Cyber Essentials Plus and Microsoft 365: the tests

What Cyber Essentials Plus is

The same requirements as Cyber Essentials, verified by an assessor through technical tests of patching, malware protection, MFA and account separation.

Who asks for it: UK organisations that need the independently tested level.

What Microsoft 365 can show

7 tests and controls evidenced by 37 checks. A check maps to a test or control only where its result is genuine evidence for it, so a test or control is listed only when a tenant setting can show it.

Outside Microsoft 365

The external vulnerability scan and the assessor’s sampling of devices happen outside Microsoft 365. These checks show whether the tenant would pass the parts the assessor tests in it.

Readiness is not certification. ConfigCheckup shows how ready a tenant is; certification is assessed by an IASME certification body.

Every test or control and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

The assessor’s tests

Cyber Essentials Plus: each test and the checks that show whether the tenant would pass it
Test	Checks that evidence it
Account separation test: admin accounts used only for administration	How to find administrators without MFA in Microsoft 365 How many Global Admins should a Microsoft 365 tenant have? Why admin accounts should be cloud-only in Microsoft 365 How to use PIM for just-in-time admin roles Disabled and dormant accounts that still hold admin roles 4 more checks for Account separation test: admin accounts used only for administration Why admin accounts should not have Microsoft 365 licences Stop Global Admins becoming local admins on joined devices How to stop users becoming local admin on devices they join Require approval to activate Global Administrator in PIM
Malware protection test	Defender for Office 365: check the protections are on How to require BitLocker, firewall and antivirus in Intune How to block dangerous attachment types in Exchange Online How to set up Safe Links for email, Teams and Office apps How to set up a Safe Attachments policy 4 more checks for Malware protection test Safe Attachments for SharePoint, OneDrive and Teams Comprehensive attachment filtering in Exchange Online How to turn on zero-hour auto purge for Microsoft Teams How to apply preset security policies to everyone
Multi-factor authentication test on cloud services	How to find users without MFA in Microsoft 365 How to require MFA for every user with Conditional Access How to block legacy authentication in Microsoft 365 Security defaults vs Conditional Access: which to use? How to require phishing-resistant MFA for administrators 5 more checks for Multi-factor authentication test on cloud services How to find administrators without MFA in Microsoft 365 Block legacy authentication to SharePoint and OneDrive How to require MFA for administrator roles in Entra ID How to turn on system-preferred MFA in Entra ID How to check modern authentication is on in Exchange Online
Patching test: supported software with security updates applied	Device end of life: find devices due for replacement How to find devices on unsupported operating systems

The Cyber Essentials controls beneath them

Cyber Essentials Plus: each Cyber Essentials control and the checks that evidence it
Control	Checks that evidence it
Secure configuration	How to block legacy authentication in Microsoft 365 How to stop users consenting to third-party apps in Entra ID How to stop users registering applications in Entra ID How to set up Intune compliance policies for every platform How to raise your Intune device compliance rate 2 more checks for Secure configuration How to require a compliant device with Conditional Access How to find unmanaged devices in Entra ID
Security update management	How to find devices on unsupported operating systems
User access control	How to find users without MFA in Microsoft 365 How to require MFA for every user with Conditional Access Security defaults vs Conditional Access: which to use? How to require phishing-resistant MFA for administrators How to find administrators without MFA in Microsoft 365 6 more checks for User access control How many Global Admins should a Microsoft 365 tenant have? Why admin accounts should be cloud-only in Microsoft 365 How to use PIM for just-in-time admin roles Disabled and dormant accounts that still hold admin roles How to find inactive users in Microsoft 365 Microsoft 365 offboarding checklist for leavers

Get ready for the assessment

Cyber Essentials checklist for Microsoft 365: Every Cyber Essentials requirement across the five controls, where to check it in Entra, Intune and Defender, and what to confirm outside the tenant.
Cyber Essentials evidence for MSPs: Evidence the Cyber Essentials requirements Microsoft 365 can show, tenant by tenant: MFA, admin accounts, devices, patching and more, with the gaps.
Microsoft 365 security for schools and trusts: Check, fix and prove Microsoft 365 security in every school: pupils never count towards the price, and trusts see every school in one view.

Cyber Essentials: The UK government-backed baseline: five technical controls for every organisation.
NCSC Cyber Assessment Framework: The NCSC’s outcome-based framework for essential services, the NHS and their suppliers.
Data Security and Protection Toolkit: The NHS self-assessment for organisations that handle patient data.
NCSC 10 Steps: The NCSC’s guidance for boards and organisations, in ten steps.

Run the Cyber Essentials Plus report on every tenant.

ConfigCheckup checks each tenant you connect against Cyber Essentials Plus: each test or control met, partly met or not met, and what Microsoft 365 cannot show.

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. See the price per tenant