How to apply the Essential Eight to Microsoft 365 after a migration

Decide which maturity level you are aiming for and record why. Microsoft notes that ML2 is mandatory for certain non-corporate Commonwealth entities under the PSPF. Many businesses start at ML1.

List Windows devices, servers, Microsoft 365 services and third-party online services that hold your data. Onboard Windows devices to Intune and Defender for Endpoint so you can measure them. Compare the Intune device list with the Defender device inventory to find devices missing from either.

Several controls depend on licences such as Defender for Endpoint, Entra ID P1/P2 or Windows Enterprise. Check Microsoft's current licensing pages for your plan and record any gaps against each strategy.

Microsoft recommends Microsoft Purview Compliance Manager for ongoing monitoring, with Essential Eight templates at all three maturity levels. Create an assessment from the Essential Eight template for your target level.

Microsoft says ML1 can be achieved with AppLocker; ML2 and ML3 require Windows Defender Application Control (WDAC). Microsoft recommends WDAC where you can. For WDAC, Microsoft uses the Windows Defender App Control Wizard at https://webapp-wdac-wizard.azurewebsites.net/.

Microsoft suggests at minimum blocking C:\Windows\Temp, %USERPROFILE%\AppData\Local (with an exception for AppData\Local\Microsoft\WindowsApps) and %USERPROFILE%\AppData\Roaming. Prefer publisher or hash rules over path rules in user-writable locations.

Microsoft recommends the open-source AaronLocker project to generate AppLocker rules. Download it from GitHub, follow its README to scan the PC and build audit and enforce policies, then export the effective policy for your records.

Get-AppLockerPolicy -Effective -Xml | Out-File .\effective-applocker.xml

Deploy with Intune, Group Policy or PowerShell, starting in audit mode. In Intune, Microsoft uses a Custom profile with an OMA-URI setting: select Add under OMA-URI Settings, enter the OMA-URI for the policy, choose the data type and upload the policy file, then assign the profile to a pilot device group. For WDAC Microsoft gives the OMA-URI ./Vendor/MSFT/ApplicationControl/Policies/{PolicyID}/Policy with data type Base64 (File), where the GUID must match the policy's PolicyID. For AppLocker, use the AppLocker CSP that Microsoft links from the same page.

Forward AppLocker events to Microsoft Sentinel or query them with Defender for Endpoint advanced hunting before enforcing. Microsoft lists AppControlExecutableAudited (8003) and AppControlExecutableBlocked (8004) among the AppLocker action types.

DeviceEvents
| where ActionType startswith "AppControl"
| where Timestamp > ago(7d)
| project Timestamp, DeviceName, ActionType, FileName, FolderPath

Onboard devices to Defender for Endpoint. Microsoft Defender Vulnerability Management continuously monitors devices and keeps its vulnerability database current. Review the Recommendations page, and the Software inventory tab on each device page from the device inventory.

Microsoft says Office Click-to-Run and Edge update when Windows Update for Business or Autopatch is configured to update Windows and Microsoft products. Configure the rings in Strategy 6 so they include Microsoft product updates.

Scroll to Microsoft Intune connection and turn the toggle On, so remediation requests create Intune security tasks. To raise one, open a recommendation and select Remediation options. The Intune admin opens the security task and selects Accept.

Use Intune app deployment to uninstall unsupported apps: Microsoft says to change the app's assignment type to Uninstall. For unused online services, delete the Entra enterprise app, remove connectors and disable the service account.

Create a security group called All Office Users and another called Allow macro execution - Trusted Publisher for people with an approved business need. Add members to each.

Save ACSC Office Hardening Guidelines.json from Microsoft's Intune-ACSC-Windows-Hardening-Guidelines repository on GitHub (office/policies folder). Name the policy, select Browse for files under Policy file, choose the file and select Save. Assign it to All Office Users.

Microsoft notes the macro-blocking policy is not part of the policy set and must be imported separately. Save All Macros Disabled.json from the same repository folder, import it the same way, assign it to All Office Users and exclude Allow macro execution - Trusted Publisher.

Microsoft's ASR policy configures the ACSC-recommended rules in audit mode first. Microsoft deploys it by sending a POST request to https://graph.microsoft.com/beta/deviceManagement/templates/0e237410-1367-4844-bd7f-15fb0f08943b/createInstance with the body from ACSC Windows Hardening Guidelines-Attack Surface Reduction.json in the same repository, then assigning it to All Office Users. Test for compatibility before enforcing. To test one rule on a single device:

Add-MpPreference -AttackSurfaceReductionRules_Ids 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions AuditMode

Select Create Profile, review the configuration and assign it to a group. Microsoft says to deploy it together with the ACSC Microsoft Edge hardening policy.

Save ACSC Edge Hardening Guidelines.json from the edge/policies folder of Microsoft's Intune-ACSC-Windows-Hardening-Guidelines repository. Name the policy, select Browse for files, choose the file and select Save, then assign it. It includes the setting that blocks ads on sites with intrusive ads.

Search the settings picker for Disable Internet Explorer 11 as a standalone browser (User) (under Administrative Templates\Windows Components\Internet Explorer), set it to Enabled, and assign the policy. Microsoft notes IE11 is not present on Windows 11 and Java is not installed by default on Windows 10 or 11.

Policies deployed through Intune cannot be changed by standard users, which covers the "users cannot change settings" control. Check that managed settings cannot be changed.

ML1 requires requests for privileged access to be validated when first requested. Microsoft maps this to Entra entitlement management with approvers and time-limited access. On Requests, turn on Require approval and Require requestor justification and add approvers. On Lifecycle, set Access package assignments expire to a number of days. Select Create on Review + create.

Microsoft says highly privileged Entra ID, Azure and Microsoft 365 accounts should be cloud-only, not synced from AD, and should not have productivity licences such as mailboxes. Create admin accounts in the cloud (Microsoft suggests the onmicrosoft.com domain for emergency access accounts) and do not assign a licence that includes email.

Removing mail licences, a proxy allowlist for admin portals on privileged devices, or a host firewall are the measures Microsoft lists. Clear any licence that includes Exchange Online and save.

Microsoft recommends Conditional Access for administrators that requires MFA and a compliant Entra joined device, and blocks high sign-in and user risk. Target the admin directory roles under Users or workload identities, exclude your emergency access accounts, set Enable policy to Report-only and select Create. Turn it On after reviewing results. Risk-based blocking uses Entra ID Protection.

Microsoft's guidance says separate physical workstations are the most secure way to separate privileged and unprivileged environments. Record which admins use dedicated privileged devices.

Microsoft suggests 3 to 5 Windows Update for Business rings (test, pilot, fast, broad, critical) with deadlines and grace periods, managed in Intune. Enter a name, configure the deferral, deadline and grace period settings under Update ring settings, assign device groups under Assignments, and select Create. Microsoft's Essential Eight page gives suggested values for each ring.

Autopatch automates rings for you. Microsoft notes it requires Windows 10/11 Enterprise E3 or higher. Run the readiness assessment and fix what it reports, add admin contacts under Admin contacts, then add devices to the Windows Autopatch Device Registration group.

Use an Intune expedited quality update profile to meet 48-hour timeframes. Name it after the update being expedited, choose the quality update to expedite, set the days until a restart is enforced, and assign it to all applicable Windows devices. Microsoft notes a restart delay of 0 restarts devices immediately. Remove the policy once the update reaches all devices.

Unsupported operating systems must be replaced. List devices on unsupported versions and plan replacement or upgrade. See the Windows 10 end of support guide.

Microsoft says users should be prompted for MFA regardless of location, and Conditional Access policies for MFA should not exclude trusted locations such as the office network. Name the policy. Under Users or workload identities include All users and exclude only emergency access accounts (and Directory Synchronization Accounts if you sync). Under Target resources include All resources. Do not configure location exclusions. Under Grant choose Grant access and Require authentication strength. Set Enable policy to Report-only, select Create, then switch it to On after review.

Microsoft's ML1 page lists recommended methods including passkeys (FIDO2 security keys, Windows Hello for Business, passkeys in Microsoft Authenticator) and Authenticator passwordless sign-in. It lists SMS sign-in and email one-time passcodes as not permitted at ML1. Open SMS and Email OTP in the policy list and turn them off for users in scope, and enable the methods you will allow.

Configure Entra authentication methods and Conditional Access authentication strengths so only permitted methods satisfy MFA. Create a custom authentication strength that contains only the methods you allow, as Microsoft's custom authentication strength article describes, and select it in the policy from the previous step. Microsoft warns that external authentication methods are currently incompatible with authentication strength. Plan phishing-resistant methods now if you will move to ML2 or ML3.

Connect third-party SaaS that holds your data to Entra ID single sign-on so the same MFA policy applies, or turn on MFA in each service.

Create a retention policy and apply it to Exchange, SharePoint, OneDrive and Teams locations, choosing whether to retain, delete or both. Microsoft says no user can modify or delete retained copies in Microsoft 365.

SharePoint and OneDrive keep version history and support Restore your OneDrive and Restore this library to a point within the past 30 days. Select Restore your OneDrive or Restore this library, pick Yesterday, One week ago, Three weeks ago or Custom date and time, then Restore.

Use Azure Backup (or another backup product) for servers and Azure workloads, with role-based access to backups. Microsoft lists the Backup Contributor, Backup Operator and Backup Reader roles, and Resource Guard for extra protection. Microsoft also describes Microsoft 365 Backup, which keeps immutable backups within the Microsoft 365 boundary.

Microsoft lists Microsoft 365 DSC for capturing tenant configuration, so settings can be restored too. Follow its getting started guide to export your tenant configuration on a schedule.

Run and record restore tests as part of disaster recovery exercises, including restoring to a common point in time. Record what was restored, how long it took and who checked it.