For UK managed service providers
Get your clients ready for Cyber Essentials v3.3
Connect a client's Microsoft 365 tenant with one-click, read-only consent. Halberd checks MFA, user access, cloud services in scope and device patching, then gives you a clear readiness report you can brand as your own.
Read-only · No agents to install · No changes ever made to client tenants
Cyber Essentials v3.3
Readiness summary
- User access control6 pass · 2 fail
- Secure configuration2 pass · 1 needs evidence
- Security update management2 pass
- Firewalls2 manual checks
- Malware protection2 manual checks
17
checks across all five CE control areas
8
read-only Microsoft Graph permissions
0
changes ever made to client tenants
14 days
free trial on every plan, no card needed
Why now
What changed in Cyber Essentials v3.3
Cloud services are in scope
They can no longer be excluded from the assessment.
MFA for every cloud service
Missing MFA where a service offers it is an automatic fail.
14-day patching
High and critical security updates must be applied within 14 days.
No unsupported software
Unsupported operating systems or software are an automatic fail.
30-day lapse rule
A certificate lapsed for more than 30 days needs full re-assessment.
MFA coverage
Know who is really protected by MFA
- Registered vs enforced, per user
- Every admin role holder covered
- Report-only policies don't count
| User | Registered | Enforced by |
|---|---|---|
| Adele Vance | Conditional Access | |
| Megan BowenADMIN | Conditional Access | |
| Lee Gu | Conditional Access | |
| Break-glass accountADMIN | Documented exclusion |
Cloud services in scope
Find every third-party app clients forgot about
- Ready-to-copy list for the assessment
- Unverified high-privilege apps flagged
- User-consent settings checked
CaseTrack Pro
DeclaredVerified publisher · CaseTrack Ltd
User.ReadCalendars.ReadQuickSign Docs
DeclaredUnverified publisher
Mail.SendFiles.ReadWrite.AllTeamBoard
DeclaredVerified publisher · TeamBoard Software Ltd
User.Read
White-label reports
Hand over a report your client understands
- Your branding on every page
- Prioritised fix steps
- CSV for your own tooling
Monitoring and renewals
Hear about drift before the assessor does
- Immediate email for critical drift
- Weekly digest for the rest
- Renewal reminders per client
- critical
MFA enforcement policy disabled
Contoso Bakery Ltd · today 06:15
- high
New Global Administrator: j.smith
Tailspin Engineering · yesterday
- medium
New third-party app: QuickSign Docs
Fabrikam Legal LLP · 2 days ago
Critical drift is emailed immediately. Everything else arrives in the Monday digest.
Coverage
All five control areas, with nothing hidden
| Control area | Checked automatically | Guided manual checklist |
|---|---|---|
| User access control |
| — |
| Secure configuration |
| — |
| Security update management |
|
|
| Firewalls | Not checkable through Microsoft 365 |
|
| Malware protection | Not checkable through Microsoft 365 |
|
When a licence or permission is missing, the check shows Needs evidence with the reason — Halberd never fails silently.
How it works
Connect, scan, report, monitor
- 1
Connect
Add the client's domain. Halberd finds the tenant and creates a one-click, read-only consent link for their Global Administrator.
- 2
Scan
Halberd detects licences, collects only what each check needs and evaluates every rule. Missing data becomes “Needs evidence”, never a silent pass.
- 3
Report
Review findings with your team, complete the manual checklist with evidence, and share a branded report.
- 4
Monitor
Weekly or monthly re-scans, drift alerts and certificate renewal reminders keep each client ready all year.
Built for MSPs
One dashboard for every client
- Roles for your team
- White-label PDF and CSV
- Certificate dates and body per client
- In-app and email alerts
Security
Read-only. Every permission explained.
- Read-only by design — nothing is ever changed in a client tenant
- No stored client tokens — certificate credentials, tokens kept in memory
- Strict tenant isolation, private evidence storage and an audit trail
Pricing
Simple plans per MSP, not per user
Starter
£49/month
Up to 10 client tenants · monthly scans
Growth
£99/month
Up to 30 client tenants · weekly scans
Pro
£199/month
Up to 100 client tenants · weekly scans
FAQ
Questions MSPs ask us
Does Halberd certify my clients?
No. Halberd is a readiness aid and does not issue or guarantee Cyber Essentials certification. Certification is awarded by an IASME-licensed certification body after assessment. Halberd helps you find and fix gaps before you apply.
Can Halberd change anything in a client's tenant?
No. It requests read-only Microsoft Graph permissions only, and its code blocks any request that is not a read.
Who needs to approve access?
A Global Administrator (or Privileged Role Administrator) of the client's Microsoft 365 tenant, using a one-click consent link. You can open it yourself if you administer their tenant.
What licences does the client need?
Halberd works with any Microsoft 365 business plan. Some checks need Entra ID P1 (for example sign-in logs and inactive accounts) or Intune (device patching). When data is unavailable, Halberd marks the check "Needs evidence" and explains why — it never fails silently.
Does Halberd cover everything in Cyber Essentials?
No tool can check everything through Microsoft 365. Firewalls, routers, on-premises servers, non-Microsoft apps and malware protection appear as manual checklist items with guidance and evidence upload.
See where a client stands in minutes
Free Cloud scope & MFA check for one client tenant. Read-only, no card needed.
Already a customer? Sign in
Important: Halberd is a readiness aid and does not issue or guarantee Cyber Essentials certification. Certification is awarded only by an IASME-licensed certification body after assessment. Halberd is not affiliated with or endorsed by the NCSC or IASME.