This guide explains how Microsoft 365 supports the ACSC Essential Eight, control by control, and what it takes to reach the maturity level you need.
The Essential Eight is the Australian Government’s baseline for cyber security. Developed by the Australian Signals Directorate (ASD) and its Australian Cyber Security Centre, it is increasingly expected by customers, insurers and regulators. If your business runs on Microsoft 365, you already own many of the tools needed to meet it. This guide explains how each control maps to Microsoft 365, and what to watch out for.
What are the Essential Eight?
The Essential Eight is a set of eight mitigation strategies that make it much harder for attackers to compromise your systems. ASD’s Essential Eight Maturity Model describes four levels, from Maturity Level Zero to Maturity Level Three, based on how well you resist increasingly capable attackers. ASD reviews and updates the model regularly, so check the current version when planning.
How Microsoft 365 supports each control
1. Application control
Application control stops unapproved software from running. In a Microsoft environment this is delivered with App Control for Business (Windows Defender Application Control) or AppLocker, deployed and managed through Intune.
2. Patch applications
Microsoft 365 Apps can be updated automatically through update channels managed in Intune, while Microsoft Defender Vulnerability Management finds out-of-date and vulnerable applications across your devices.
3. Configure Microsoft Office macro settings
Intune policies can block macros in files that come from the internet, allow only digitally signed macros from trusted publishers, and restrict where macros can run.
4. User application hardening
Attack surface reduction rules in Microsoft Defender, browser policies for Microsoft Edge, SmartScreen and web content filtering help reduce the risk from web content and risky features in everyday applications.
5. Restrict administrative privileges
Use separate admin accounts, give people the least privilege they need, protect admin sign-ins with phishing-resistant MFA, and use Microsoft Entra Privileged Identity Management, which needs a higher licence, to grant admin rights only when required.
6. Patch operating systems
Windows Update for Business, managed in Intune, controls how and when Windows updates are rolled out, and Defender Vulnerability Management reports on missing patches.
7. Multi-factor authentication
Microsoft Entra ID provides MFA, and Conditional Access lets you require it for everyone, with phishing-resistant methods such as passkeys for administrators and sensitive access.
8. Regular backups
Microsoft 365 does not replace backup. Use a dedicated Microsoft 365 backup solution and regularly test restores, together with backups of any on-premises servers.
The licensing question
Many of these capabilities are included in Microsoft 365 Business Premium, which bundles Intune, Defender for Business, Conditional Access and more. Larger organisations often use Microsoft 365 E3 or E5. The right plan depends on your size and target maturity level.
An important reality check
Owning the tools does not make you compliant. Reaching a maturity level takes correct configuration across every device, consistent processes, evidence and regular review. Maturity is assessed against the model, ideally by an independent assessor, and it is easy to overestimate where you are. Aim for a consistent level across all eight controls before moving to the next.
A practical path forward
- Assess where you are against each control.
- Prioritise quick wins such as MFA, patching and backups.
- Configure Intune and Defender policies to match your target level.
- Document your settings and keep evidence.
- Review regularly and as the model changes.
Key takeaways
- The Essential Eight is the Australian Government baseline for cyber security, developed by the Australian Signals Directorate and its Australian Cyber Security Centre.
- The ASD Essential Eight Maturity Model describes four levels, from Maturity Level Zero to Maturity Level Three.
- Microsoft 365 provides many of the tools, including Intune, Defender Vulnerability Management and macro controls, but they still need to be configured, managed and evidenced.
- ASD reviews the model regularly, so check the current version when planning.
ACSC Essential Eight: frequently asked questions
What are the Essential Eight?
A set of eight mitigation strategies from the Australian Signals Directorate that make it much harder for attackers to compromise your systems. They are increasingly expected by customers, insurers and regulators.
How many maturity levels are there?
ASD describes four levels, from Maturity Level Zero to Maturity Level Three, based on how well you resist increasingly capable attackers. ASD reviews and updates the model regularly, so check the current version.
Can Microsoft 365 meet the Essential Eight on its own?
It supplies many of the tools. For example, application control can be delivered with App Control for Business or AppLocker through Intune, and Defender Vulnerability Management finds out-of-date applications. You still need to configure, manage and keep evidence for each control.
Related reading: Essential Eight support. For Microsoft or government guidance, see ASD Essential Eight guidance.
Total Solutions IT helps Australian businesses assess, implement and maintain Essential Eight aligned security on Microsoft 365. Call 02 6061 4222 to book an assessment.
