Cyber Essentials with Microsoft 365: The Settings Admins Miss

To pass Cyber Essentials on Microsoft 365, your tenant and every in-scope device must meet the five technical controls in the NCSC's Requirements for IT Infrastructure v3.3, which applies to assessment accounts created after 27 April 2026. The settings admins most often miss are MFA on every cloud account, separate admin accounts, update deadlines that overrun 14 days, personal phones and unsupported Windows 10.

At a glance

What changed in April 2026

IASME, the NCSC's Cyber Essentials delivery partner, set out the changes in its April 2026 update. The items that matter most for Microsoft 365 tenants:

• MFA is mandatory for every cloud service, whether free, included or paid. Organisations that do not implement it now automatically fail the assessment.
• Cloud services cannot be excluded from scope, and a new definition of cloud services has been added.
• A partial scope must be justified to your assessor.
• Passwordless methods and passkeys get more emphasis in user access control.
• Version timing. v3.3 applies to assessment accounts created after 27 April 2026. Older accounts keep the previous version, and you have six months to complete an assessment once its account is created.

As of October 2026, IASME lists Cyber Essentials prices by organisation size, from £320 plus VAT for micro organisations (0 to 9 employees) to £600 plus VAT for large ones (250 or more).

Scope: what Microsoft 365 brings in

The requirements document splits cloud responsibilities by service type. For software as a service such as Microsoft 365, the provider handles firewalls, security updates and malware protection for the service itself. You own user access control, and you share secure configuration. In practice, your Entra ID settings are yours to get right, and so is every device that signs in.

The device list is where scope surprises happen:

• Personal phones and laptops that access organisational data or services are in scope. Devices used only for native voice, native text or MFA apps are out.
• Home routers your organisation did not supply are out of scope, which is why each device needs its own software firewall.
• A scope that excludes end user devices is not acceptable.

Intune app protection policies help with personal phones, because conditional launch settings can block access below a minimum OS version. That supports the update control, but the phone still needs a supported operating system, a screen lock and timely updates to meet the requirements.

The settings admins miss, control by control

User access control

This is where Microsoft 365 tenants most often come unstuck, and the April 2026 change makes it stricter.

• MFA on every account that can sign in. Security defaults require all users to register for MFA and block legacy authentication, but Microsoft decides when to prompt. With Entra ID P1, a Conditional Access policy requiring MFA for all users, plus one blocking legacy authentication, gives you finer control and clearer evidence. Our Conditional Access basics guide walks through the baseline policies.
• Shared mailboxes. Every shared mailbox has a user account behind it that is not meant for direct sign-in, so block sign-in and keep it blocked. An unblocked shared mailbox account with no MFA is an easy finding.
• Emergency access accounts. Give break-glass accounts a passkey (FIDO2) or certificate-based authentication, so they use MFA without depending on Conditional Access.
• Separate admin accounts. The requirements say administrative accounts are for administrative activity only: no email, web browsing or other standard user tasks. Give each admin a second, unlicensed account for their roles, and use Privileged Identity Management if you have Entra ID P2.
• Passwords. Entra ID cloud passwords need at least 8 characters and are checked against a global banned password list, which lines up with the "8 characters plus a deny list" option. If you sync from on-premises Active Directory, your on-premises policy sets the length, so check it. The requirements also say not to enforce regular expiry, and Microsoft notes that tenants created before 2021 have a 90-day expiry by default.
• Brute force. Entra smart lockout locks an account after 10 failed attempts by default, which matches the limit of no more than 10 unsuccessful attempts.
• Leavers and dormant accounts. You need a process to remove accounts that are no longer needed, including after a defined period of inactivity. Sign-in activity reports show you which accounts have gone quiet.

Secure configuration

• AutoPlay and auto-run. The requirements say to disable any auto-run feature that allows file execution without user authorisation. Turn off AutoPlay through the Intune settings catalog.
• Unused and default accounts. Remove old test users in Entra ID and unused local accounts on devices. Windows LAPS, managed through Intune, gives each device a unique, rotated local administrator password instead of a shared default.
• Device unlock. Where a PIN only unlocks the device, it must be at least 6 characters, so set the Windows Hello PIN minimum to 6 or more. New Windows 11 devices lock the account after 10 failed sign-in attempts by default.

Security update management

The rule: install updates within 14 days of release when the vendor rates them critical or high risk, when they fix vulnerabilities with a CVSS v3 base score of 7 or above, or when the vendor gives no severity details. Turn on automatic updates wherever you can.

• Add up your update ring numbers. Quality update deferral, deadline and grace period together must fit inside 14 days. Windows Autopatch groups assign default deferral and deadline periods ranging from 1 to 20 days across rings, so check the last ring in particular.
• Windows 10. Support ended on 14 October 2025. Microsoft's Extended Security Updates lifecycle table shows Year 1 of ESU ended on 13 October 2026 and Year 2 runs to 12 October 2027. A Windows 10 device without a current ESU licence is unsupported software and must be upgraded, removed or moved out of scope.
• Everything else. Browsers, PDF readers, meeting clients and router firmware count too. Defender Vulnerability Management helps you spot missing updates across onboarded devices.

Firewalls

• All three Windows profiles on. In Intune endpoint security, set the Windows Firewall policy to enable the domain, private and public network profiles. Laptops on public Wi-Fi are exactly what the software firewall rule is for.
• macOS has its own Intune firewall profile. Turn it on.
• Boundary devices. Change default router passwords, block internet access to admin interfaces unless there is a documented business need (and then protect them with MFA or an IP allow list), and document each inbound rule with its business need and the person who approved it.

Malware protection

Anti-malware software must also block connections to malicious websites. Microsoft Defender SmartScreen covers Edge. For Chrome, Firefox and other browsers, network protection must be in block mode, a Defender for Endpoint and Defender for Business setting that is easy to leave in audit. For phones and tablets, the application allow listing route relies on signed apps from official stores, so block installation from unknown sources on Android.

Evidence to keep for the assessor

Collect this before you start the questionnaire. It also prepares you for Cyber Essentials Plus, where your systems are independently tested to check the controls work in practice.

• An export of Conditional Access policies, or a screenshot showing security defaults on
• The authentication methods registration report showing MFA coverage
• A list of admin role holders and their separate admin accounts
• The Intune device inventory with OS versions and compliance status
• Update ring and Autopatch settings, plus a recent update compliance report
• Firewall and antivirus policy settings, and Defender device health
• Your BYOD register and the policy staff sign
• Documented inbound firewall rules with business need and approver
• Your joiner, mover and leaver process, including the inactivity period you chose

Tie each item to the question it answers, so you are not hunting for screenshots on assessment day.

How CertTulen Academy can help

Endpoint Administrator Associate (MD-102) is the closest match to this work: Intune compliance, update rings, Autopatch, endpoint security and Defender for Endpoint, taught live by a Microsoft Certified Trainer with hands-on labs. Newer admins can start with Security, Compliance and Identity Fundamentals (SC-900). If you were planning MS-102, read what to do before it retires on 30 November 2026. Contact us for a batch that suits your time zone.