Does Danzell ban SMS-based MFA?

No. SMS remains acceptable for user accounts. It is discouraged in favour of authenticator apps or hardware keys, especially for administrators.

What about service accounts that cannot do MFA?

Document the account, restrict it to specific IPs or conditional access rules, rotate the credential, and avoid using it interactively. Assessors accept this as a compensating control.

Is conditional access required for CE?

Not required, but it is the easiest way to evidence MFA enforcement at scale in Microsoft 365. Most firms on Business Premium use it.

Do I need MFA on the home Wi-Fi?

No. MFA applies to authentication into organisational accounts and services, not to local network access.

Does this affect CE Plus testing?

Yes. CE Plus auditors will check admin sign-in flows and may simulate sign-in attempts to verify MFA prompts trigger correctly.

Danzell MFA Changes: What Trips UK Firms Up

What Danzell changed

The five controls list is unchanged but the wording around MFA is firmer:

MFA on every cloud service – not just email.
MFA on every administrative account, every time.
Break-glass accounts must use a strong MFA method, not a stored password alone.
SMS is still accepted but discouraged. Authenticator apps or hardware keys are preferred.

The accounts assessors check

Microsoft 365 / Google Workspace user and admin accounts.
Identity provider admin consoles (Entra ID, Okta, Google Cloud Identity).
IaaS consoles (AWS root + IAM users, Azure subscriptions, GCP projects).
SaaS admin portals for any in-scope cloud app.
Remote access (VPN, SSH bastions, RDP gateways).

Common Danzell-era trip-ups

Service accounts with stored credentials that bypass MFA – Danzell expects compensating controls (conditional access, IP allowlisting, secrets manager rotation).
Legacy authentication still enabled on Exchange Online or POP/IMAP – disable it.
One MFA method per user – have a backup method so a lost phone does not lock you out.
Trusted device exemptions – under Danzell, "remember this device for 90 days" is not a substitute for MFA on each sign-in for admin accounts.

What to evidence

Conditional Access policy exports (M365), IAM MFA reports (AWS / GCP), or an exported user list with MFA status from your identity provider. See our Microsoft 365 checklist for the exact settings.