The short version
- Review identity first: effective MFA and legacy-authentication restrictions can reduce credential risk. Confirm licence entitlements and compatibility.
- Business Premium includes useful controls; some features, workloads, log storage and backup services require additional licensing or spend.
- Map every control to the Essential Eight so hardening produces evidence you can show insurers, tenders and enterprise customers.
- Evaluate controls in audit or simulation mode, then pilot supported enforcement settings. Detection supports monitoring; prevention requires appropriate enforcement, exceptions and response.
- If you cannot see it, you cannot prove it: confirm the unified audit log is on and extend retention before an incident, not after.
28 controls across 5 domains
- Identity6 controls
- Email & collaboration6 controls
- Data protection5 controls
- Endpoint6 controls
- Logging & monitoring5 controls
Identity — Entra ID, Conditional Access, MFA & PIM
Identity is the perimeter. Prioritise authentication and privileged access according to the tenant’s risks and existing controls.
Require MFA for all users (Conditional Access policy)
Do this — Build and test a Conditional Access policy that requires multi-factor authentication. Prefer phishing-resistant methods such as passkeys / FIDO2 where supported. Microsoft Authenticator number matching improves push-notification security but is not phishing-resistant authentication.
Why — Reduces the risk from stolen passwords; method strength, session protection and coverage still matter.
Multi-factor authentication
Block legacy authentication (Conditional Access policy)
Do this — Add a separate Conditional Access policy that blocks legacy / basic-auth protocols (POP, IMAP, SMTP AUTH, older Office clients) for all users.
Why — Legacy protocols cannot enforce MFA, so an attacker with a stolen password bypasses it entirely — the most common way MFA gets defeated.
Multi-factor authentication
Require a compliant or hybrid-joined device
Do this — Use a Conditional Access grant control to require an Intune-compliant or Entra hybrid-joined device before granting access to email and SharePoint.
Why — Stops corporate data being pulled onto unmanaged, unpatched personal machines where you have no visibility or control.
Enforce Privileged Identity Management (PIM) for admin roles
Do this — Make Global Admin, Exchange Admin and other privileged roles eligible-only via PIM with just-in-time activation, approval and MFA (requires Entra ID P2 or Entra ID Governance; the base Business Premium subscription includes Entra ID P1).
Why — Removes standing admin rights, so a compromised admin account is not permanently privileged.
Restrict administrative privileges
Separate, cloud-only break-glass and admin accounts
Do this — Keep two excluded emergency-access accounts, and give admins a separate cloud-only admin identity distinct from their day-to-day mailbox account.
Why — Separates daily work from privileged access. Monitor and regularly test emergency access; it reduces lockout risk but cannot guarantee access during every failure.
Restrict administrative privileges
Enable SSPR and Entra Password Protection
Do this — Turn on self-service password reset and Password Protection with a custom banned-password list (business name, suburb, common local terms).
Why — Stops staff choosing guessable passwords and cuts help-desk reset requests that are themselves a social-engineering vector.
Email & collaboration — Defender for Office 365
Email is the delivery mechanism for phishing, business email compromise and most ransomware. Business Premium includes Defender for Office 365 Plan 1 — the job is to switch on the preset policies rather than trust the defaults.
Apply Defender preset security policies (Standard or Strict)
Do this — In the Microsoft Defender portal, enable the Standard (or Strict) preset so anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments are set to Microsoft’s recommended baseline in one move.
Why — Provides a maintained baseline; confirm policy coverage, exclusions and compatibility with the tenant.
Anti-phishing policy with impersonation & mailbox intelligence
Do this — Enable impersonation protection for your key people (owner, finance, payroll) and domains, plus mailbox intelligence, in the anti-phishing policy.
Why — Helps detect impersonation and business email compromise; users and response processes remain necessary.
Safe Attachments — including SharePoint, OneDrive & Teams
Do this — Turn on Safe Attachments in Dynamic Delivery mode, and enable Safe Attachments for SharePoint, OneDrive and Teams.
Why — Analyses attachments and can quarantine detected threats; testing does not guarantee detection of every malicious file.
Safe Links for email, Teams and Office apps
Do this — Enable Safe Links so URLs are rewritten and re-checked at time-of-click across mail, Teams and the Office clients.
Why — Can detect malicious destinations at click time, including links changed after delivery, within supported coverage.
External sender tagging & first-contact safety tip
Do this — Enable the native External sender tag in Outlook and the first-contact safety tip so mail from outside the tenant is visibly flagged.
Why — Gives staff an obvious cue to slow down on spoofed or unfamiliar senders, cutting the phishing click-through rate.
Configure SPF, DKIM & DMARC; block external auto-forwarding
Do this — Publish SPF, sign with DKIM, set a DMARC policy (progress to p=reject), and use the outbound spam policy to block automatic external forwarding.
Why — Reduces domain-spoofing risk and unauthorised forwarding within configured coverage; monitor exceptions and other exfiltration paths.
Data protection — Purview DLP, sensitivity labels & sharing
Once identity and email are locked down, the question is where your data can go. Purview and SharePoint sharing controls can reduce inappropriate sharing within configured and licensed coverage.
Purview DLP policy for Australian sensitive data
Do this — Create and test Purview DLP policies using relevant Australian sensitive information types across licensed Exchange, SharePoint and OneDrive locations. Teams files use SharePoint or OneDrive; Teams chat and channel-message DLP requires separate eligible licensing. Check current entitlements before deployment.
Why — Can detect or restrict configured sensitive-data sharing. Coverage and false positives need testing; it does not guarantee prevention or determine whether a breach is notifiable.
Purview sensitivity labels with encryption
Do this — Publish a small label set (e.g. Public / Internal / Confidential), with Confidential applying encryption and access restrictions, and set a default label.
Why — Keeps protection attached to the file itself, so a Confidential document stays encrypted even after it leaves your tenant.
Restrict SharePoint & OneDrive external sharing
Do this — Set organisation-level external sharing to the least-open setting your business can work with (ideally “New and existing guests”), not “Anyone”.
Why — Closes anonymous links as a data-leak and unauthenticated-access path.
Disable or expire anonymous “Anyone” links
Do this — Turn off Anyone links — or, if required, force an expiry (e.g. 14 days) and a view-only default in the SharePoint sharing settings.
Why — Stops indefinitely-live public links to client files being indexed or forwarded beyond the intended recipient.
Govern Teams guest and external access
Do this — Review guest access in Teams / Entra External ID, restrict who can invite guests, and run periodic access reviews of guests.
Why — Prevents former contractors and stale guest accounts retaining access to internal channels and files.
Endpoint — Intune, BitLocker, ASR rules & Defender
Business Premium includes Intune and Defender for Business. They support several Essential Eight activities, but effectiveness and coverage across the assessed environment still require evidence.
Intune device compliance policies
Do this — Define compliance policies (encryption on, Defender running, minimum OS build, firewall on) and pair them with the earlier Conditional Access device requirement.
Why — Restricts access according to assessed device state and configured policy; validate reporting, exceptions and unsupported devices.
Enforce BitLocker via Intune with key escrow
Do this — Push a disk-encryption policy that silently enables BitLocker (XTS-AES 256) and escrows recovery keys to Entra ID.
Why — Helps protect data at rest on a lost device. Verify encryption and recovery-key escrow, and test recovery; notification obligations depend on the actual incident.
Attack Surface Reduction (ASR) rules in Block mode
Do this — Deploy the ASR rules via Intune — especially blocking Office child-process creation, macro-launched executables and content from email / webmail — moving them from Audit to Block.
Why — Cuts off the most common macro-and-Office malware execution chains without waiting on user behaviour.
Configure Microsoft Office macro settings
Block untrusted and internet-sourced Office macros
Do this — Use Intune ADMX settings to block macros in files from the internet and only allow signed macros, backed by the corresponding ASR rule.
Why — Restricts defined macro execution paths; assess allowed macros and exceptions against the applicable requirements.
Configure Microsoft Office macro settings
Onboard to Defender for Endpoint with EDR in block mode
Do this — Onboard all Windows endpoints to Defender for Business / Endpoint, and enable EDR in block mode, tamper protection, network protection and controlled folder access.
Why — Provides real-time detection and automated response to ransomware and living-off-the-land attacks that signature AV misses.
Windows Update rings / Autopatch and app patching
Do this — Configure Intune update rings (or Windows Autopatch) for OS updates, and use Defender Vulnerability Management to track and drive application patching.
Why — Closes the exploited-vulnerability window that ransomware crews rely on — the two patching mitigations of the Essential Eight.
Patch operating systems
Logging & monitoring — audit log, alerts & retention
If you cannot see it, you cannot respond to it or prove what happened. These controls give you the forensic trail a Notifiable Data Breach assessment and any cyber-insurance claim will demand.
Confirm the unified audit log is enabled
Do this — Verify in the Purview compliance portal that audit logging is on tenant-wide (default-on for new tenants, but confirm) and that mailbox auditing is active.
Why — Without it you have no record of who accessed, forwarded or deleted what — leaving you blind during an incident.
Configure alert policies for high-risk activity
Do this — Enable and tune Purview / Defender alert policies for mass download, mailbox forwarding-rule creation, unusual admin activity and eDiscovery changes.
Why — Turns silent compromise into an actionable notification, so you catch data theft and BEC in hours, not months.
Enable Entra ID Protection risk detections
Do this — Turn on risky sign-in and risky user detections in Entra ID Protection and alert on them (risk-based Conditional Access needs Entra ID P2).
Why — Surfaces impossible-travel and leaked-credential sign-ins that indicate an account is already compromised, and can trigger step-up MFA.
Extend sign-in and audit log retention
Do this — Set retention by log source and licence. Entra sign-in and audit logs are normally retained for 7 days on Free and 30 days on P1/P2; export when longer retention is needed. Microsoft Purview Audit is separate: Audit Standard normally retains records for 180 days, with longer options dependent on licensing and retention policy.
Why — Attacks are often discovered long after the initial breach; short default retention destroys the evidence you need.
Assign owners and review alerts on a schedule
Do this — Nominate who reviews security alerts and the Microsoft Secure Score weekly, and record the items actioned.
Why — Monitoring only reduces risk if someone actually looks — an unread alert queue is no control at all.
Authentication reference: Microsoft Entra authentication strengths distinguish phishing-resistant methods from Authenticator push notifications.
Verify requirements against ASD's assessment guide, Microsoft Teams DLP licensing, Entra log retention and Purview audit retention.
How Microsoft 365 covers the Essential Eight
The value of hardening a tenant methodically is that it lines up with the ASD Essential Eight — the baseline Australian tenders, insurers and enterprise buyers ask about. The mappings below describe tooling support, including additional entitlements where noted. They are not a maturity assessment.
Tooling mappings — not measured maturity or percentage coverage
- Multi-factor authenticationTooling support
Entra ID MFA enforced through Conditional Access, phishing-resistant methods, legacy auth blocked.
- Restrict administrative privilegesTooling support
Entra ID PIM (P2) with just-in-time activation, separate admin accounts and access reviews.
- Patch operating systemsTooling support
Intune Update Rings / Windows Autopatch enforcing OS updates on a defined schedule.
- Configure Microsoft Office macro settingsTooling support
Intune ADMX policy blocking internet-sourced / unsigned macros, backed by ASR macro rules in Block mode.
- User application hardeningTooling support
ASR rules, Defender for Endpoint network protection, and Edge / Office hardening via Intune.
- Patch applicationsPartial
Intune app deployment plus Defender Vulnerability Management to find and prioritise unpatched apps.
- Application controlPartial
App Control for Business (formerly WDAC) and AppLocker via Intune, with Defender for Endpoint visibility.
- Regular backupsPartial
Microsoft 365 Backup (a separate pay-as-you-go add-on) plus native retention — validate the restore and keep an independent copy.
Coverage reflects what the Microsoft 365 tooling can deliver — the maturity level you achieve depends on configuration, patching timeframes and evidence, which are process, not licence.
FAQs
Do I need Microsoft 365 E5 to harden properly?
No. Microsoft 365 Business Premium covers the large majority of this checklist — Entra ID P1 (Conditional Access), Intune, Defender for Office 365 Plan 1, Defender for Business, and core Purview DLP and labels. The main gaps are Privileged Identity Management and risk-based Conditional Access, which need Entra ID P2 (available as an add-on), plus workload-specific DLP entitlements, including Teams chat/channel-message protection. Check current licensing for every selected feature. Most SMEs reach a strong position on Business Premium alone.
How does this map to the Essential Eight maturity levels?
These controls support selected requirements; enabling them does not establish Maturity Level One or Two. Assess the agreed environment against every applicable requirement at the target level, including implementation and effectiveness, patching deadlines, administrative access, application control and recovery tests. Microsoft 365 is only part of that environment.
Is Microsoft 365’s built-in retention the same as a backup?
No. Retention policies and the recycle bin protect against accidental deletion for a window, but they are not a point-in-time backup you control. For the Essential Eight backup mitigation, use Microsoft 365 Backup (a separate pay-as-you-go add-on, not part of Business Premium) and confirm you can actually restore — and for higher assurance keep an independent copy. Always test the restore, not just the backup job.
Will enforcing MFA and Conditional Access lock my staff out?
Lockouts are possible. Use report-only evaluation, pilot groups, user preparation and tested rollback before broad enforcement. Maintain, monitor and test emergency-access accounts according to Microsoft guidance. These measures reduce disruption risk; they do not guarantee access.
We already use an IT provider — do we still need this?
Yes, as your assurance baseline. Many providers manage devices without hardening the tenant, so use this checklist to ask specifically which controls are configured, in Block versus Audit mode, and who reviews the alerts. Ask for appropriate configuration and operating evidence; Secure Score alone does not prove control effectiveness.
Is the Essential Eight mandatory for an SME?
Private SMEs should check applicable laws, contracts, tender and insurer requirements. Essential Eight is a useful assessment framework, but a particular maturity level is not automatically mandatory for every SME or every procurement.