Microsoft 365 App Certification: what it covers and why it matters

Microsoft 365 Certification is the security assessment behind the 'certified' status you see against apps in the Microsoft marketplace. Claranet designed the standard with Microsoft in 2018 and has delivered it ever since, certifying hundreds of applications, add-ins and integrations a year. If you've come across it recently and aren't quite sure what's involved, what Microsoft expects or what the value really is, here's the short version.

So what is it, exactly?

Getting your app into the Microsoft 365 world is obviously valuable, but getting it listed isn't the full story. Customers want to know that what they're connecting to Microsoft 365 is secure, and that's what the App Compliance Programme is there for. Two terms come up quickly. Publisher Attestation is essentially a self-assessment: it gives customers visibility of what you say you do. Microsoft 365 App Certification goes further, with an independent assessment of the app and the environment behind it, so rather than claiming, you're proving. The risk it's tackling is a single one: Microsoft customer data being exposed through weak integrations.

What gets assessed?

This is what gets underestimated the most. It isn't a simple app review. The environment behind your application, meaning the infrastructure and services you use to process, store and protect customer data, can feature just as heavily. That's why scoping comes first: how the app is hosted, what Microsoft 365 data it touches, where that data goes, which systems and third parties support it, and what the penetration test needs to cover. Get that wrong and you'll end up with evidence that doesn't cover what was expected.

What the controls are looking at

Depending on your hosting environment, the assessment can run to 70 controls across three areas.

Every one of them comes back to the same question: does the app meet the security standard for protecting the Microsoft data held within it? None of that will surprise someone who takes security seriously. The difference is that a policy or a claim isn't enough here. You have to be able to show it, whether through documentation, configuration or the way you actually operate.

The good news: what you already hold can count

If you already hold ISO 27001, SOC 2, PCI DSS or FedRAMP, we map those across so they count towards the total, which has the potential to take a meaningful chunk out of the work. So bring your certificates, scope statements and audit evidence to the first conversation. This will soon include App Defense Alliance certifications too, alongside ISO 27701 and ISO 42001.

Then there's penetration testing

It's mandatory, and it's one of the first things we're asked about, so it's worth putting in proportion: the test is roughly the final 20% of the work. The rest is the compliance framework we built with Microsoft in 2018, drawing on ISO 27001, PCI-DSS and NIST CSF alongside our own cyber and governance, risk and compliance expertise. If you already run an annual pen test, you may well be able to use it. Just check the scope, provider, methodology and report line up with what the programme needs before testing starts, rather than finding out afterwards that something wasn't covered.

What the process actually looks like

It sounds complex, but it breaks down into manageable parts. You start with scope: the app, its hosting environment, the supporting systems and the data flows between them, which together decide how many of the 70 controls apply. While some of the documentation is uploaded to Partner Centre, it isn't all paper-based, which tends to come as a relief. Controls get observed in operation, usually over a screen share with whoever owns them, and that gets you to an outcome faster than swapping documents back and forth. It does mean one person rarely owns the whole thing, so expect to pull in security, infrastructure, development and compliance.

And if something doesn't meet the requirement? It's recorded as a finding to be remediated and revalidated, not a reason you've failed. Arguably that's the most useful part of the whole exercise, because it surfaces gaps you might not have known were there. Once findings are closed, we get back on a call with you to review the remediated items. After that, if you're able to meet all the required controls, the assessment goes through quality assurance and the certification is awarded. It isn't a one-time event, though: apps are recertified annually so the assurance stays current.

Why it doesn't have to be slow

Security assessment has a reputation for dragging. At the volume we run, it can't. Dedicated coordination keeps things moving, priority applications get the extra support they need, and live calls have replaced much of the document shuffling. Scoping matters just as much. We assess vendors from well over 5,000 people down to three-person teams, so we spot complexity early and match the right people and the right amount of time to each one. Being clear about your hosting model, your data flows and where your evidence is thin is what keeps that accurate.

How it sits alongside other marketplace schemes

When the standard was designed in 2018, the App Defence Alliance didn't exist. Since then the Alliance, Slack and other vendors with ISV marketplaces have introduced schemes with much the same intent.

The value certification brings

The security case is easy enough: an independent assessment, gaps identified, assurance over both the app and the environment behind it. The commercial case is where it gets interesting. The Microsoft 365 ecosystem is crowded and security is increasingly the deciding factor, so being able to point at an independent assessment beats asking a customer to take your word for it. It gives their security team something solid when the questionnaires and procurement questions start. And certification status shows up in the Microsoft 365 admin experiences, including the Teams Admin Centre, which is exactly where someone decides whether your app gets into their tenant. It isn't just a plaque for your website.

How to prepare

The single biggest mistake is leaving the evidence question too late. Four things are worth prioritising:

• Work with us transparently during assessment scoping so we can accurately identify your hosting environment, which decides how many of the 70 controls apply.
• Gather the certifications you already hold, with their scope statements.
• Be informed on which controls are mandatory and make sure you can meet these before getting started.
• Dedicate the time to working with us on getting you to an outcome, it can be time consuming so being ready for that is important.

It's also worth knowing who owns each control in your business before you start. This is rarely a one-person job, and knowing who to pull in will save you a lot of time later.

Where to start

If you're weighing up Microsoft 365 Certification, do get in touch. We're always happy to jump on a call and discuss all the questions you have to help you make your decision. Claranet supports customers across the whole journey, from the gap analysis through assessment, remediation and certification. If you'd like to understand what it would look like for your app, speak to our team.