The same security controls on every tenant
Most breaches we get called about are not clever. They are a missing MFA policy, an unmanaged laptop, or a mailbox rule nobody noticed. This is the floor we hold everyone to, not just the clients who asked.
-
Microsoft Defender for Endpoint P2
Mandatory on every managed device. Not an upsell, not optional.
-
Managed detection with a 24/7 SOC
Endpoint, identity and phishing-simulation coverage watched by humans overnight.
-
Attack surface reduction rules
The Microsoft hardening rules that block the macro and script tricks ransomware still relies on.
-
Conditional Access and enforced MFA
Including legacy authentication blocked, which is still the most common way accounts get taken.
-
Independent Microsoft 365 backup
Held outside your tenant, so a compromised admin account cannot delete your safety net.
How the baseline maps to the Essential Eight
The Australian Cyber Security Centre's Essential Eight is the reference most Australian businesses, insurers and auditors use. Several of its strategies are covered directly by the baseline:
- Multi-factor authentication: enforced for every user through Conditional Access.
- Patch applications and operating systems: scheduled through Intune, with compliance reporting.
- Configure Microsoft Office macro settings: attack surface reduction rules block the macro tricks ransomware relies on.
- Regular backups: independent Microsoft 365 backup, test-restored on a schedule.
Where a client needs a specific maturity level, for example for an insurer or a contract, we line up the remaining work as projects in our quarterly planning.
Beyond the baseline
App Control for Business lets only code your policy trusts run, which is the Essential Eight's application control strategy. It isn't switched on from day one. It is a longer process: we audit what runs on your devices, formulate a policy and work towards enforcing it over time. Defender for Endpoint P2 gives our security operations centre advanced hunting across 30 days of device data when it investigates an alert. Why we license P2 on top of Business Premium is explained in our Business Premium guide.
Check your own tenant
The Microsoft 365 tenant self-check asks 22 questions about these controls and sorts your answers into what to look at first. For the sign-in side, read our Conditional Access baseline.
Book a free tenant review.
Read-only, no obligation, and you keep the findings either way. We usually respond same day.