Check your readiness
Endpoint security · Microsoft

Microsoft Defender for Business settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Defender for Business (Microsoft 365 Business Premium).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

Defender for Business evidences malware protection option A for Cyber Essentials on Windows and macOS: real-time protection, automatic security intelligence updates, tamper protection and web protection on every onboarded device. Its vulnerability management view lists missing security updates and end-of-support software, which supports the 14-day rule and the Cyber Essentials Plus authenticated patch scan.

Key facts
Platform
Microsoft Defender for Business (Microsoft)
Applies to
Defender for Business (Microsoft 365 Business Premium)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
12 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Microsoft Defender for Business for firewalls?

Apply 1 setting in Microsoft Defender for Business: enforce the firewall from the Defender portal. Together they provide evidence for A4.1.1 and A4.7.

Defender for Business can manage the Windows firewall through security settings management, so the same console evidences A4.1.1. See the firewalls requirements for what the control asks.

  1. Enforce the firewall from the Defender portal

    A4.1.1A4.7
    Microsoft Defender portal > Endpoints > Configuration management > Device configuration > Windows tab > Firewall section > select the policy or Add > Domain network, Public network, Private network: firewall on, inbound connections blocked (the Defender for Business default)

A5: how do you configure Microsoft Defender for Business for secure configuration?

Apply 2 settings in Microsoft Defender for Business: enable attack surface reduction rules and review the device exposure list. Together they provide evidence for A5.8 and A5.1.

Attack surface reduction rules stop common ways files run without the user meaning them to, which supports A5.8. See the secure configuration requirements for what the control asks.

  1. Enable attack surface reduction rules

    A5.8
    Intune admin center (included in Business Premium) > Endpoint security > Attack surface reduction > Create policy > Platform: Windows > Profile: Attack Surface Reduction Rules > Block executable content from email client and webmail: Block; Block untrusted and unsigned processes that run from USB: Block; Block all Office applications from creating child processes: Block

    Run new rules in Audit mode for a week, check the report for business apps that would break, then switch to Block.

  2. Review the device exposure list

    A5.1
    Microsoft Defender portal > Endpoints > Vulnerability management > Recommendations > filter Remediation type: Configuration change

A6: how do you configure Microsoft Defender for Business for security update management?

Apply 3 settings in Microsoft Defender for Business: review missing security updates, find end-of-support software and export the software inventory. Together they provide evidence for A6.4, A6.5, A6.2, A6.3, A6.6, A6.2.1, A6.2.2, A6.2.3 and A6.2.4.

Vulnerability management shows which devices are missing which updates and which installed software has reached end of support. Use it to prove the 14-day window and to find unsupported software before the assessor does. See the security update management requirements for what the control asks.

  1. Review missing security updates

    A6.4AUTO-FAILA6.5AUTO-FAIL
    Microsoft Defender portal > Endpoints > Vulnerability management > Recommendations > filter Remediation type: Software update; sort by Exposed devices

    Anything rated critical or high, or scored CVSS v3 7.0 or above, that has had a fix available for more than 14 days is what fails Cyber Essentials Plus test case 2.

  2. Find end-of-support software

    A6.2A6.3A6.6
    Microsoft Defender portal > Endpoints > Vulnerability management > Inventories > Software tab > add a Tags filter and select the end-of-support (EOS) tags

  3. Export the software inventory

    A6.2.1A6.2.2A6.2.3A6.2.4
    Microsoft Defender portal > Endpoints > Vulnerability management > Inventories > Software tab > Export

    The export gives you the browser, anti-malware, email and office application versions that A6.2.1 to A6.2.4 ask you to list.

A7: how do you configure Microsoft Defender for Business for user access control?

Apply 1 setting in Microsoft Defender for Business: restrict Defender portal admin roles. Together they provide evidence for A7.5 and A7.8.

Defender does not manage user accounts. Use the Microsoft 365 and Intune guides for A7, and keep Defender portal roles to dedicated admin accounts. See the user access control requirements for what the control asks.

  1. Restrict Defender portal admin roles

    A7.5A7.8
    Entra admin center > Users > All users > select the user > Assigned roles > Add assignments (or Microsoft 365 admin center > Users > Active users > Manage roles); assign Security Administrator only to dedicated admin accounts

A8: how do you configure Microsoft Defender for Business for malware protection?

Apply 5 settings in Microsoft Defender for Business: onboard every device, enforce the antivirus policy, turn on tamper protection, turn on web protection and check device health. Together they provide evidence for A8.1, A8.2 and A8.3.

The core of the guide. Onboard every Windows and macOS device, enforce the antivirus policy, stop users switching it off, and turn on web protection for A8.3. See the malware protection requirements for what the control asks.

  1. Onboard every device

    A8.1
    Microsoft Defender portal > Settings > Endpoints > Device management > Onboarding > select the operating system > Deployment method (Local script for a handful of devices; devices enrolled in Intune can be onboarded through Intune)

    Compare the onboarded device count with your A2.6 list. An unonboarded laptop has no evidence of protection.

  2. Enforce the antivirus policy

    A8.1A8.2
    Microsoft Defender portal > Endpoints > Configuration management > Device configuration > Windows tab > Next-generation protection > Turn on real-time protection: On, Block at first sight: On, Action to take on potentially unwanted apps (PUA): Enabled (security intelligence checks every four hours are preconfigured)

  3. Turn on tamper protection

    A8.2
    Microsoft Defender portal > Settings > Endpoints > General > Advanced features > Tamper protection: On

    Stops local users or malware turning real-time protection off.

  4. Turn on web protection

    A8.3
    Next-generation protection policy > Turn on network protection: Block mode (the default); optionally Settings > Endpoints > Rules > Web content filtering > + Add policy to block content categories

  5. Check device health

    A8.2
    Microsoft Defender portal > Reports > Endpoints > Device health > Microsoft Defender Antivirus health (engine, platform and security intelligence versions)

Which questions does this guide cover?

The 18 questions below are the ones Microsoft Defender for Business can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A4.1.1Do you have software firewalls enabled on all of your computers, laptops and servers?A4: Enforce the firewall from the Defender portal
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Enforce the firewall from the Defender portal
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Review the device exposure list
A5.8Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?A5: Enable attack surface reduction rules
A6.2Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?A6: Find end-of-support software
A6.2.1Please list your internet browser(s).A6: Export the software inventory
A6.2.2Please list your malware protection softwareA6: Export the software inventory
A6.2.3Please list your email applications installed on end user devices and servers.A6: Export the software inventory
A6.2.4Please list all office applications that are used to create organisational data.A6: Export the software inventory
A6.3Are any of the in-scope software or cloud services unlicensed or unsupported?A6: Find end-of-support software
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Review missing security updates
A6.5AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?A6: Review missing security updates
A6.6Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?A6: Find end-of-support software
A7.5Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?A7: Restrict Defender portal admin roles
A7.8Do you formally track which users have administrator accounts in your organisation?A7: Restrict Defender portal admin roles
A8.1Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:A8: Onboard every device; A8: Enforce the antivirus policy
A8.2If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?A8: Enforce the antivirus policy; A8: Turn on tamper protection; A8: Check device health
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Turn on web protection

What evidence should you keep for the assessor?

Keep the 5 dated records listed below for Microsoft Defender for Business. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Device health report showing antivirus mode, engine, platform and security intelligence versions per device.
  • Next-generation protection and firewall policies from Device configuration, and the attack surface reduction policy from Intune, with their assignments.
  • Vulnerability management recommendations export showing no critical or high-risk updates older than 14 days.
  • Software inventory export filtered on the End of support tag.
  • Onboarded device list reconciled against the A2.6 device count.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Yes when it is active, updated and set to block. Test case 3 checks anti-malware is installed and running, then the assessor sends test files by email (sub-test 3.1.1) and downloads them in the browser (sub-test 3.1.2). A pass needs malware test files blocked and executable test files unable to run without an extra prompt. Where test files cannot prove it, the assessor checks logs and update status instead (3.1.3).

It can, but Cyber Essentials does not ask for anti-malware software on phones. Requirements v3.3 limit the anti-malware option to Windows and macOS devices. iPhones, iPads and Android phones meet A8.1 through application allow listing (option B): signed apps from an approved list, with installs from elsewhere blocked.

It is the best preparation for one. Cyber Essentials Plus test case 2 uses an assessor-approved scanner on sampled devices, so your own reports do not replace it. Clearing Defender's critical and high-risk software update recommendations before the audit is the most reliable way to pass it.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources