Does Microsoft 365 Certification require a penetration test?

Yes, for any app that connects to services not hosted or managed by Microsoft. It must be done every 12 months by an independent company.

What does the test need to cover?

Web application testing with and without a login, external infrastructure, internal infrastructure where it applies, and your full external footprint, all in the live production environment.

How quickly can I get the report?

You can buy online and start the same day. Most of the time goes to fixing what the test finds and retesting, all inside the 30-day window.

Penetration Testing for Microsoft 365 App Certification

Penetration testing for Microsoft 365 app certification

If you are taking an app for Teams, Outlook, or Microsoft 365 through Microsoft 365 Certification, a penetration test report is one of the pieces of evidence you will be asked for. This page explains what Microsoft's requirements say the test must cover and how to get the report without a long consulting engagement.

What Microsoft asks for

Microsoft's certification requirements say penetration testing is mandatory for any app that connects to services not hosted or managed by Microsoft. The test must:

Take place every 12 months
Be conducted by "a reputable independent company"
Cover web application testing, both authenticated and unauthenticated
Cover external infrastructure, and internal infrastructure where it applies
Run against the live production environment that supports the app
Include your full external footprint, such as IP addresses, URLs, and API endpoints, documented in the report

What a matching test looks like

Standard external penetration test, $3,495 for a 30-day window: 10 external IPs or domains, with authenticated web application testing included. This is the usual fit for an app that has a login.
Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts), if your environment has internal infrastructure in scope.

You set the scope yourself in the portal, so your full external footprint can be listed and appears in the report.

Fix, retest, then submit

The test runs inside a 30-day window. Fix what it finds, retest inside the same window, and submit the report that shows the issues closed.

If the reviewer wants an engineer-led test

Microsoft's certification analysts decide whether the evidence meets their requirements. If they ask for a test led by a named engineer, our managed penetration testing team does that.

Microsoft, Microsoft 365, Teams, and Outlook are trademarks of the Microsoft group of companies. Clone Systems is not affiliated with Microsoft.

See pen test pricing and buy online · Talk to a specialist