Cyber Essentials with Microsoft 365: what to switch on, click by click

Where Microsoft 365 sits in the assessment

Microsoft 365 is a cloud service: in scope, not excludable, and holding most of your business data. The questionnaire will ask whether it offers MFA (it does), whether MFA is on for every administrator (A7.16) and every user (A7.17), and about the accounts themselves — individual logins, admin separation, leavers removed promptly. Because Outlook, Teams, OneDrive and SharePoint share the Microsoft 365 login, getting this one service right answers those questions for all of them at once. It does not cover your laptops’ operating systems, your phones or your router — those have their own questions.

1. Turn on two-factor login for each person

1. On a computer, go to microsoft365.com and sign in with the work account.
2. Click your initials or photo (top right), then “View account” — this opens the My Account page.
3. Choose “Security info”.
4. Click “Add sign-in method”, then pick “Authenticator app” and follow the prompts.
5. On your phone, install Microsoft Authenticator from the app store if you don’t have it, then scan the on-screen code with it.
6. Approve the test notification in the app (type in the number shown on screen if asked).

Done when: Microsoft 365 asks for a code (or an Authenticator prompt) next time that person signs in. Passkeys and security keys also count as MFA; text-message codes are allowed but discouraged.

2. Make it required for everyone (admins)

Individual enrolment is a start; the questionnaire asks whether MFA is on for every user and admin, so it needs to be required, not optional. In Microsoft’s world that is done by an admin turning on “Security defaults” — or, on plans that have it, a Conditional Access policy — in the Microsoft Entra admin centre. Security defaults is the simple switch built for small businesses: it makes every account register for MFA, prompts admins for MFA at every sign-in, prompts other users when Microsoft judges it necessary, and blocks the old sign-in methods that bypass it. A Conditional Access policy requiring MFA for all users prompts every time instead; it needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Whichever you use, turn it on, give people a few days to enrol, then check everyone has — and only then answer yes to A7.16 and A7.17.

3. Separate admin from everyday accounts

The account that administers Microsoft 365 should not be the one someone reads email in all day (A7.6, A7.7). Keep a separate admin account — with MFA — used only for admin tasks, keep the list of who holds admin roles short and written down (A7.8), and look at it every few months (A7.9). If an IT provider manages your tenant, their login is one of your in-scope admin accounts: same rules.

4. Joiners, leavers and shared mailboxes

Decide who creates accounts and who approves it (A7.1). When someone leaves, an admin blocks sign-in and removes their licence promptly (A7.3) — same day is the habit worth having. For info@ and accounts@, use a shared mailbox that named people access from their own logins, rather than one password several people know (A7.2) — shared mailboxes in Microsoft 365 are designed for exactly this and remove a whole category of MFA and leaver problems.

5. What Microsoft 365 does not cover

The other cloud services — accounting, CRM, the business social accounts — each need MFA separately; the MFA gap checker turns your tool list into that to-do list. And the devices are their own section: supported Windows and macOS versions, automatic updates within 14 days, screen locks, the router’s admin password. Microsoft 365 settings answer the user-access questions for Microsoft services — a big piece, not the whole assessment.