Microsoft 365, locked down properly.
Identity, data, and access controls configured by senior engineers in a single 4–6 week engagement. Not a checklist hand-off. Not a slide deck. Configuration that lands inside your tenant.
Harden is Aegentra’s Microsoft 365 security practice. Senior, NV1-cleared engineers configure Conditional Access, Intune, Purview and Defender inside your own tenant, mapped to the ACSC Essential Eight — configured, not described in a report.
What Harden covers
| Area | What gets configured |
|---|---|
| Identity and access | Conditional Access policies, MFA enforcement, privileged role management, legacy authentication blocking, and break-glass account design. |
| Email security | Defender for Office 365 policies, anti-phishing and impersonation protection, safe links and safe attachments, and SPF, DKIM and DMARC alignment. |
| Data loss prevention | DLP policies across Exchange, SharePoint, OneDrive and Teams, tuned to the data you actually hold rather than a default template. |
| Microsoft Purview | Sensitivity labels, retention policies, and audit configuration — the controls that produce evidence for ISO 27001 Annex A and the Privacy Act. |
| Endpoint hardening | Intune compliance and configuration profiles, Defender for Endpoint onboarding, attack surface reduction rules, and application control. |
| Audit and detection | Unified audit log retention, alert policies, and the logging depth an incident response actually needs. |
Why this maps to the Essential Eight
The ACSC Essential Eight is the baseline Australian organisations are measured against — in government contracts, in cyber insurance questionnaires, and increasingly in commercial tenders. Most of the eight mitigation strategies are implemented in Microsoft 365 for organisations that run on it: application control, patching applications and operating systems, configuring macro settings, user application hardening, restricting administrative privileges, multi-factor authentication, and regular backups. Hardening the tenant is how an Essential Eight maturity level stops being a self-assessment spreadsheet and becomes a configuration state you can evidence.
How Harden differs from a security audit
An audit tells you what is wrong. Harden changes it. The same senior engineer who assesses your tenant does the configuration work, which means there is no gap between the finding and the fix, and no second engagement to implement someone else’s recommendations. Work is scoped and fixed-priced after a discovery pass, and delivered on-shore.
How Harden connects to ISO 27001
A hardened Microsoft 365 tenant is where most of ISO 27001’s Annex A technical controls are actually satisfied — access control, cryptography, logging and monitoring, and secure configuration. Organisations pursuing certification usually harden first, because it converts a long list of Annex A controls into evidence generated by the system itself. See ISO 27001 implementation for the certification path, or the ISO 27001 certification guide for Australia for the standard, costs and timeline.
Who Harden is for
- Australian organisations running on Microsoft 365 that need to demonstrate a security baseline to a customer, insurer or regulator.
- Companies that have been asked for an Essential Eight maturity level and cannot currently evidence one.
- Businesses preparing for ISO 27001 certification that want the technical controls in place before the management system work starts.
- Organisations with an internal IT team that needs senior specialist help for a defined piece of work rather than an ongoing managed service.
For ongoing support rather than a hardening project, see On-Demand IT, or the solutions overview for all four practices together.
Where we work
Delivered remotely across Australia — every state and territory, including regional and remote — and in New Zealand. Senior engineers are Australian residents; there are no offshore hand-offs.
Process
- Day 1 — Tenant scan. Aeges runs read-only against your Microsoft 365 tenant. We map identity hygiene, DLP gaps, audit coverage, and the existing endpoint state.
- Week 1 — Hardening plan. A senior engineer walks the gap map with your team, agrees a phased configuration plan, and stages every change in a change-control document.
- Weeks 2–4 — Implementation. Identity, data, endpoint, audit and insider-risk controls configured in pilot rings, then rolled out tenant-wide. Each change is observed for at least 48 hours before locking in.
- Week 5 — Verification & handover. Re-run Aeges to verify the new posture, walk the runbook with your team, and hand over. We stay on-call for 30 days post-handover at no charge.
Outcomes
- A Conditional Access estate that survives a tenant-wide identity audit.
- DLP and sensitivity labels that actually classify and block — verified across SharePoint, OneDrive, Exchange, and Teams.
- Endpoint compliance enforced on every managed device — BitLocker, ASR, Defender, Intune baseline.
- A unified audit log with usable retention and alert policies on the operations that matter.
- Privileged access locked to PIM with scheduled reviews — no permanent admin sprawl.