By EJN Labs · 10 Nov 2026 · 7 min read
Microsoft 365 App Certification requires an annual, independent penetration test for any app that connects to external services Microsoft doesn’t host or manage, or that runs on Azure: authenticated and unauthenticated web application testing, plus internal and external infrastructure testing where applicable. Apps built purely on Microsoft-managed services such as Graph API may fall outside the requirement. Microsoft reviews the report; it does not run the test itself.
Why does Microsoft 365 App Certification require penetration testing?
Microsoft requires independent testing because Publisher Attestation, the self-service questionnaire every app completes first, is self-reported and not independently verified. An annual penetration test is the evidence certification analysts use to confirm those answers hold up once your app is live.
For a SaaS vendor building Teams apps, Outlook add-ins or Graph API integrations, the commercial driver sits in procurement. Enterprise and public sector buyers increasingly filter for the Microsoft 365 Certified badge in AppSource and the Teams Store, and a questionnaire that once stopped at attestation now often asks whether you hold full Certification. It sits alongside the wider pattern we cover in our guide to penetration testing for SaaS platforms: buyers want a named, recent, independent test on file before they sign.
What does Microsoft’s certification framework actually require?
Microsoft’s certification framework requires annual, full web application testing, both authenticated and unauthenticated, plus internal (where applicable) and external infrastructure testing, carried out by a reputable independent company. That is Microsoft’s own requirement, not a separate law or regulator’s rule.
The same clause sets a one-month remediation clock: any critical or high-risk finding must be fixed and retested within a month of the test’s conclusion, or sooner if your own patching policy is stricter, with the fix clearly evidenced in the report. Web application testing has to cover every current vulnerability class, for example the OWASP Top 10 or the CWE Top 25, and the report must document your full external footprint: IP addresses, URLs and API endpoints included.
Which apps and hosting environments fall inside the testing scope?
Scope follows hosting and connectivity, not app category. Testing becomes mandatory once your app connects to external services Microsoft doesn’t host or manage, or runs in Azure. A standalone app using only Microsoft-managed services, Graph API alone, can fall outside the requirement.
Publisher Attestation still applies to every app regardless of hosting. Where testing does apply, the hosting model sets exactly what’s in scope:
| Hosting model | What must be tested |
|---|---|
| PaaS or serverless | Web application (authenticated and unauthenticated) plus its supporting infrastructure |
| IaaS or ISV-hosted | Web application (authenticated and unauthenticated), internal infrastructure where applicable, and external infrastructure |
| Standalone app, Microsoft-managed services only | May fall outside the mandatory testing requirement; Publisher Attestation still applies |
Most SaaS ISVs we speak to sit in the first two rows: a web application hosted on Azure or their own cloud, calling out to a database or third-party API Microsoft doesn’t manage. Our web application penetration testing and external infrastructure penetration testing services map directly onto that scope.
How does the certification timeline fit around your test?
The cycle starts with Publisher Attestation, a self-assessment questionnaire valid for a year with no independent verification. Full Certification then reviews a penetration test report completed within the last 12 months, plus architecture diagrams and your public footprint, across a 60-day evidence window.
Microsoft can extend that window by another 60 days for genuine delays, testing among them, but there is a tidier route. Where an ISV doesn’t already hold a current annual test, Microsoft’s own audit team can commission one, at an additional cost and on Microsoft’s schedule. Sourcing your own test ahead of submission keeps cost, scope and timing in your hands, and if a finding needs a retest, the same testing company handles it before you submit rather than after a delay is flagged.
What does a Microsoft 365 Certification penetration test cost in the UK?
UK day rates for CREST-accredited testing of this kind typically run £1,100 to £1,400. A PaaS-hosted app needing web application testing alone typically takes 5 to 8 days, or £5,500 to £11,200; adding infrastructure testing for an IaaS or ISV-hosted app moves that to 7 to 10 days, or £7,700 to £14,000.
| Scope | Typical days | Typical UK cost |
|---|---|---|
| Web application only (authenticated and unauthenticated), PaaS-hosted | 5 to 8 days | £5,500 to £11,200 |
| Web application plus external infrastructure, IaaS or ISV-hosted | 7 to 10 days | £7,700 to £14,000 |
| Web application plus internal and external infrastructure | 9 to 13 days | £9,900 to £18,200 |
| Annual retest, later years with no major changes | 1 to 2 days | £1,100 to £2,800 |
Treat these as market bands rather than a price list; the figure that lands depends on how many apps, environments and integrations sit inside your submission. Our wider guide to penetration testing costs in the UK walks through how effort and price scale beyond this specific requirement, and the quote form below turns your scope into a fixed number.
How EJN Labs approaches Microsoft 365 Certification testing
We approach it as three linked deliverables: independent testing evidence, full-footprint documentation, and a report your certification analyst can move straight into review. EJN Labs is UK-based, CREST-accredited, and ISO 27001 and ISO 9001 certified: Microsoft’s own definition of a reputable independent company.
- Scoping to your hosting model. We map your architecture against PaaS, IaaS or ISV-hosted criteria first, so the engagement covers exactly the infrastructure the framework puts in scope, no more and no less.
- Full vulnerability class coverage. Web application testing is run against the current OWASP Top 10 and documented that way, since Microsoft’s analysts want that mapping visible in the report itself.
- Public footprint documentation. Every IP address, URL and API endpoint we test is listed in the report, matching the footprint detail Microsoft’s initial submission asks for.
- Retest built in. Where a finding is critical or high-risk, we retest it within the month Microsoft’s framework expects and mark the fix clearly as resolved.
Microsoft’s own certification analysts decide whether an app is certified, based on the evidence submitted against their published criteria; no testing company makes that call, us included. What we produce is the independent penetration test report your submission needs. For a broader look at what separates providers on work like this, our guide to choosing a UK penetration testing provider is worth reading before you commit an annual scope.
Frequently Asked Questions
Does every Microsoft 365 app need an annual penetration test?
No. Testing is mandatory once your app connects to external services Microsoft doesn’t host or manage, or runs on Azure. A standalone app using only Microsoft-managed services, such as Graph API alone, may fall outside the requirement, though attestation still applies to every app.
Can we get a fixed-price proposal for the annual penetration test?
Yes. Once your hosting model and app details are confirmed, a fixed-price proposal for an independent annual penetration test is how this work gets quoted, covering the web application and whatever infrastructure your environment brings into scope. Architecture diagrams and your public footprint firm up the number.
What happens if my penetration test report isn’t clean?
A retest is usually required. Critical and high-risk findings must be remediated within one month of the test’s conclusion, or sooner under your own patching policy, and retested by the same testing company, with the fix clearly evidenced in an updated report before a certification analyst will accept it.
What does a Microsoft 365 Certification penetration test cost in the UK?
CREST-accredited testing in the UK typically costs £1,100 to £1,400 per day. A PaaS-hosted app needing web application testing alone typically costs £5,500 to £11,200 across 5 to 8 days; adding infrastructure testing for an IaaS-hosted app takes the typical range to £7,700 to £14,000 across 7 to 10 days.
Who decides whether my app gets Microsoft 365 Certified?
Microsoft’s own certification analysts make that decision, based on the evidence you submit against their published criteria. Our role is narrower: we provide the independent penetration test report your submission needs, produced by a CREST-accredited UK firm that meets Microsoft’s own independence requirement.
Get independent evidence for your Microsoft 365 Certification
If Certification is on your roadmap this year, tell us your hosting model, whether that’s PaaS, IaaS or ISV-hosted, and we’ll scope an annual penetration test around it and deliver a report built for direct submission. Get a CREST pentesting quote and we’ll return a fixed scope and price for your app.
Leave a Reply