It is unlikely that significant changes to the infrastructure will be required to meet the Microsoft 365 Certification. The controls are based on industry security best practices and will most likely be already implemented. We have seen in most cases; ISVs have had to update internal processes to bridge gaps between current working practices and what is required within the Microsoft 365 Certification. If this is a concern, Microsoft recommends that you review the latest Microsoft 365 Certification controls which can be found on the Microsoft 365 Certification Submissions Guide to ensure that your currently deployed environment and working practices meet the controls defined.