Microsoft 365 and Cyber Essentials — what you need to configure to pass

← All articles

Cyber Essentials is a UK government-backed cybersecurity certification scheme. It covers five technical controls that, if implemented correctly, protect against the most common cyber attacks. Many organisations pursuing Cyber Essentials are surprised to find that a significant number of the requirements relate directly to Microsoft 365 configuration.

The five Cyber Essentials controls

1. Firewalls

In a Microsoft 365 context, this applies primarily to access controls rather than traditional network firewalls. Relevant M365 settings:

• Conditional Access policies restricting access by location or device compliance
• Named Locations configured to define trusted networks
• Azure AD Identity Protection risk-based policies

2. Secure configuration

Systems should be configured securely — default passwords changed, unnecessary services disabled. In Microsoft 365:

• Security Defaults or Conditional Access must be enabled — the assessor will check this
• Admin accounts should have MFA enabled and not be used for day-to-day tasks
• Legacy authentication protocols should be blocked
• Unused licences and accounts should be removed
• Guest accounts should be reviewed and limited

3. User access control

User accounts should only have the access they need. In Microsoft 365:

• Global Admin role should be minimised — use least-privilege admin roles instead
• Admin accounts should be separate from standard user accounts
• Guest access should be controlled and reviewed
• Shared mailboxes should not have interactive sign-in enabled
• Stale accounts (leavers) should be disabled and eventually deleted

4. Malware protection

Malware protection must be active on all devices. In Microsoft 365:

• Microsoft Defender Antivirus or Defender for Business must be enabled on all Windows devices
• Safe Attachments and Safe Links (Defender for Office 365) protect against email-borne malware
• Attack Surface Reduction rules reduce the attack surface for malware
• For Cyber Essentials Plus: each device must demonstrate active, up-to-date malware protection

5. Patch management

Software must be kept up to date. In Microsoft 365:

• Microsoft 365 Apps (Office) should be on the Current Channel or Monthly Enterprise Channel — not perpetual Office versions
• Windows devices should have Windows Update for Business configured
• Intune can enforce update policies and compliance requirements
• Cyber Essentials requires patching within 14 days for high/critical vulnerabilities

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials is self-assessed. Cyber Essentials Plus involves an external assessor who will test your controls technically — including attempting to authenticate without MFA, scanning for unpatched software, and checking that malware protection is genuinely active.

How to check your Cyber Essentials readiness

M365Clarity maps every scan finding to the relevant Cyber Essentials controls in the Compliance tab. You'll see which controls you're passing, which are failing, and exactly what needs to be fixed — with direct links to the admin centres to resolve them. It won't replace your Cyber Essentials assessment, but it'll make sure you're not failing on the Microsoft 365 side.

Related articles