Cyber Essentials for Microsoft 365 (Office 365): Entra ID and Intune Settings by Control

Office 365 Cyber Essentials compliance comes down to five groups of settings: multi-factor authentication on every account, separate and limited admin accounts, devices patched within 14 days, firewalls switched on, and malware protection running. Microsoft 365 is a cloud service, so it is always in scope and cannot be excluded. Every Microsoft 365 tenant can enforce MFA at no extra cost, so leaving any account without it now fails the assessment automatically. This guide maps the Entra ID, Intune and Defender settings to each control, then lists the evidence to keep ready for your assessor.

It is written for IT teams and managed service providers who run Microsoft 365 tenants. It explains the Microsoft side only; the full rule set for every device and service is in our Cyber Essentials checklist. If you run IT for a legal practice, our guide to Cyber Essentials for law firms covers the Legal Aid Agency rule and how to scope fee earners who work from home.

Is Microsoft 365 (Office 365) in scope for Cyber Essentials?

Yes, always. Cloud services that hold or process your data have had to be in scope since version 3.0 of the requirements, and version 3.3 of the NCSC’s Requirements for IT Infrastructure, in force since April 2026, adds a formal definition of a cloud service and says authentication to cloud services must always use MFA. IASME has confirmed that missing MFA on a cloud service that offers it is an automatic fail.

Microsoft runs and patches the Microsoft 365 platform. You are responsible for how your tenant is configured and who can sign in to it, and for the devices your staff use to reach it. That split is why most of this guide is about Entra ID accounts and Intune-managed devices rather than Exchange or SharePoint themselves. Every device that reaches Microsoft 365 data, including staff-owned phones that get work email, is in scope with it.

Which Microsoft 365 settings map to each Cyber Essentials control?

The sections below explain the settings that most often decide a pass or a fail.

How should MFA be set up in Microsoft 365 for Cyber Essentials?

Enforce MFA for every account that can sign in, with no exceptions for senior staff, shared mailboxes that people log in to directly, or service accounts used interactively. There are two ways to do it:

Whichever you choose, block legacy authentication. Older protocols cannot do MFA, so leaving them on gives attackers a way round it. Keep two emergency access accounts as Microsoft recommends, but protect them with strong MFA such as a FIDO2 security key rather than excluding them from it.

Which MFA methods count, including whether text-message codes are accepted, is covered in our guide to Cyber Essentials MFA requirements.

How should Microsoft 365 admin accounts be handled?

Cyber Essentials requires separate administrator accounts that are used only for admin tasks, never for email or web browsing. In Microsoft 365 the cleanest way to meet that is:

• Separate, cloud-only admin accounts with no Exchange licence, so they have no mailbox to read email with.
• The least privileged role that does the job, such as User Administrator or Exchange Administrator, instead of Global Administrator. Microsoft recommends fewer than five Global Administrators.
• Just-in-time elevation through Privileged Identity Management, if you have Entra ID P2, so admin rights are activated only when needed.
• Partner access through GDAP, so an MSP holds only the roles it needs for the time it needs them.
• A leaver process that disables accounts the day someone leaves and removes admin roles when someone changes job.

Password rules sit alongside these. Entra ID requires passwords of at least eight characters for cloud-only accounts, blocks common passwords through its global banned password list, and by default smart lockout locks an account after 10 failed sign-ins in commercial tenants, which is within the scheme’s limit of 10 attempts. Our Cyber Essentials password policy guide explains how MFA and these defaults meet the password rules, and what still needs setting on Windows devices.

Do Intune compliance policies help with Cyber Essentials?

Yes. A compliance policy states what a healthy device looks like, and Conditional Access can then block devices that fall short from reaching Microsoft 365. Useful settings by platform:

Set devices with no compliance policy to be marked as not compliant, so a new device cannot slip through unmanaged. Phones and tablets have their own rules on supported versions and locking, set out in our guide to Cyber Essentials mobile device requirements.

How do you meet the 14-day patching rule with Intune?

High-risk and critical updates must be installed within 14 days of release, and missing that deadline is an automatic fail. In Intune:

• Windows Update rings. Keep the quality update deferral short and set a deadline and grace period that force installation well inside 14 days. Use expedited quality updates when an urgent fix lands mid-cycle.
• Microsoft 365 Apps. Leave automatic updates on and set an update deadline so apps restart onto the patched version.
• Third-party apps. Windows Update does not patch browsers from other vendors, PDF readers or other third-party software, so they need their own route, such as the app’s automatic updates or your patching tool.
• Unsupported software. Use the minimum OS version in compliance policies to find devices that no longer receive security updates, then replace or remove them.

Firmware on firewalls and routers falls under the same rule but is outside Microsoft 365, so track it separately.

Which Microsoft Defender settings count as malware protection?

On Windows, Microsoft Defender Antivirus can meet the anti-malware option: keep real-time protection on and security intelligence updating automatically, and turn on tamper protection so local admins cannot switch it off. The requirement also asks for connections to malicious websites to be blocked. Microsoft Defender SmartScreen covers this in Edge, and network protection extends blocking to other browsers and apps.

Exchange Online Protection scans mail for malware in every Exchange Online tenant, and Defender for Office 365, included in Business Premium, adds Safe Attachments and Safe Links. Macs are in scope too and need malware protection that meets the same rules; Microsoft Defender for Endpoint on Mac is one option that Intune can deploy and report on.

Does Intune help with Cyber Essentials Plus?

Yes, mostly in preparation. Cyber Essentials Plus samples devices by operating system version, so Intune’s device inventory gives you the counts for the asset declaration, and bringing devices onto the same build reduces how many are tested. Compliance reports show you which devices would fail before the assessor does. On the day, the assessor checks MFA on your cloud services and that admin accounts are separate, so the settings above need to apply to every account, not only the sample. The test steps and sample sizes are on our Cyber Essentials Plus requirements page.

What evidence should you keep ready for the assessor?

Basic Cyber Essentials is marked from your answers, but assessors may ask you to clarify them, and Cyber Essentials Plus tests them. Keep these to hand:

Why Sovereign Secure

• We are the certification body. Sovereign Secure is IASME-licensed to issue Cyber Essentials and Cyber Essentials Plus certificates, so your questions go straight to the people who assess you.
• Support in every package. Each Cyber Essentials package includes a pre-assessment check and a support call of up to an hour, from £320 + VAT.
• Beyond the baseline. We are a PCI SSC Qualified Security Assessor company and ISO 27001 certified, and our Microsoft 365 security assessment reviews a tenant in more depth than Cyber Essentials requires.

Next step

Run through the table above against your tenant, then try our free Cyber Essentials readiness check, which takes about five minutes and flags the April 2026 automatic fails, such as a cloud account without MFA. When you are ready, send us your scope through the Cyber Essentials scoping questionnaire or the form on this page, or call +44 161 523 5276. MSPs certifying several Microsoft 365 clients can talk to us about our Cyber Essentials partner programme.