Cyber Essentials Microsoft 365 MFA Evidence: What Should You Check Before Assessment?
Published 6 November 2026
What to verify: user accounts
- Policy coverage: the MFA policy (Conditional Access or security defaults) applies to all users, not a pilot group.
- Exclusions: any users or groups excluded from the policy are known, few in number, and justified.
- Registration: every active user has registered an MFA method. A policy that requires MFA does not help if accounts have not been set up.
- Guests: external and guest accounts are covered or deliberately restricted.
- Shared mailboxes and resource accounts: sign-in is blocked where nobody needs to log in directly.
What to verify: privileged and admin accounts
- List everyone holding admin roles, especially Global Administrator.
- Confirm each admin uses a separate admin account, not their everyday mailbox account.
- Confirm MFA is enforced for admin portals as well as user sign-in.
- Check emergency "break-glass" accounts: know how they are protected and who holds the credentials.
- Include third-party IT providers who have delegated admin access to your tenant.
Check there is no route around MFA
Settings change and features are renamed often, so rather than follow a click-by-click list, ask a simple question: is there any way to sign in to this tenant with a password alone? Look for:
- Legacy or basic authentication protocols that do not support MFA.
- App passwords or older mail clients that bypass modern sign-in.
- Policy exclusions for locations, devices or groups that are broader than intended.
- Other cloud services holding organisational data that use their own logins rather than Microsoft 365 sign-in.
Microsoft's sign-in logs are the most reliable check: they show which sign-ins succeeded with single-factor authentication. If you find any, investigate before you submit.
Evidence to gather
| Evidence | What it shows |
|---|---|
| Export or screenshot of the MFA or Conditional Access policy | MFA is required, and who it applies to |
| Authentication methods registration report | Users have actually registered MFA |
| List of policy exclusions with reasons | Exceptions are known and controlled |
| Admin role holder list | Admin accounts are separate and limited |
| Sign-in log review for single-factor sign-ins | No bypass route is being used |
| Confirmation legacy authentication is blocked | No password-only route remains |
Date your evidence and keep it with your submission records. For Cyber Essentials Plus, the assessor may ask to see these settings live, so make sure an admin can show them.
Methods that count
Authenticator apps, hardware tokens and passkeys are all accepted MFA methods. NCSC v3.3 regards FIDO2 authenticators and passkeys as MFA. See passkeys and Cyber Essentials and our broader MFA requirements guide.
Common findings during pre-checks
- MFA enforced for users but an old admin account was missed.
- A former contractor's account still active without MFA registered.
- A shared mailbox with a password and direct sign-in still enabled.
- A finance system connected to the business but using its own password-only login.