Cyber Essentials on Microsoft 365: 4 of 5 controls checked automatically.

What Cyber Essentials asks

• Every device in scope is protected by a correctly configured firewall: a boundary firewall, or a host firewall on devices used on untrusted networks such as home or public Wi-Fi.
• Default firewall administrator passwords are changed, and the admin interface is not reachable from the internet unless it is protected by MFA or an allow-list.
• Inbound connections are blocked by default, and every rule that opens one is approved, documented and removed when no longer needed.

Where it lives in Microsoft 365

Host firewalls on Windows, macOS and mobile devices are deployed as Intune endpoint security policies. The boundary firewall or router at each office is outside Microsoft 365, so it is checked and attested by hand.

What Cyber Essentials asks

• Unnecessary user accounts and software are removed or disabled, default and guessable passwords are changed, and auto-run is turned off.
• Devices lock and need a biometric, or a password or PIN of at least six characters, to unlock.
• Password sign-in is protected against guessing, for example by locking or throttling after no more than ten failed attempts, with stronger length rules where MFA is not used.

Where it lives in Microsoft 365

Intune compliance policies and configuration profiles (or security baselines) set the device rules. Windows Hello covers device unlock. Entra ID smart lockout limits password guessing, and Entra Password Protection blocks common passwords.

Checkpoint checks: 4 posture checks read this control from your tenant and flag it when it drifts.

What Cyber Essentials asks

• All software in scope is licensed and supported by its vendor. Unsupported software is removed or kept out of scope.
• Updates install automatically where possible, and critical or high-risk security updates are applied within 14 days of release.

Where it lives in Microsoft 365

Windows Update for Business rings (or Windows Autopatch) in Intune install updates with a deadline. Microsoft Defender Vulnerability Management shows missing updates and software the vendor no longer supports.

Checkpoint checks: 3 posture checks read this control from your tenant and flag it when it drifts.

What Cyber Essentials asks

• Accounts are created only when approved, given only the access the job needs, and removed or disabled when no longer needed.
• Administrator accounts are separate from day-to-day accounts and used only for admin tasks, not for email or web browsing.
• Multi-factor authentication is turned on for every user of cloud services such as Microsoft 365.

Where it lives in Microsoft 365

Conditional Access in Entra ID requires MFA for all users and blocks legacy authentication, which would otherwise bypass it. Privileged Identity Management makes admin roles time-limited, and access reviews and Lifecycle Workflows remove leavers.

Checkpoint checks: 7 posture checks read this control from your tenant and flag it when it drifts.

What Cyber Essentials asks

• Every device in scope uses anti-malware software, kept up to date and set to scan files and block malicious websites, or runs only approved applications through application allow-listing.

Where it lives in Microsoft 365

Microsoft Defender Antivirus with real-time and cloud protection, plus SmartScreen and network protection for websites. For allow-listing, App Control for Business (WDAC) deployed through Intune.

Checkpoint checks: 3 posture checks read this control from your tenant and flag it when it drifts.