the user > Delete, or Account status: Edit > clear Account enabled

    Block sign-in on shared mailboxes too; they need no interactive account.

  2. Stop users consenting to apps

    A5.1
    Entra admin center > Entra ID > Enterprise apps > Consent and permissions > User consent settings > Do not allow user consent

  3. Turn on password protection and smart lockout

    A7.10A7.11
    Entra admin center > Entra ID > Authentication methods > Password protection > Lockout threshold: 10 > Enforce custom list: Yes > Custom banned password list

    Smart lockout defaults to 10 failed attempts in commercial tenants, which meets the 10-attempt limit in A7.10. Customising the threshold or the banned password list needs Entra ID P1. For A7.11, MFA meets the password quality requirement on its own; an 8-character minimum plus a deny list is the backup.

  4. Switch off password expiry

    A7.11A7.12
    Microsoft 365 admin center > Settings > Org settings > Security & privacy > Password expiration policy > Set passwords to never expire

    The requirements say not to enforce regular expiry. Rotate on suspected compromise instead (A7.13).

A6: how do you configure Microsoft 365 and Entra ID for security update management?

Apply 3 settings in Microsoft 365 and Entra ID: put Microsoft 365 Apps on a supported channel, find and remove unsupported Office installs and record the tenant and service health source. Together they provide evidence for A6.5, A6.5.1, A6.2.4, A6.6 and A2.9.

Microsoft patches the service. Your job is the Microsoft 365 Apps clients and any old Office versions still installed. See the security update management requirements for what the control asks.

  1. Put Microsoft 365 Apps on a supported channel

    A6.5AUTO-FAILA6.5.1A6.2.4
    Microsoft 365 Apps admin center (config.office.com) > Home > Manage (next to the Current Channel or Monthly Enterprise Channel cloud update profile) > assign your Entra groups; or Intune admin center > Devices > Configuration > Create > Windows 10 and later > Settings catalog > Microsoft Office 2016 (Machine) > Updates > Enable Automatic Updates: Enabled, Update Channel: Monthly Enterprise Channel; for unmanaged installs, Microsoft 365 admin center > Settings > Org settings > Services > Microsoft 365 installation options > Feature updates

    Microsoft recommends Cloud Update. Since July 2026, Semi-Annual Enterprise Channel receives feature and security updates monthly on the same basis as Monthly Enterprise Channel. The admin center setting only affects unmanaged installs, so do not rely on it if Intune or Group Policy also sets a channel.

  2. Find and remove unsupported Office installs

    A6.2.4A6.6
    Intune admin center > Apps > Monitor > Discovered apps (search Office, Microsoft Office Professional Plus, Office 16); or Microsoft Defender portal > Endpoints > Vulnerability management > Inventories > Software; for unmanaged devices, Settings > Apps > Installed apps on each device

    Office 2016 and 2019 ended support on 14 October 2025, and Office 2021 and Office LTSC 2021 on 13 October 2026. Any of these on an in-scope device fails A6.2. Upgrade to Microsoft 365 Apps or Office LTSC 2024.

  3. Record the tenant and service health source

    A2.9
    Microsoft 365 admin center > Health > Service health and Health > Message center

A7: how do you configure Microsoft 365 and Entra ID for user access control?

Apply 5 settings in Microsoft 365 and Entra ID: require MFA for all users, require MFA for administrators, create dedicated admin accounts with no mailbox, disable leavers and revoke sessions and review admin roles regularly. Together they provide evidence for A7.17, A7.14, A7.16, A7.6, A7.7, A7.8, A7.3 and A7.9.

MFA for everyone, dedicated admin accounts, and a joiner and leaver process you can describe in the notes field. See the user access control requirements for what the control asks.

  1. Require MFA for all users

    A7.17AUTO-FAILA7.14
    Entra admin center > Entra ID > Conditional Access > Create new policy from templates > Require multifactor authentication for all users > then switch the policy from Report-only to On

    Target All users and All resources. Do not exclude groups of ordinary users or trusted office locations: Cyber Essentials Plus test case 4.1 has users sign in from an incognito browser session and fails if no MFA prompt appears. Break-glass accounts are the only usual exclusion; document them.

  2. Require MFA for administrators

    A7.16AUTO-FAIL
    Entra admin center > Entra ID > Conditional Access > Create new policy from templates > Require multifactor authentication for admins > then switch the policy from Report-only to On

    Microsoft also enforces MFA for the Azure portal, Entra admin center, Intune admin center and Microsoft 365 admin center under its mandatory MFA programme, but Microsoft does not list the Exchange, SharePoint or Teams admin centres in that programme. Your own policy covers them.

  3. Create dedicated admin accounts with no mailbox

    A7.6A7.7A7.8
    Microsoft 365 admin center > Users > Active users > Add a user (no licence) then Entra admin center > Entra ID > Roles & admins > Global Administrator (select the role name) > Add assignments

    Remove admin roles from any account that also has a mailbox. Two to four global admins is the usual target.

  4. Disable leavers and revoke sessions

    A7.3
    Entra admin center > Entra ID > Users > All users > select the user > Account status: Edit > clear Account enabled > Save, then Overview > Revoke sessions

  5. Review admin roles regularly

    A7.9A7.8
    Entra admin center > Entra ID > Roles & admins > select each privileged role to list its assignments (or ID Governance > Access Reviews with Entra ID P2)

A8: how do you configure Microsoft 365 and Entra ID for malware protection?

Apply 3 settings in Microsoft 365 and Entra ID: configure the anti-malware policy, turn on Safe Links and Safe Attachments and apply preset security policies. Together they provide evidence for A8.2 and A8.3.

Mail and link filtering in Microsoft 365 supports the control but does not replace anti-malware on the devices themselves (see the Defender for Business guide). See the malware protection requirements for what the control asks.

  1. Configure the anti-malware policy

    A8.2
    Microsoft Defender portal (security.microsoft.com) > Email & collaboration > Policies & rules > Threat policies > Anti-malware > Default policy > Enable the common attachments filter: On, Enable zero-hour auto purge for malware: On

  2. Turn on Safe Links and Safe Attachments

    A8.3
    Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Safe Links and Safe Attachments (Defender for Office 365 Plan 1, included in Business Premium)

    Safe Links warns on malicious URLs in mail and Teams; endpoints still need SmartScreen or equivalent for browsing.

  3. Apply preset security policies

    A8.2A8.3
    Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset Security Policies (Templated policies section) > Standard protection: On for all users

Which questions does this guide cover?

The 20 questions below are the ones Microsoft 365 and Entra ID can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A2.9Please list all the cloud services that are in use by your organisation and provided by a third party.A6: Record the tenant and service health source
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A4: Turn off SMTP AUTH for the tenant; A5: Stop users consenting to apps
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Remove or block unused accounts
A6.2.4Please list all office applications that are used to create organisational data.A6: Put Microsoft 365 Apps on a supported channel; A6: Find and remove unsupported Office installs
A6.5AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?A6: Put Microsoft 365 Apps on a supported channel
A6.5.1Are all updates applied on your applications by enabling auto updates?A6: Put Microsoft 365 Apps on a supported channel
A6.6Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?A6: Find and remove unsupported Office installs
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A5: Turn on password protection and smart lockout
A7.11Which technical controls are used to manage the quality of your passwords within your organisation?A5: Turn on password protection and smart lockout; A5: Switch off password expiry
A7.12Please explain how you encourage people to use unique and strong passwords.A5: Switch off password expiry
A7.14Do all of your cloud services have multi-factor authentication (MFA) available as part of the service?A7: Require MFA for all users
A7.16AUTO-FAILHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?A4: Block legacy authentication; A4: Require MFA to reach the admin portals; A7: Require MFA for administrators
A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?A4: Block legacy authentication; A4: Turn off SMTP AUTH for the tenant; A7: Require MFA for all users
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?A5: Remove or block unused accounts; A7: Disable leavers and revoke sessions
A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?A7: Create dedicated admin accounts with no mailbox
A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?A7: Create dedicated admin accounts with no mailbox
A7.8Do you formally track which users have administrator accounts in your organisation?A7: Create dedicated admin accounts with no mailbox; A7: Review admin roles regularly
A7.9Do you review who should have administrative access on a regular basis?A7: Review admin roles regularly
A8.2If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?A8: Configure the anti-malware policy; A8: Apply preset security policies
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Turn on Safe Links and Safe Attachments; A8: Apply preset security policies

What evidence should you keep for the assessor?

Keep the 5 dated records listed below for Microsoft 365 and Entra ID. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Export of Conditional Access policies (Entra admin center > Entra ID > Conditional Access > Policies) showing MFA for all users, MFA for admins and the legacy authentication block.
  • Entra ID sign-in log filtered on Authentication requirement: Multifactor authentication for a sample of users.
  • List of role assignments for Global Administrator and other privileged roles, showing dedicated accounts with no licence.
  • Microsoft 365 Apps admin center Inventory export (config.office.com) showing each device's build and update channel.
  • Screenshot of the SMTP AUTH and user consent settings.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Usually, yes. Security defaults require every user to register for MFA, require MFA at every sign-in for privileged roles such as Global Administrator, and block legacy authentication. For ordinary users Microsoft prompts for MFA when it judges it necessary, based on location, device and task. If you hold Entra ID P1, a Conditional Access policy requiring MFA for all users on all resources gives a clearer export for A7.17 and a predictable prompt for Cyber Essentials Plus test case 4.1.

Shared mailboxes should have sign-in blocked so they have no interactive login to protect. Genuine service accounts that must sign in interactively are the exception; document each one, protect it with a long unique password and lockout, and expect the assessor to ask why MFA is not possible.

Yes. Requirements v3.3 say SMS is not the most secure type of MFA but that any multi-factor authentication is better than none, and recommend an alternative where one will work. The Microsoft Authenticator app, a passkey or a FIDO2 key is preferred; SMS still passes A7.16 and A7.17.

Test case 4.1 in the CE Plus test specification v3.2 has the assessor watch a user, and an administrator, sign in to Microsoft 365 with their organisation account from an untrusted device or an incognito browser session. A prompt for MFA before access is granted is a pass. Because all Microsoft 365 apps share Entra ID, the test is done once for that authentication service.

Office 2016 and Office 2019 lost support on 14 October 2025, and Office 2021 and Office LTSC 2021 on 13 October 2026. Any of them on an in-scope device makes A6.2 a No. Microsoft 365 Apps on a supported channel and Office LTSC 2024 (supported to 9 October 2029) are the current options.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources