Essential 8 with Microsoft 365
Nick Ross · · Video and write-up
In this post, we’ll explore how the Australian Cyber Security Centre’s Essential Eight framework maps directly to Microsoft 365 security controls—and how you can automate evidence collection and policy checks across your tenant.
Today, we’ll:
- Walk through each of the eight mitigation strategies
- Show the Microsoft 365 tools and licensing needed to implement them
- Highlight user impact, cost considerations, and maintenance overhead
- Introduce CloudCapsule’s automated assessment that handles over 70% of these technical checks in a single scan
Download a Free Self-Assessment
I built a self-assessment workbook you can leverage that covers all of the mappings between the Essential 8 and Microsoft 365 policies. You can leverage this to perform manual checks within the tenant.
What Is the Essential Eight?
The Essential Eight is a prioritized set of mitigation strategies developed by the Australian Cyber Security Centre. By adopting these controls at increasing maturity levels, you can systematically harden your environment:
- Maturity Level 1 – Basic cybersecurity hygiene
- Maturity Level 2 – Intermediate resilience with configurable policies
- Maturity Level 3 – High resilience, hard to compromise
At each level, you balance friction, upfront costs, and ongoing maintenance against the risk reduction achieved.
Microsoft 365 Mapping
Microsoft has their own published documentation which outlines the mapping between Essential 8 and M365 which is what I am following: ACSC Essential Eight – Essential Eight | Microsoft Learn (opens in new tab)
Emersed within this documentation, you will also see a github repository that host Intune ACSC Windows Hardening Guidelines. This has a bunch of the policies you could upload into a tenant as JSON files that are already preconfigured. I’ve linked this library below:
1. Patch Applications
Essential Eight patch applications – Essential Eight | Microsoft Learn (opens in new tab)
2. Patch Operating Systems
Essential Eight patch operating systems – Essential Eight | Microsoft Learn (opens in new tab)
3. MFA
Essential Eight multifactor authentication – Essential Eight | Microsoft Learn (opens in new tab)
4. Restrict Admin Privileges
5. Application Control
Essential Eight application control – Essential Eight | Microsoft Learn (opens in new tab)
6. Office Macros
7. User Application Hardening
Essential Eight user application hardening – Essential Eight | Microsoft Learn (opens in new tab)
8. Regular Backups
Automating Assessments
We’ve automated about 70% of the technical controls for the Essential 8 as it relates to your configurations/policies in Microsoft.
Each Policy has automated evidence collection that represents the pass fail values
- Scans take around 60 seconds to perform on average
- Executive, white-labeled PDF reporting is available immediately to share with your customers
Map your Microsoft 365 settings to CIS Controls and NIST CSF in about a minute.
CloudCapsule scans 300+ controls, maps each finding to the framework you report against, and tracks the trend over time, so the evidence for your next review is already there.
No credit card required. Results in about a minute.
Keep reading
ConnectWise / SkyKick Breach: How to Secure Third-Party Applications in Microsoft 365
The ConnectWise Cloud Backup (formerly SkyKick) incident showed how a compromised vendor app can reach Microsoft 365 tenants without passwords or MFA. Here are 4 steps to lock down third-party applications.
How to Set Up Claude SSO with Microsoft Entra ID (10-Minute Guide)
TLDR: You can set up Claude single sign-on (SSO) with Microsoft Entra ID in about 10 minutes on a paid Claude Team or Enterprise plan. The process has three parts: verify your company domain in Claude, connect Claude to Entra through Claude’s guided setup, and control access by assigning users or groups in Entra. Once […]
How to secure Claude AI for your Business
An employee opens Claude on their laptop. It is free, it is fast, and within ten minutes they have pasted in a contract, a financial summary, and a list of customer records, all because they are trying to get their job done. No audit trail. No admin visibility. And depending on their account settings, that […]