Can Microsoft 365 and Intune meet the Essential Eight on their own?
If a customer, contract or regulator now asks for Essential Eight evidence and your estate runs on Microsoft 365, Intune, Entra ID and Defender, the honest answer is that Microsoft tooling covers much of the technical work for each strategy, but the organization still owns its controls. An independent assessor, not Microsoft and not your implementation partner, is the only party that reaches a conclusion about your maturity. The Essential Eight is a set of mitigations rather than a certification scheme, and there is no ASD certificate to point to. Microsoft describes its Essential Eight guides as Consumer Guidance to be read alongside its IRAP assessment reports, which tells you where the product documentation stops and your own evidence begins.
Whether the tools are enough depends on three variables: the maturity level you are targeting, the licensing tier you hold, and how much of the estate is cloud-managed. A Maturity Level One target on a fully Intune-enrolled fleet asks very different questions from a Maturity Level Three target that includes servers, on-premises Active Directory and third-party software. Confirm your licensing against the Essential Eight license map on the Microsoft 365 License Maps portal, remembering that Microsoft notes it is a community project by Microsoft employees and not an official Microsoft document. Then check each strategy's requirements in ASD's Essential Eight Maturity Model rather than relying on a product page.
Before you commit budget, ask a practical question of each team: which control is configured by a tool, which is operated by a person, and which exists only as a policy document. Gaps between those three usually decide whether an assessor accepts the evidence. An implementation partner can configure the Microsoft estate and assemble the evidence set, but the decision on what you claim, and the assessment itself, remain with you and an independent assessor.
Which Microsoft tools map to each Essential Eight strategy
This table pairs each Essential Eight strategy covered by Microsoft's guidance with the Microsoft tool it cites, the maturity level that citation applies to, and the evidence your organization must still produce. Microsoft's guides are point-in-time references, so the right-hand column matters as much as the tool name. The Microsoft licence map is a community project by Microsoft employees, not an official document, so confirm entitlements with your Microsoft account team before purchasing.
| Strategy | Microsoft tool cited | Maturity level cited | Still to prove |
|---|---|---|---|
| Application control | AppLocker | ML1 | Approved execution set, user profiles in scope, and logs of allowed and blocked events |
| Application control | Windows Defender Application Control (WDAC) | ML2 and ML3 | Policy deployment and enforcement status, driver control, and exception approvals |
| Multi-factor authentication | Entra phishing-resistant authentication methods | ML2 and ML3 | Enrollment coverage for in-scope users, identity verification before issuing credentials, and MFA event logs |
| Patch operating systems | Windows Update for Business expedited deployment | Internet-facing critical patches (ISM-1877) | Patch timing records against the 48-hour requirement and evidence of exceptions |
| Patch operating systems | Intune driver and firmware deployment | ML3 | Driver and firmware deployment status and records meeting ML3 deadlines |
| Restrict administrative privileges | Entra Privileged Identity Management (PIM) for just-in-time access | ML2 and ML3 (ISM-1508, ISM-1883) | Approval records, activation logs, and periodic review of privileged role assignments |
| Restrict administrative privileges | Cloud-only accounts for high-privilege Entra, Azure and Microsoft 365 roles | Per Microsoft's privileged access guidance | Inventory of privileged accounts showing none are synchronized from on-premises Active Directory |
| Regular backups | In-place retention policies and labels in Microsoft 365 | Per Microsoft's backup guidance | Your own backup scope, retention settings, and restore tests, since Microsoft retains shared responsibility for your data |
How licensing changes the Microsoft answer
The Microsoft tools that implement each Essential Eight strategy are not all included in the same licence tier, so the licence you hold can decide which maturity level is practical. The cards below cover the licence-sensitive components and the checks to run before you commit to a target level.
Start with the license map
Microsoft points to an Essential Eight license map on the Microsoft 365 License Maps portal that summarises the licences and tools needed across maturity levels. Use it to build a shortlist of components to check, not as a final answer. Microsoft notes that the maps are a community project by Microsoft employees and are not official Microsoft documents. Record the map version and date you used, so your evidence trail shows where your starting assumptions came from.
Application control tooling by level
Microsoft's guidance says Maturity Level 1 can be achieved with AppLocker, while Maturity Levels 2 and 3 require Windows Defender Application Control (WDAC) because of the additional ISM requirements. Confirm with your Microsoft licensing contact which Windows edition and management tooling your devices hold before you design rules. A level target that depends on WDAC should be checked against every device class in scope, including servers and any unmanaged endpoints.
Privileged access and PIM entitlements
Microsoft's guidance uses Microsoft Entra Privileged Identity Management (PIM) for time-bound, just-in-time access to meet ISM-1508 and ISM-1883. PIM capability depends on the Entra ID licence assigned to the users and administrators it governs, so an administrator without the right entitlement may still hold standing privilege. Ask for a written statement of which licence covers the eligible roles in your tenant, and confirm it covers the cloud-only accounts Microsoft recommends for high-privilege roles.
Intune and update management scope
Windows Update for Business expedited deployment, Configuration Manager deadlines and Intune driver and firmware deployment all sit inside licensed management products. Check which of these your tenant includes, and whether the licence covers every device type that falls under your patch deadlines. Where a device is outside Intune, confirm which tool will evidence its patch state, since a gap in management coverage becomes a gap in the Essential Eight evidence.
Defender and Purview monitoring
Microsoft recommends Microsoft Purview Compliance Manager, which offers Essential Eight premium templates for all three maturity levels, to monitor for compliance and configuration drift. Premium templates and the Defender features that feed them may depend on your Microsoft 365 or security add-on licences. Ask for written confirmation of which template and data sources your tenant can use before you rely on Compliance Manager scores in an assessment.
Get a written entitlement check
Ask your Microsoft account team or licensing partner for a written entitlement check that maps each Essential Eight component you plan to use to the licence it requires in your tenant. Include the target maturity level, the device and identity counts in scope, and any government or sovereign cloud constraints. Keep the answer with your assessment evidence. Licence terms change, so repeat the check when you renew or change the target level.
Cloud-only, hybrid and on-premises estates
A cloud-only tenant manages identities in Entra ID and devices through Intune, so most privileged access and device patching controls can be configured in one management plane. Microsoft's restrict administrative privileges guidance recommends cloud-only accounts rather than accounts synchronised from on-premises Active Directory for high-privilege Entra ID, Azure and Microsoft 365 roles, because the on-premises directory then sits outside the tenant's privileged access path. Microsoft's Essential Eight guidance pairs this with Entra Privileged Identity Management for time-bound, just-in-time access.
- Cloud-only admin accounts: Create separate, cloud-only accounts for high-privilege roles and keep them out of the synchronised directory.
- Just-in-time elevation: Configure Entra PIM so privileged roles are activated for a limited period with approval or justification.
- Intune device baselines: Use Intune to enforce update rings, expedited updates and application control policies on managed endpoints.
- Common gaps: Break-glass accounts, service principals and legacy automation often keep standing privilege that PIM does not see.
- Unmanaged devices: Devices outside Intune enrolment can still reach Microsoft 365, so access conditions need to be checked.
Before relying on this model, confirm which roles, service principals and emergency accounts exist in the tenant and whether each one is covered by PIM or a documented exception.
In a hybrid estate, Active Directory on-premises still holds user accounts, group memberships or devices that synchronise to Entra ID. Microsoft's guidance recognises that high-privilege roles should move to cloud-only accounts, but many organizations keep synchronised accounts for day-to-day work, file shares and legacy applications. The assessor will look for a clear boundary between the two directories and evidence that the on-premises estate cannot quietly grant cloud administrative rights.
- Privileged tiers: Separate on-premises domain administrator accounts from cloud roles and restrict where they can sign in.
- Sync scope: Document which objects synchronise and confirm that privileged groups are excluded or monitored.
- Patching across both sides: Windows Update for Business and Intune cover cloud-managed devices, while Configuration Manager often handles servers and devices still tied to the domain.
- Common gaps: Synchronised administrator accounts, stale on-premises admin groups and servers patched on a different calendar from workstations.
- Evidence: Export sync configuration, role assignments and patch compliance reports from both management planes.
Confirm with your own environment which management tool owns each device class and whether the Configuration Manager deadlines match the Essential Eight maturity level you are targeting.
Some estates keep on-premises servers that Intune does not manage, such as database hosts, line-of-business applications and infrastructure appliances. Microsoft's patch operating systems guidance describes Configuration Manager deadlines and 14-day scans for workstations and internal servers, which means the organization must run and report that tooling itself. Where Configuration Manager is absent, the scanning cadence, patch deadlines and privileged access controls need to be implemented and evidenced by other means.
- Scanning cadence: Schedule scans at the interval the maturity level requires and keep the results as dated evidence.
- Deadline tracking: Record when each critical patch was released, when it was due and when it was applied.
- Privileged access to servers: Use separate administrative accounts, restrict interactive logon and log administrative sessions.
- Application control gaps: Servers often need their own WDAC or AppLocker policies, and these are not applied automatically by cloud policy.
- Unsupported systems: Identify any operating systems that have reached end of support and plan their replacement or isolation.
Ask the implementation partner or internal team to produce an inventory of on-premises servers and confirm which tool, owner and evidence source applies to each one.
Using Purview Compliance Manager for continuous monitoring
Microsoft describes Essential Eight assessment and remediation with its guides as a point-in-time activity, and it recommends Microsoft Purview Compliance Manager to watch for compliance and configuration drift between those points. Compliance Manager offers Essential Eight premium assessment templates for all three maturity levels, so the tenant can be scored against the controls for the level you are targeting. Treat that score as a monitoring signal only. A template score shows how the configuration and recorded evidence in Microsoft 365 compare with the template's improvement actions. It does not show that a strategy is implemented or effective against the maturity model, and it does not replace an independent assessment of your environment, your processes or your Windows and Intune settings outside what the template can read.
Before you enable the templates, decide who owns the signal. Name an accountable owner for the Essential Eight assessment in Compliance Manager, a reviewer for changes in the score, and a cadence for that review. Confirm with your Microsoft account team and in your own tenant which improvement actions the template marks as automated, which need manual evidence upload, and which cannot be assessed from Microsoft 365 at all. The gaps you find will usually be process controls, such as who approves privileged role activations or how exceptions are granted, and those need owners outside the security team.
Document every exception. When a control is intentionally not met, record the justification, the compensating measure, the approver, the review date and the expiry. Keep that record with the Compliance Manager export so an assessor can see that a drop in score was a decision rather than an unnoticed drift. Ask your implementation partner to set up the review workflow and evidence register, but make clear in the written scope that the organization approves exceptions and that only an independent assessor can issue an assessment conclusion.
How the Microsoft-based implementation and assessment runs
The sequence moves an organization from a chosen maturity level and confirmed licences to a set of configuration and log evidence that an independent assessor can test. Each phase produces a named output, so the next phase starts from something verifiable.
Confirm target maturity level and licences
The organization's leadership and security owners choose the Essential Eight maturity level they will assess against, then check which Microsoft 365 and Windows licences that level requires using the community-maintained Essential Eight license map, which Microsoft notes is not an official Microsoft document. Confirm each licence against the Microsoft 365 agreement and reseller terms, because the map is a planning aid. The output is a signed scope note listing target levels per strategy, the licence inventory and any gaps to close before work starts.
Map each strategy to Microsoft guidance
Engineers and the implementation partner, if one is engaged, read Microsoft's Essential Eight guidance on Microsoft Learn for each of the eight strategies and record which tool implements which ISM control at the chosen level. Application control, MFA, OS patching, privileged access and backups each have their own Microsoft page, so the mapping is done strategy by strategy. The output is a control-to-tool matrix that names the owner, configuration target and tool for every control in scope, and that the assessor can trace.
Implement each strategy in the Microsoft tenant
Administrators configure Intune, Entra ID, Defender, WDAC or AppLocker, Windows Update for Business and Microsoft 365 retention settings according to the matrix. Changes should be made through managed configuration, not one-off portal edits, so that the settings can be exported and compared later. Where a strategy depends on organizational process, such as approval of new applications or admin account requests, the process is written down at the same time. The output is a configured tenant, a change record for each setting and a short process document per strategy.
Validate configuration and test effectiveness
Before evidence is collected, the team tests whether each control works as intended. Examples include attempting to run an unapproved executable, sign in with a method that should be blocked, or restore a sample backup. Test results are recorded with the date, tester and outcome, including failures and the fixes applied. The output is a test log that shows each control was tried, not only switched on, which matters because the maturity model assesses effectiveness as well as implementation.
Collect configuration and log evidence
The team exports configuration baselines, policy assignments, Entra sign-in and audit logs, privileged role activation records, WDAC or AppLocker event logs, patch compliance reports and backup job histories for the assessment period. Evidence is stored in a location with access controls and retention that the assessor can reach. Ask the assessor which artifact formats they accept before export begins. The output is an evidence index that maps each artifact to the ISM control it supports and states the period it covers.
Enable Purview templates for ongoing monitoring
Microsoft recommends Microsoft Purview Compliance Manager to monitor for compliance and configuration drift after the point-in-time assessment. The team enables the Essential Eight premium templates for the chosen maturity level, assigns improvement actions to owners and confirms that the assessments reflect the configured tenant. Confirm with Microsoft or the licence reseller which Purview features apply to the organization's agreement. The output is a live compliance assessment with named owners for each open action and a routine for reviewing drift.
Hand the evidence to an independent assessor
The organization, supported by the implementation partner, gives the evidence index, test log, process documents and Purview assessment to an independent assessor. The assessor, not the partner, decides whether each strategy meets the chosen maturity level and issues any written report. Microsoft's IRAP assessment reports are referenced alongside this work but do not replace the organization's own assessment. The output is the assessor's findings, any remediation list the organization must close, and the scope the assessor tested.
What must be in place before an assessment
An assessor samples evidence, not intentions, so readiness means the records exist, match the live tenant and cover the period under review. The six checks below connect the Microsoft 365 and Intune estate to the Essential Eight strategies, and each one can be checked by you before an outside assessor arrives.
Identity and device inventory
Export the user, device and guest account lists from Entra ID and Intune, then compare them with your HR and asset records. Confirm that every device that can reach Microsoft 365 is enrolled or explicitly excluded, and that stale accounts and devices are disabled or retired. Assessors use this inventory to choose samples for patching, MFA and application control, so gaps here delay everything else. Ask whether the export can be reproduced on a given date.
Privileged account register
List every account that holds an Entra ID, Azure or Microsoft 365 administrative role, including break-glass accounts, service accounts and any account synchronised from on-premises Active Directory. Record which accounts are cloud-only, which are eligible for Privileged Identity Management and which are permanently assigned. Microsoft recommends cloud-only accounts for high-privilege roles, so any synchronised admin account needs a documented reason. Check the register against role assignments in the portal, not against your memory of who should have access.
Documented exceptions
Record every control that is not met as written, with the affected devices or accounts, the compensating measure, the approver and a review date. Typical examples include a legacy line-of-business application that cannot be managed by WDAC or a device that cannot receive the latest update. Assessors treat undocumented gaps as failures, while a dated, approved exception shows that risk was accepted deliberately. Confirm who has authority to accept each risk before the assessment begins.
Reviewed Entra and Intune configuration
Export the Conditional Access policies, authentication method settings, Intune compliance and configuration profiles, and Windows Update for Business rings. Review each against the maturity level you are targeting and sign off the review with a date and reviewer name. Settings changed without a change record are a common cause of drift between what a team describes and what the tenant enforces. Compare the exports at the start and end of the review period to show that changes were tracked.
Retained logs for the sample period
Confirm that sign-in, audit, Intune device and Defender logs are retained for at least the period the assessor will sample, and that someone can export them without relying on the portal's default view. Check your retention settings and any export to a SIEM or storage account, because default retention may be shorter than the review window. Test one export end to end before the assessment. Logs that have already rolled off cannot be recovered, and assessors may ask for evidence from months earlier.
Named owner for each strategy
Assign one accountable person to each of the eight strategies, with a deputy who can answer questions during sampling. The owner should be able to show the current implementation, the last test or review, and the open exceptions for their strategy without help from a consultant. Record the owners in your governance register with the date of assignment. Assessors often interview owners, and a strategy with no clear owner usually produces weaker evidence even when the technical controls are sound.
Who owns the controls, who prepares evidence and who assesses
The organization owns its Essential Eight posture. It decides which maturity level it targets, runs its Microsoft 365 tenant and Intune environment day to day, and remains accountable for every control, whether a partner configured it or not. Microsoft's guidance is written for advisers, assessors and decision makers, so the internal team still has to read it, apply it to its own tenant and make the calls that the guidance leaves open.
- Target level and scope: Choosing ML1, ML2 or ML3 per strategy, and deciding which tenants, devices and user groups fall in scope.
- Tenant operations: Administering Entra ID, Intune, Defender and Purview, and reviewing changes made to them.
- Exception approval: Approving, time-limiting and recording any deviation from a control, with a named risk owner.
- Recurring work: Running patch cycles, access reviews, backup restore tests and monitoring for configuration drift.
- Licensing decisions: Confirming which Microsoft 365 and Entra licences the organization holds and whether they cover the tools each level requires.
Before engaging anyone, confirm internally who owns each Essential Eight strategy and who will sign the exception register.
An implementation partner such as DeployOpen works inside the organization's environment to prepare systems and evidence. Under a written, fixed scope, the partner can configure Intune policies, set up WDAC or AppLocker, build Entra authentication and PIM settings, document each configuration and help upgrade the setup as Microsoft changes its products. The partner does not own the controls, does not approve exceptions and does not decide that a control is effective.
- Configuration: Building and testing policies, rule sets, conditional access and backup settings in the client's tenant.
- Evidence preparation: Exporting configurations, recording settings and organizing screenshots, logs and reports for the assessor.
- Documentation: Writing the runbooks, change records and mapping notes the organization needs to operate the controls.
- Upgrades and support: Re-validating settings after Microsoft updates, under a retainer if the client chooses ongoing support.
- Limits: DeployOpen does not issue audit reports, attestations or certificates, and hiring it does not guarantee a maturity result.
Ask the partner to state in writing which deliverables are configurations and documents, and which decisions remain with you.
The independent assessor tests the implemented controls against the maturity model and records what it finds. This is the only role that can issue a conclusion about maturity. Depending on the engagement, the assessor might be an external auditor, a firm with assessment experience, or an internal function that is independent of the people who built the controls. Organizations should confirm with the assessor what it will accept as evidence before the build starts.
- Independence: The assessor should not have designed or configured the controls it tests.
- Testing: Sampling settings, reviewing logs, checking restore tests and interviewing staff against the stated level.
- Findings: Recording gaps, exceptions and effectiveness conclusions in its own report.
- Evidence standards: Agreeing with the assessor how long logs must be retained and which exports it will accept.
- Conclusions: Only the assessor, not the partner or the vendor, states whether a level has been met.
Confirm the assessor's scope, reporting format and independence in writing before the assessment begins.
Questions buyers ask about Essential Eight on Microsoft 365
Is Microsoft 365 alone enough to meet the Essential Eight?
No. Microsoft 365 and Intune cover a large share of the technical work, but Microsoft 365 is a set of services, not a complete implementation of the eight strategies. Microsoft's own guidance for each strategy describes Microsoft tools that help, and it is positioned as consumer guidance to be read alongside Microsoft's IRAP assessment reports. Your organization still has to define the policies, run the patch and backup processes, operate the admin model, and produce evidence that each strategy works at the level you target. Some strategies, such as regular backups of Microsoft 365 data, carry your own responsibility under the shared responsibility model. Confirm with your assessor which tools and processes they will accept as evidence for each strategy before you rely on a configuration.
Is AppLocker acceptable for Essential Eight application control at ML2?
Usually not. Microsoft's application control guidance says Maturity Level 1 can be achieved with AppLocker, while Maturity Levels 2 and 3 require Windows Defender Application Control (WDAC) because of the additional ISM requirements. Plan for WDAC policies at ML2 and treat any AppLocker deployment as a stepping stone. Ask your assessor to confirm how they will test driver control, blocklists and logging of allowed and blocked events at your target level, since those are where tooling differences matter most.
What licensing gaps usually surface when planning Essential Eight on Microsoft 365?
The gaps usually appear when teams map required features to the licenses they already hold. Common areas to check include Intune device management, Entra ID features used for phishing-resistant authentication and privileged access, Entra Privileged Identity Management for just-in-time access, Purview Compliance Manager, and Defender tooling for vulnerability scanning. Microsoft points to an Essential Eight license map on the Microsoft 365 License Maps portal, but Microsoft notes that the maps are a community project by Microsoft employees, not official Microsoft documents. Use the map as a starting list, then confirm each feature against current Microsoft licensing terms with your Microsoft account team or reseller before committing budget.
Can our internal team implement the Essential Eight on Microsoft 365 without outside help?
Often yes, if you already run Intune, Entra ID and Defender in production and have people who can write and test policy. The work tends to stall in three places: documenting the processes that the controls depend on, collecting consistent evidence over time, and keeping configuration from drifting after the first assessment. Microsoft describes its assessment and remediation guides as a point-in-time activity and recommends Purview Compliance Manager, which offers Essential Eight premium templates for all three maturity levels, to monitor for compliance and configuration drift. An implementation partner can prepare systems and evidence under a written scope, but only an independent assessor issues a conclusion on maturity. Decide early which parts your team owns and which you want to hand off.
How long does Essential Eight work on Microsoft 365 take, and what does it need from staff?
No supplied figure sets a duration, so estimate from your environment rather than from a generic number. Duration depends on the target maturity level, the number of tenants and devices, how mature your existing Intune and Entra configuration is, and how many process owners must agree on patch deadlines, admin access and backup retention. Staff time usually falls on identity and endpoint engineers, Microsoft 365 administrators, security operations, and the owners of change management and backup. Ask any provider for a written scope that lists the tenants, device groups, applications and processes in scope, the deliverables for each strategy, and the named roles you must provide.
Which Microsoft tools should we ask a consultant to explain in a quote?
Ask for each Microsoft tool named against the Essential Eight strategy it supports. For example, a quote should state how WDAC policies, Windows Update for Business rings, Entra phishing-resistant authentication methods, Entra PIM for just-in-time access, LAPS, and Microsoft 365 retention policies and labels are configured, and which parts remain with your team. Also ask which Microsoft licenses the design assumes, who confirms them, and how drift will be monitored after handover. A useful quote separates one-time design and build work from recurring monitoring, patch review and evidence collection.
How DeployOpen scopes Essential Eight work in Microsoft environments
DeployOpen plans, implements and documents Essential Eight controls inside your own Microsoft 365 and Intune estate, working from a written scope agreed before work starts. We prepare configurations, policies and evidence for assessment, while your organization owns its controls and an independent assessor makes any determination of maturity.
How we scope
- Confirm the target maturity level for each of the eight strategies before configuration begins.
- Inventory Microsoft 365 licensing, Entra ID tenant setup, Intune enrollment and Defender coverage against the licence map Microsoft references.
- Record in writing which strategies, tenants, device groups and admin roles are in scope and which remain with your team.
How we build
- Configure Intune policies, WDAC or AppLocker rules, and Windows Update for Business rings to match the agreed level.
- Set up Entra ID authentication methods, conditional access and Privileged Identity Management for the privileged roles in scope.
- Test each control on pilot devices and accounts, then record the results alongside the configuration that produced them.
How we hand over
- Deliver configuration exports, runbooks and an evidence map that ties each control to the Microsoft tool that produces it.
- Document the recurring tasks your staff must perform, such as reviewing access reviews and patch compliance reports.
- Walk your security and compliance teams through the Purview Compliance Manager templates so they can monitor drift after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work closes.
- Retainers can cover Intune policy updates when Microsoft changes guidance, and periodic checks for configuration drift.
- Any assessment of maturity is performed by an independent assessor, which DeployOpen can help you prepare for but does not replace.
