Free tool

Cyber Essentials checklist for Microsoft 365

Every Cyber Essentials requirement across the five controls. 8 of the 17 can be checked in Microsoft 365, and this shows you where. Tick them off as you go; your progress stays in this browser.

0 of 17 ready

Firewalls

Internet-connected devices sit behind a correctly configured firewall.

Every internet connection is protected by a firewall, with its default admin password changed and inbound rules limited to what is needed and documented.
Confirm outside Microsoft 365: Boundary firewalls and routers are in place, default passwords are changed, and every inbound rule is approved and documented.
Devices used on untrusted networks, such as home and public Wi-Fi, have their software firewall switched on.
Confirm outside Microsoft 365: The software firewall is on for every laptop and other device used outside the office.

Secure configuration

Devices and cloud services are configured to reduce what an attacker can use.

Devices meet a defined secure configuration, enforced and reported by device management.
Check in Microsoft 365
- Device compliance policy coverageIntune admin centre → Devices → Compliance policies
- Device compliance rateIntune admin centre → Reports → Device compliance
- Unmanaged devices in the directoryEntra admin centre → Identity → Devices → All devices
Company data is only reachable from devices that meet that configuration.
Check in Microsoft 365
- Device compliance requirement in Conditional AccessEntra admin centre → Protection → Conditional Access
Cloud services have insecure defaults turned off: legacy authentication, unmanaged app consent and app registration by any user.
Check in Microsoft 365
- Blocking of legacy authenticationEntra admin centre → Protection → Conditional Access
- User consent to third-party applicationsEntra admin centre → Identity → Applications → Enterprise applications → Consent and permissions
- Application registration by non-administratorsEntra admin centre → Identity → Users → User settings
Unnecessary software, services and accounts are removed or disabled, default passwords are changed, and auto-run is off.
Confirm outside Microsoft 365: Devices have unnecessary software and accounts removed, default passwords changed, and auto-run of downloaded content disabled.
Devices need a PIN, password or biometric to unlock, and lock after repeated failed attempts.
Confirm outside Microsoft 365: Every device requires a PIN, password or biometric to unlock, with lockout or throttling after failed attempts.

User access control

Only the right people have accounts, with only the access they need, protected by MFA.

Multi-factor authentication protects every account on cloud services.
Check in Microsoft 365
- Multi-factor authentication registration coverageEntra admin centre → Protection → Authentication methods
- Enforcement of multi-factor authentication for all usersEntra admin centre → Protection → Conditional Access
- Identity baseline: security defaults or Conditional AccessEntra admin centre → Identity → Overview → Properties
Every administrator uses multi-factor authentication, preferably phishing-resistant.
Check in Microsoft 365
- Administrators without registered multi-factor authenticationEntra admin centre → Identity → Roles and administrators
- Phishing-resistant authentication for administratorsEntra admin centre → Protection → Conditional Access → Authentication strengths
Administrative rights are held by as few people as possible, using separate cloud-only admin accounts.
Check in Microsoft 365
- Number of Global AdministratorsEntra admin centre → Identity → Roles and administrators → Global Administrator
- Privileged roles held by synchronised on-premises accountsEntra admin centre → Identity → Roles and administrators
- Just-in-time privileged access (PIM)Entra admin centre → Identity governance → Privileged Identity Management
Accounts no longer needed, including privileged ones, are removed or disabled promptly.
Check in Microsoft 365
- Disabled or dormant accounts holding privileged rolesEntra admin centre → Identity → Roles and administrators
- Dormant enabled accountsEntra admin centre → Identity → Users → All users
- Leavers not fully offboardedMicrosoft 365 admin centre → Users → Active users → the user → Licences and apps / Mail
There is a process to create, approve and remove user accounts, and admin accounts are not used for email or web browsing.
Confirm outside Microsoft 365: Joiners, movers and leavers follow an approval process, and admin accounts are used only for administration.

Malware protection

Malicious software is stopped from running on every device.

Anti-malware is installed, kept up to date and scanning on every device in scope, or applications are limited to an approved list.
Confirm outside Microsoft 365: Anti-malware (e.g. Microsoft Defender Antivirus) is active and up to date on every device, including BYOD in scope, or application allow-listing is enforced.
Access to known malicious websites is blocked.
Confirm outside Microsoft 365: Web protection blocks known malicious sites (e.g. Defender SmartScreen or network protection).

Security update management

Software is supported and security updates are applied promptly.

Every device runs an operating system that still receives security updates.
Check in Microsoft 365
- Unsupported operating systems in useIntune admin centre → Devices → Windows updates / Update policies
Critical and high-risk security updates are installed within 14 days of release, automatically where possible.
Confirm outside Microsoft 365: Automatic updates are on, and critical or high-risk security updates are applied within 14 days (e.g. Intune update rings with deadlines).
All software is licensed and supported, and unsupported software is removed.
Confirm outside Microsoft 365: All installed software is licensed and still supported by its vendor; unsupported software has been removed.

Mapping reviewed September 2026 against the NCSC's published requirements. Readiness is not certification: certification is assessed by an IASME certification body. Read the official Cyber Essentials requirements.