If your organisation uses Microsoft 365, multi-factor authentication is no longer optional. From April 2026, CCEC v3.3 — the latest version of the UK government's Cyber Essentials scheme — makes MFA a mandatory control, and non-compliance means failing the scheme outright.

This is not a soft target. The Cyber Essentials scheme is a hard pass/fail. If MFA is not deployed across your Microsoft 365 environment by the April deadline, your certification will lapse. That has immediate commercial consequences, particularly if you bid on public sector contracts or work with enterprise clients who require verified Cyber Essentials certification as a baseline procurement requirement.

Microsoft 365 already ships with all the MFA capabilities you need. What most UK SMEs lack is a clear deployment plan that balances security, user experience, and audit readiness. This article walks through exactly what to do, in what order, and where the common pitfalls sit.

Why April 2026? Understanding the Cyber Essentials v3.3 deadline

The Cyber Essentials scheme, run by the UK National Cyber Security Centre (NCSC) and delivered through approved assessors such as Danzell, sets out twelve minimum technical controls that organisations must meet to hold valid certification. The current version — CCEC v3.3 — explicitly requires MFA on all remote access and cloud services, including Microsoft 365.

Key points to understand:

• MFA is not optional under CCEC v3.3. The scheme treats it as a mandatory control. No exceptions for SMEs with fewer than fifty employees.

• The deadline is structural, not advisory. Assessed organisations will be checked against the updated control set. There is no grace period built into the standard.

• Microsoft 365 is the most common cloud environment. Most UK SMEs use it for email, collaboration, and file storage. That makes it the single most important platform to secure.

• Certification lapses matter commercially. Many public sector and enterprise procurement processes now require valid Cyber Essentials as a pre-qualification gate.

March 2026 is the last planning window. If you begin deployment in April, you will already be non-compliant.

Does your Microsoft 365 tenant already have MFA?

Most organisations do not actually know what state their tenant is in. That is the first thing to establish.

Check 1: Conditional Access policies

Sign in to the Microsoft Purview compliance portal (compliance.microsoft.com) or the Microsoft Entra admin centre and navigate to Protection > Conditional Access. Look for policies that require multi-factor authentication.

A well-structured tenant will have at least one policy that covers all users and requires MFA for sign-in. If you see an empty list, or policies that apply only to specific admin roles, your organisation is likely running without organisation-wide MFA enforcement.

Check 2: Microsoft 365 security defaults

Microsoft provides a built-in feature called Security Defaults that enforces MFA for all users. To check whether this is active:

1. Go to Microsoft Entra admin centre (entra.microsoft.com)

2. Navigate to Properties > Manage security defaults

3. Confirm whether "Enable security defaults" is set to Yes

Security Defaults are a reasonable baseline for most SMEs. They are simpler to manage than custom Conditional Access policies and cover the same mandatory controls.

Check 3: licence users and authentication methods

Navigate to Microsoft Entra admin centre > Protection > Authentication methods. Here you can see which methods are enabled (phone call, SMS, Microsoft Authenticator, FIDO2 security keys) and whether any users are excluded from MFA policies.

Exemptions are the most common gap. If you have legacy accounts, service accounts, or contractor arrangements that bypass MFA, those represent both a compliance risk and a commercial vulnerability.

What authentication method should your SME use?

CCEC v3.3 does not prescribe a specific MFA technology. It requires that authentication on cloud services use something beyond a password. But the method you choose has real consequences for user adoption, helpdesk load, and audit readiness.

Microsoft Authenticator app (recommended for most SMEs)

The Authenticator app is the lowest-friction option for the vast majority of UK SMEs. It pushes a notification to a user's phone when they sign in. The user approves or denies with a single tap.

Pros:

• Near-zero training required

• Works offline

• Supports number matching, which defeats phishing

• Free with existing Microsoft 365 licenses

Cons:

• Requires a smartphone (not a concern for most staff)

• Users must install and register the app once

For most organisations, this should be the default registration method.

FIDO2 security keys (for high-privilege accounts)

FIDO2 keys (such as YubiKeys) provide the strongest form of authentication. They are phish-resistant by design because the authentication is bound to the specific domain.

These are overkill for general staff but sensible for privileged accounts — directors, finance users, and anyone with access to sensitive data or admin roles. They also look excellent on a Cyber Essentials assessment.

SMS and voice calls (legacy, not recommended)

SMS-based MFA is still available in Microsoft 365. However, it is the weakest method. SIM swapping and SMS interception are real threats. The NCSC itself has published guidance discouraging SMS as a primary second factor.

If you have SMS enabled as a fallback method, that is acceptable. If it is your primary or only second factor, migrate to Authenticator or FIDO2.

How to deploy MFA across your Microsoft 365 tenant

There are two supported approaches. Pick the one that matches your organisation's size and complexity.

Option A: Enable Microsoft Security Defaults (simplest path)

This is the fastest route to compliance and suits organisations without a dedicated IT team.

1. Sign in to the Microsoft Entra admin centre (entra.microsoft.com)

2. Go to Properties > Manage security defaults

3. Set "Enable security defaults" to Yes

4. Confirm the change

That is it. Every user will be prompted to register MFA on their next sign-in. Microsoft Authenticator will be the default method. SMS and voice calls are available as fallbacks.

No policy authoring. No exclusions. No ongoing tuning. It simply works.

Option B: Configure Conditional Access policies (for larger or more complex tenants)

If your organisation already uses Conditional Access or needs granular control (for example, allowing guest users different MFA requirements, or exempting specific legacy applications), you can build targeted policies.

Core policy structure:

1. Create a policy targeting all users. Require MFA for sign-in.

2. Add an exclusion for break-glass accounts. These are emergency administrator accounts that you can still access if MFA or tenant settings are misconfigured. Keep two break-glass accounts per organisation. Store their credentials securely offline.

3. Add a grant condition for Microsoft Authenticator. Prefer Authenticator over SMS/voice.

4. Enable session controls. Optionally enforce continuous access evaluation and sign-in frequency limits.

This approach requires more initial effort but gives you audit-ready documentation of exactly who is covered, what methods are required, and where exemptions exist.

The registration process: getting users onboarded

Your users need to register their chosen MFA method. Microsoft provides a registration portal (aka.ms/mfasetup) that guides them through the process in plain English.

Best practice steps:

1. Communicate before you enforce. Send a short, clear email explaining what is changing, why it is changing (Cyber Essentials compliance), and what users need to do. Include the registration link.

2. Run a pilot with IT or admin users first. This catches edge cases before you roll out to the wider organisation.

3. Prepare your helpdesk for registration queries. The most common question is "What is the Authenticator app?" Have a one-page guide ready.

4. Set a registration deadline. Give users two weeks to complete registration. After that, block sign-in for non-compliant accounts.

You can check registration status in the Microsoft Entra admin centre under Users > All users, then filter by the "MFA status" column.

Service accounts and shared mailboxes: the blind spot

MFA compliance fails at the edges, not the centre. The most common gaps SMEs encounter are:

• Service accounts used for third-party applications (backups, monitoring, email send connectors). These accounts often lack passwords altogether, or they store credentials in unencrypted config files. Rotate any passwords you can, and move these accounts to individual owners with MFA registered.

• Shared mailboxes that are accessed via direct Outlook login rather than delegation. Each access should go through a named individual account with MFA, not a shared password.

• API integrations using application passwords. Replace these with certificate-based authentication or Microsoft Entra app registrations with proper permissions.

Every non-person account should have an owner. That owner is responsible for ensuring MFA is registered. Keep a live register of all service accounts and their owners.

What happens if you miss the April deadline?

There are two practical scenarios:

You still hold Cyber Essentials certification

Your current certification will remain valid until its expiry date. However, at the next re-assessment (usually annual), you will be evaluated against CCEC v3.3. Without MFA on Microsoft 365, you will fail.

Plan your deployment now so that, if your reassessment date falls after April, you are already compliant and can demonstrate the control to your assessor with evidence from your Microsoft 365 admin centre.

You do not currently hold Cyber Essentials certification

You can apply for Cyber Essentials at any time. From the April reassessment date, MFA on Microsoft 365 will be checked as part of the self-assessment questionnaire (for self-assessed Cyber Essentials) or the technical verification (for Cyber Essentials Plus). Without it, you will not be awarded certification.

Cost implications for UK SMEs

The good news: there is no additional software cost.

• Microsoft Security Defaults are free and included with every Microsoft 365 licence.

• Microsoft Authenticator is a free mobile app available on iOS and Android.

• FIDO2 keys cost approximately £30–£60 each. For a fifty-person SME with ten privileged accounts, that is £300–£600 — a trivial sum against the commercial cost of losing certification.

• Third-party MFA solutions (Duo, Okta, etc.) are unnecessary for most SMEs if you are already on Microsoft 365. They add cost without adding meaningful security for the typical small business use case.

The only real cost is time: planning the deployment, communicating with users, and registering accounts. Most SMEs can complete this within one working week with a focused effort.

A practical six-week deployment plan

This timeline assumes you begin in early March and enforce by the end of the month. That gives you a comfortable buffer before April.

How Infinite Cloud IT can help

If you are not confident auditing your Microsoft 365 tenant or deploying MFA at scale, that is exactly what a Security Triage Call covers. We review your current authentication posture, map it against CCEC v3.3 requirements, and deliver a concrete action plan — no alarmism, no free audits, just a clear path to compliance.

Book a Security Triage Call

FAQ: MFA for Microsoft 365 and Cyber Essentials

Does Microsoft 365 include MFA at no extra cost?

Yes. Security Defaults and the Microsoft Authenticator app are included with every Microsoft 365 licence. No additional licence is required to meet Cyber Essentials requirements.

Can we exempt individual staff members from MFA?

No. CCEC v3.3 does not allow personnel-based exemptions. Every user with access to cloud services must authenticate with MFA. Break-glass accounts are the only permitted exception, and these are emergency accounts, not operational bypasses.

What if some of our staff work offline or without mobile phones?

Microsoft Authenticator requires a smartphone with an internet connection. If a user genuinely cannot use a smartphone, FIDO2 security keys or a registered hardware token are acceptable alternatives under the standard.

Does MFA need to be enabled on on-premises systems too?

Cyber Essentials covers all remote access and cloud services. If your organisation has on-premises systems accessible remotely (Remote Desktop, VPN, web portals), those also require MFA. Most SMEs on Microsoft 365 will find that securing the cloud tenant covers the majority of their exposure.