Any reputable independent penetration testing company can perform the penetration test for Microsoft 365 Certification. Microsoft's certification overview, last updated 14 August 2026, says web application (authenticated and unauthenticated) and internal (if applicable) and external infrastructure penetration testing "MUST take place annually (every 12 months) and conducted by a reputable independent company." The other route runs through the audit firm itself: Claranet sells a test at a "Pentest day rate," which the same page says is "Needed if app does not already have a reputable 3rd party pen test in the last 12 months."
Microsoft 365 Certification is "an independent security and privacy audit" of Microsoft 365 add-ins, Teams apps, SharePoint solutions, SaaS web apps and Copilot extensions. It is optional, but Microsoft's program overview says "In some cases, certification may be required for apps to be enabled within a Microsoft tenant," and the Teams admin center shows enterprise admins each app's security and compliance attributes, Penetration Testing among them, with sorting and compliance filters. For a US or Canadian SaaS vendor selling a Teams app or an Outlook add-in to enterprises, the penetration test report is one of the initial documents due inside a 14-day window, so a test you commission yourself should be finished before you press Start Certification.
Quick answer. A reputable independent penetration testing company you commission, or Claranet, Microsoft's certification audit firm, at an additional day rate. Microsoft requires authenticated and unauthenticated web application testing and external infrastructure testing, plus the internal network unless the environment is fully PaaS, "annually (every 12 months)." The report must come from manual testing, not a scanner, must be completed within the last 12 months when you submit, and must show critical and high findings fixed within one month and retested by the penetration testing company. Stingrai, a CREST-accredited penetration testing firm in Toronto, runs that test with named penetration testers and includes the retest, as a one-time annual engagement or a continuous program.
Who performs the test: the two routes
Route | Who tests | When it fits | Cost basis | Timing |
|---|---|---|---|---|
Your own independent firm | "a reputable independent penetration testing company" you contract | You already test annually, or can test before you start | Your contract with the firm | Report completed within the 12 months before the initial document submission |
The assessor's test | Claranet's Offensive Security Team | No reputable third-party test from the last 12 months | "Pentest day rate," scoped per engagement | Scheduled only after 50% of in-scope controls are approved, inside the 60-day evidence window |
Microsoft's pages set four conditions on the test and none on the tester's credentials. Each condition below comes from Microsoft's own wording:
Independent. The certification overview says "a reputable independent company"; the application security evidence guide, updated 31 July 2026, says "a reputable independent penetration testing company."
Manual. The Initial Document Submission Guide, updated 16 June 2026, says the report "must be produced from manual penetration testing, it can't be the output of an automated scanning/testing tool." An autonomous-only report, Stingrai's own Autonomous Pentest included, is the wrong evidence here.
Recent. The report must be "completed within the last 12 months," with dates.
Retested by the tester. Critical, high and automatic-failure findings "MUST be retested by the penetration testing company and clearly highlighted as fixed."
Microsoft does not define "reputable." The same overview requires the auditors behind the external frameworks it accepts to be members of accreditation bodies, naming ISO 27001 certification and PCI DSS assessors as examples, but sets no accreditation for the penetration testing company. Our advice, not a Microsoft rule: give the analyst something to check, such as a firm-level accreditation like CREST, named testers and a methodology section that states coverage.
What Microsoft's pages require of the report
Figure 1: What Microsoft's certification pages require of the penetration test report, read 23 October 2026. Sources: Microsoft Learn, certification overview, application security evidence guide, Initial Document Submission Guide and sample evidence guide overview.
Two pages describe when testing applies, in different words:
The certification overview makes it "mandatory for any app that connects to external services not hosted or managed by Microsoft." A standalone app that "only uses Microsoft services such as GraphAPI" may not need it, but "apps hosted in Azure must undergo penetration testing."
The application security evidence guide calls it "a mandatory requirement for all applications undergoing Microsoft 365 Certification." Its exception covers ISVs that host or manage no supporting infrastructure: the infrastructure test then falls away and the web application test is "assessed on a case-by-case basis."
Read together: if you run a backend, an API or a cloud tenant behind the app, you test it. The overview lists "Lack of penetration testing reports when required" among its automatic failures.
Free or paid: what Microsoft's pages say about the assessor's test
Figure 2: What each source says about the assessor's penetration test, by date, read 23 October 2026. Sources: Microsoft 365 Developer Blog, sample evidence guide overview, application security evidence guide, certification overview and Claranet.
A June 2024 post on the Microsoft 365 Developer Blog advertised "free, annual pen-testing." The sample evidence guide overview, last updated 25 February 2026, still says "the free Microsoft pen test is limited to twelve days only," one test and one retest a year, with extra days paid upfront. The newer pages read differently:
The certification overview (14 August 2026) says the "ISV will work with audit firm to pay for the certification" and lists a "Pentest day rate" row in its cost table.
The Claranet page, read 23 October 2026, lists "Pentest day rate" under bolt-ons, scoped "after the workshop," and mentions no free test.
Ask your certification analyst which model applies before you plan around it. Either way, the assessor's test has two constraints your own test does not. It cannot be scheduled until 50% of in-scope controls are approved, and the evidence guide makes the ISV pay rescheduling and cancellation fees, which reach 100% payable for a reschedule requested less than two days before the start date.
Publisher Verification, Publisher Attestation and certification
Tier | What it is | Who checks it | Penetration test |
|---|---|---|---|
Publisher Verification | A verified Microsoft partner account linked to the app registration; a blue badge on the Entra consent prompt | Microsoft verifies the publisher, and "doesn't imply or indicate quality criteria" | None |
Publisher Attestation | A self-assessment of more than 80 factors, published for customers, valid one year | "Microsoft does not independently verify the information submitted" | The questionnaire asks "Do you perform annual penetration testing on the app?"; no report is reviewed |
Microsoft 365 Certification | An independent audit across application security, operational security, and data handling, security and privacy | A certification analyst, with Claranet recommending the result to Microsoft | Required, as above, and renewed every year |
Microsoft's marketplace policy 1140.6 says "Apps and agents must complete Publisher Attestation in Partner Center," and the attestation page calls it a "Requirement for all Teams apps," although the Teams Store validation guidelines mark it "Good-to-fix." Both verification and attestation are prerequisites for certification, and an attestation older than three months must be resubmitted before you start.
How to scope the test
The certification overview puts "the environment where the app, add-in, or agent's code is hosted (usually referenced in the manifest file)" in scope, plus any environment that interacts with it. Microsoft sets the test by hosting model:
Hosting model (Microsoft's terms) | Test Microsoft expects | Source |
|---|---|---|
IaaS or ISV hosted (on-premises, private data center) | Internal and external infrastructure plus the web application | Sample evidence guide overview |
PaaS or serverless | The web application and its underlying supporting infrastructure; the full internal network is not required when the environment is fully PaaS | Sample evidence guide overview; certification overview |
Hybrid hosted | Each part assessed under its own hosting type | Appendix F |
Only Microsoft 365 components, or hosted entirely in the customer's infrastructure | No infrastructure test; web application test decided case by case | Application security evidence guide |
Six scoping decisions decide whether the report passes:
The full external footprint. Every public IP address, URL, domain and API endpoint goes in scope and in the report, and should match the public footprint and API endpoint list in your initial document submission.
Production. Testing runs against live production. UAT or staging is accepted only when production is not feasible and the report confirms "the same application build was deployed to production at the time of testing," or when the same infrastructure-as-code templates and CI/CD pipelines give staging "deterministic parity with production."
Segmentation. If segmentation keeps other environments out of scope, "the penetration testing report must validate the effectiveness of these segmentation techniques."
Disaster recovery and backups. Separate disaster recovery and remote backup environments sit inside the certification scope, so decide with your tester whether they belong in the test too.
Coverage. Web application testing must cover "all vulnerability classes," for example the OWASP Top 10 or SANS Top 25, and Microsoft recommends stating that coverage in the report.
Roles. Test authenticated and unauthenticated, as Microsoft requires; our advice is to cover every role the app exposes in a tenant.
Two adjacent controls reward the same work. Control 17 asks for a Graph API permission register, and permissions beyond least privilege are an automatic failure; testing the app registration shows whether granted scopes exceed what the code calls (Entra app registration guide). For Copilot agents, Responsible AI control 24 asks for tests of the protections against inappropriate content "at least quarterly," which adversarial prompt testing can document (Copilot connector matrix).
What fails the report
Microsoft lists nine conditions that "will normally result in an automatic certification failure until the vulnerability has been remediated and independently retested":
an unsupported operating system or unsupported JavaScript library;
default, enumerable or easily guessable administrative accounts;
SQL injection;
cross-site scripting;
directory (path) traversal;
HTTP protocol flaws: request smuggling, desync and response splitting;
source code disclosure, including local file inclusion;
any finding rated Critical (CVSS 9.0 to 10.0) or High (7.0 to 8.9);
any significant vulnerability that could expose large volumes of end-user identifiable information or organizational user information.
Each is a class a tester checks for, and the fix is the same in every case: remediate, then have the penetration testing company retest and mark the finding resolved in the final report. Because any open Critical or High finding is itself on the list, a report without retest results is the gap to close first, and the certification FAQ says a retest "may be required" when a report has none. At renewal, Microsoft can reject an app that "has outstanding vulnerabilities in place and can't be fixed within the certification window."
The evidence pack the analyst reads
Item | What the analyst looks for | Microsoft source |
|---|---|---|
Full unredacted report with test dates | Completed within 12 months; manual testing; sent through Partner Center when requested, or "the certification analysts will not be able to complete the audit" | Initial Document Submission Guide; sample evidence guide overview |
Scope section | Every public IP, URL, domain and API endpoint, the internal network where applicable, and the hosting environment | Certification overview |
Methodology and coverage | Authenticated and unauthenticated testing; OWASP Top 10 or SANS Top 25 coverage stated, as Microsoft recommends | Certification overview |
Environment statement | Production, or the same build in production at the time of testing, or IaC parity | Application security evidence guide |
Segmentation results | Proof that out-of-scope environments are isolated | Certification overview |
Retest results | Critical, high and automatic-failure findings retested and marked resolved | Certification overview |
Remediation dates | Critical and high findings fixed within one month of the end of testing | Certification overview |
A shareable summary | Reports, a cover letter or a summary of documents marked to be shared with customers' admins | User guide |
One detail catches teams out: the evidence-sharing checkbox in Partner Center is "checked by default" and opens your certification evidence to Microsoft 365 administrators in the Teams and Microsoft 365 admin centers. Microsoft's user guide lets you share "more refined and scrubbed documents" instead, so send the full report to the analyst and a summary or attestation letter to admins (completion letter vs full report).
Timeline: when to commission the test
Figure 3: The Microsoft 365 Certification clock. Day markers are our arithmetic from Microsoft's stated windows. Sources: certification overview and sample evidence guide overview.
Initial Document Submission: 14 days, "up to 30 days" in some circumstances.
Full evidence review: 60 days, with a first pass advised within 30 days and the final submission "two weeks before the completion date."
Extension: "up to an additional 60 days" on the certification overview, which names "Penetration testing delays" as a reason, but "a maximum of an additional 30 days" in the evidence guide overview.
Freshness: the evidence guide wants all evidence "less than 3-months old" (ask your analyst how that applies to a report up to 12 months old), and Microsoft allows "only one submission in a year."
The schedule favours a test commissioned before you press Start Certification: the report is due in the first 14 days, the fixes and retest happen before the clock starts, and you never wait for 50% of controls to be approved.
When | What | Basis |
|---|---|---|
Two to three months before starting | Commission the test; fix critical and high findings within one month; retest | Our recommendation, built on the 12-month report and one-month remediation rules |
Before starting | Publisher Verification; Publisher Attestation (resubmit if older than three months) | Prerequisites |
Days 0 to 14 | Initial documents: report, architecture and data flow diagrams, public footprint, API endpoints, Graph permissions | Initial document submission |
Days 14 to 74 | Evidence for every scoped control; first pass by day 44 | Sample evidence guide overview |
Every quarter | Vulnerability scans of the full public footprint and internal ranges | Operational security controls |
Months 9 to 12 | New annual test and retest; recertification can start 90 days before expiry | Certification overview |
What it costs
Microsoft publishes no fee for the certification. The ISV pays Claranet, which scopes the work on a pre-call, sends a "fixed-price statement of work," headlines "6.5 days of consultancy, assessment, and reporting," and publishes no prices. Where Microsoft's criteria are met, satellite audits with a reduced control set apply in years two and three, but Claranet lists a "New penetration test each year" for them too.
Stingrai's fixed prices cover one web application and associated APIs. The Hybrid Pentest, in which penetration testers test manually alongside Snipe throughout, is US$6,800 per assessment (about C$9,534) or US$1,275 a month (about C$1,788) on a 12-month plan, and ships a report and an attestation letter. The Autonomous Pentest is US$3,000 per assessment (about C$4,206) or US$650 a month (about C$911) on a 12-month plan, but its autonomous-only report does not meet Microsoft's manual-testing line. Conversions use the Bank of Canada rate of 1.4021 on 22 October 2026. The infrastructure, cloud and AI testing that certification also needs is human-led and quoted through Get a Quote.
What to ask a penetration testing vendor
Is the testing manual, and will the report say so, with test dates and the named testers?
Will the scope list every public IP, URL, domain and API endpoint we will declare in the initial document submission?
Will you test production, or state in the report that the build was identical in production at the time of testing?
Will you validate our segmentation and record the result?
Is the retest included, and will the final report mark critical, high and automatic-failure findings resolved?
Can you deliver a full report for the analyst and a separate summary or attestation letter for customers?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For an ISV pursuing Microsoft 365 Certification, Stingrai is the independent penetration testing company in route one: it tests the app and its environment and produces the report the certification analyst reads, while Claranet assesses the controls and recommends the app to Microsoft. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, and Stingrai Inc. holds CREST accreditation for penetration testing (CREST Marketplace).
The app and its APIs: authenticated and unauthenticated web application and API testing across every role, aimed at broken authorization, IDOR and business logic, including the Teams tab, bot or add-in backend named in the manifest.
Infrastructure: external and internal network testing, including segmentation testing.
Cloud and identity: cloud testing from the control plane to the workload, including Entra ID app registrations, service principals and consent grants.
Copilot agents: AI and LLM testing for prompt injection, tool misuse and excessive agency, aligned with the OWASP LLM Top 10.
Evidence: every confirmed finding is posted to the PTaaS platform with a proof of concept and remediation guidance, retesting is included, reports are redactable PDFs, and every human-led and hybrid report ships with an attestation letter.
Engagements run as a one-time annual test timed to your certification or renewal, or as a continuous program. Snipe, Stingrai's autonomous AI agent, covers web applications and their APIs only; network, cloud and AI testing is human-led. Stingrai is based in Toronto with a London office and serves US and Canadian clients remotely.
Frequently Asked Questions
Who does the penetration test required for Microsoft 365 Certification?
A reputable independent penetration testing company that you commission, or Claranet, Microsoft's certification audit firm, at an additional day rate. Microsoft's certification overview says the testing must take place every 12 months and be conducted by a reputable independent company, and it names no accreditation or approved vendor list. The assessor's test is needed only if the app has no reputable third-party test from the last 12 months.
Is a penetration test mandatory for Microsoft 365 Certification?
Yes, for any app backed by infrastructure the publisher hosts or manages. The certification overview makes testing mandatory for apps that connect to external services not hosted or managed by Microsoft, and requires it for apps hosted in Azure. An app built solely from Microsoft 365 components, or hosted entirely in the customer's infrastructure, skips the infrastructure test, and Microsoft decides on its web application test case by case.
Is the Microsoft 365 Certification penetration test free?
Microsoft's pages disagree. The sample evidence guide overview, updated 25 February 2026, describes a free Microsoft pen test limited to twelve days. The certification overview, updated 14 August 2026, says the ISV pays the audit firm and lists a pentest day rate. Confirm the current model with your certification analyst.
Can an automated or AI-generated pentest report be used?
No. Microsoft's Initial Document Submission Guide says the report must be produced from manual penetration testing and cannot be the output of an automated scanning or testing tool. Choose human-led testing, or a hybrid test in which penetration testers test manually, for this program.
How old can the penetration test report be?
The report must be completed within the last 12 months when you make the initial document submission, and the test must be repeated every 12 months. Microsoft's evidence guide also wants all evidence to be less than three months old when submitted, so confirm with your analyst how that applies to an older report.
Does Publisher Attestation require a penetration test?
No. Publisher Attestation is a self-assessment that Microsoft does not independently verify. Its questionnaire asks whether you perform annual penetration testing, but no report is reviewed. Microsoft 365 Certification is the tier that requires the report.
Related reading
Microsoft Entra App Registration Penetration Testing: Buyer Scope (2026)
Microsoft 365 Copilot Connector Permission Testing: A Buyer Matrix (2026)
How to Scope a SaaS OAuth and Connected App Penetration Test
Pentest Completion Letter vs Full Report: What to Share With Customers and Auditors (2026)
References
Microsoft. Microsoft 365 Certification framework overview. Microsoft Learn, last updated 14 August 2026, read 23 October 2026. https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/certification. Requirements, cost structure, submission time frames and automatic failures.
Microsoft. Application Security (sample evidence guide, controls 1 to 27). Microsoft Learn, last updated 31 July 2026. https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/seg2_app. Penetration test controls, production and IaC rules, automatic failures, the assessor's test and its fees.
Microsoft. Microsoft 365 Certification sample evidence guide overview. Microsoft Learn, last updated 25 February 2026. https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/seg2_overview. Evidence rules, hosting models, deadlines and the twelve-day free test wording.
Microsoft. Microsoft 365 Certification: Initial Document Submission Guide. Microsoft Learn, last updated 16 June 2026. https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/initialdocumentsubguide. The manual-testing requirement and initial documents.
Microsoft. Microsoft 365 App Compliance Program overview, What is Publisher Attestation?, Publisher Attestation FAQ and User Guide for Microsoft 365 App Compliance Program. Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365-app-certification/overview, https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/attestation, https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/attestfaq and https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/userguide. Program tiers, tenant enablement, the attestation questionnaire's penetration testing question and sharing documents with admins.
Microsoft. Microsoft 365 Certification FAQ, How-to renew and Appendix and glossary. Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/certfaq, https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/how-to-renew and https://learn.microsoft.com/en-us/microsoft-365-app-certification/docs/appendix. Retests, renewal rejection, hosting types and CVSS bands.
Microsoft. App compliance program for security, data handling, and privacy (Teams admin center). Microsoft Learn, last updated 17 December 2025. https://learn.microsoft.com/en-us/microsoftteams/overview-of-app-certification. Admin filters and evidence downloads.
Microsoft. Microsoft Marketplace general listing and offer policies, section 1140.6, and Teams Store validation guidelines. https://learn.microsoft.com/en-us/legal/marketplace/certification-policies and https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/deploy-and-publish/appsource/prepare/teams-store-validation-guidelines. Publisher Attestation for apps and agents.
Microsoft. Publisher verification overview. Microsoft identity platform. https://learn.microsoft.com/en-us/entra/identity-platform/publisher-verification-overview. What the verified badge does and does not show.
Krishna Mawani, Microsoft. Microsoft 365 Certification validates app compliance through annual pen testing. Microsoft 365 Developer Blog, 6 June 2024. https://devblogs.microsoft.com/microsoft365dev/microsoft-365-certification-validates-app-compliance-through-annual-pen-testing/. The earlier free-testing announcement.
Claranet. Microsoft 365 App Compliance Certification. Read 23 October 2026. https://www.claranet.com/uk/microsoft-365-app-compliance-certification/. Assessment options, the pentest day rate bolt-on and satellite audits.
Bank of Canada. Daily exchange rates, USD/CAD 1.4021 on 22 October 2026. https://www.bankofcanada.ca/rates/exchange/daily-exchange-rates/
Stingrai. Pricing and Snipe. https://www.stingrai.io/pricing and https://www.stingrai.io/snipe
Talk to Stingrai
Stingrai will test your Microsoft 365 app, its APIs and the infrastructure behind it before you press Start Certification, and hand you a dated report from manual testing by named penetration testers, a retest that records each critical and high finding as resolved once you fix it, and an attestation letter you can share with customers' admins, as a one-time annual engagement or a continuous program. Get a quote or book a free discovery call.
