Cyber Essentials for Microsoft 365 businesses

Cyber Essentials is the UK government-backed scheme that sets a baseline of technical controls. Many UK organisations are asked for it by clients, insurers and public-sector buyers. If you run on Microsoft 365, most of the work is configuration you may already partly have. This guide explains what to expect. It is preparation guidance, not certification: certification is carried out by accredited certification bodies. This guide is based on the NCSC’s Cyber Essentials requirements for IT infrastructure v3.3, effective from 27 April 2026. The requirements are reviewed and updated regularly, so read the current scheme documents on the NCSC Cyber Essentials resources page before you start.

The five themes

The scheme covers five technical controls:

1. Firewalls and internet gateways for the devices and networks in scope.
2. Secure configuration of devices and software, including removing unneeded accounts and software and changing default settings.
3. Security update management, meaning supported software and timely installation of security updates. Relevant security updates must be applied within 14 days of release, subject to the conditions in the Cyber Essentials requirements.
4. User access control, including least privilege, separate administrator accounts and multi-factor authentication for cloud services.
5. Malware protection on devices, or controls that prevent malware from running.

What “scope” means

Scope is the part of your organisation the certificate covers. For most small businesses it is everything: all staff devices, all users and all cloud services such as Microsoft 365. A narrow scope is possible but must be genuine and clearly explained. It is worth deciding scope first because it drives everything else.

Where Microsoft 365 businesses get caught out

• Multi-factor authentication for cloud services. Cyber Essentials v3.3 requires multi-factor authentication for authentication to cloud services. This is the most common gap.
• Unsupported devices and software. Old laptops, phones or operating systems that no longer receive updates are a frequent problem. Personal or BYOD devices used for organisational work may fall within scope, depending on how the organisation defines its assessment boundary.
• Administrator accounts. Admins should not use their admin accounts for daily email and browsing.
• Leavers and unused accounts. Accounts that should have been removed.
• Unmanaged devices. If you cannot show that devices are patched and protected, you cannot answer the questionnaire with confidence.

How to prepare in Microsoft 365

Work from the identity and device controls outlined in our guide to the first ten security controls: enforce multi-factor authentication, block legacy sign-in, separate admin accounts, manage devices with Intune where your licence allows, and keep an inventory of devices and their update status. Save dated screenshots or exports as you go. They make the questionnaire much quicker and help if an assessor asks how you know.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is a self-assessment questionnaire that is reviewed by a certification body. Cyber Essentials Plus includes hands-on technical verification by an independent assessor, so it is more demanding and more convincing. Many organisations start with the basic certificate and add Plus when a client or insurer asks for it.

A sensible plan

Decide scope. List devices and cloud services. Close the multi-factor authentication and update gaps. Remove unused accounts. Then complete the questionnaire through an accredited certification body.

A security assessment of your Microsoft environment gives you a ranked list of the fixes that matter most, which is useful preparation before you begin.

Innoligo helps businesses prepare for Cyber Essentials and does not award the certification.