---
name: Essential Eight Maturity Self-Assessment
description: Self-assess your Microsoft 365 tenant against all eight ASD Essential Eight strategies and produce a maturity scorecard with evidence pointers.
---

# Essential Eight Maturity Self-Assessment

> **TL;DR:** This skill inspects your Microsoft 365 tenant read-only and scores each of the eight ASD Essential Eight mitigation strategies against Maturity Levels 1 to 3, with evidence pointers for each finding.

## How does the Essential Eight map to Microsoft 365?

The Essential Eight is the Australian Signals Directorate (ASD) baseline of eight mitigation strategies that organisations implement to harden against common cyber threats. In a modern cloud tenant, most controls are evidenced through Microsoft Entra ID, Microsoft Intune, Microsoft Defender for Endpoint, Microsoft Defender Vulnerability Management, and Microsoft Purview. This skill reads configuration signals from those services and aligns them to the published ASD maturity levels and the matching ISM controls.

## When should you run this skill?

- "Where do we sit against the Essential Eight right now?"
- "Give me an Essential Eight scorecard before our security audit."
- "Which Essential Eight strategies are below Maturity Level 2?"
- "We are a Commonwealth entity and need evidence for our PSPF reporting."
- "Show me the gaps in our patching and MFA posture against the ASD baseline."
- "Produce a board-ready maturity summary across all eight strategies."
- "What evidence backs each Essential Eight rating in our tenant?"

## How this skill works, step by step

1. Confirm read-only access to Microsoft Entra ID, Microsoft Intune, and the Microsoft Defender portal for the target tenant.
2. Inspect multifactor authentication coverage and authentication strengths in Microsoft Entra Conditional Access for the MFA strategy.
3. Read Microsoft Intune application control, Attack Surface Reduction, and update ring configurations for application control, user application hardening, and patch operating systems.
4. Query Microsoft Defender Vulnerability Management for missing patches across applications and operating systems to score the two patching strategies.
5. Review Microsoft 365 and Microsoft Defender macro and Office hardening settings for the configure Office macro settings strategy.
6. Inspect Microsoft Entra Privileged Identity Management role assignments and just-in-time configuration for restrict administrative privileges.
7. Read backup and retention configuration signals for the regular backups strategy.
8. Map each observed signal to the relevant ISM control and ASD Maturity Level (1, 2, or 3).
9. Derive a per-strategy rating: assign the highest maturity level for which all required controls are evidenced, default to Level 0 when a required control is absent, and record an evidence pointer for every rating.

## Output format

The skill returns one row per Essential Eight strategy with its assessed maturity level and an evidence pointer.

| Strategy | Target ML | Assessed ML | Evidence pointer |
| --- | --- | --- | --- |
| Multifactor authentication | 2 | 2 | Conditional Access policy "Require MFA" enforces phishing-resistant strength for all users |
| Patch applications | 2 | 1 | Defender Vulnerability Management shows 14 apps with patches older than 2 weeks |
| Restrict administrative privileges | 2 | 0 | No Microsoft Entra PIM just-in-time activation configured for Global Administrator |

Summary bullets accompany the table:

- Overall posture expressed as the lowest assessed maturity level across all eight strategies.
- Count of strategies meeting, exceeding, or falling below the target maturity level.
- Highest-priority gaps ranked by maturity shortfall and mapped ISM control.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Conditional Access and authentication strengths | Microsoft Entra ID P1 |
| Privileged Identity Management evidence | Microsoft Entra ID P2 |
| Device application control and ASR configuration | Microsoft Intune Plan 1 |
| Vulnerability and patch signals | Microsoft Defender for Endpoint Plan 2 (or Defender Vulnerability Management add-on) |
| Continuous compliance monitoring | Microsoft Purview Compliance Manager (premium templates) |

### Least-privilege roles

- Global Reader (read-only across Microsoft Entra and Microsoft 365 configuration)
- Security Reader (read-only Microsoft Defender and Conditional Access posture)
- Intune Read Only Operator (read-only device configuration and compliance)

### Microsoft Graph permissions (read-only)

- `Policy.Read.All` — reads Conditional Access policies and authentication method configuration.
- `RoleManagement.Read.Directory` — reads privileged role assignments and PIM eligibility.
- `DeviceManagementConfiguration.Read.All` — reads Intune application control, ASR, and update ring settings.
- `DeviceManagementManagedDevices.Read.All` — reads device compliance and patch state.
- Microsoft Defender Vulnerability Management findings are read via the Microsoft Defender portal or the security Graph; some signals are reviewed in the portal rather than through a Graph scope.

## Scope and safety

This skill is read-only by default and makes no changes to tenant configuration, policies, or device state.

This skill does NOT:

- Modify, create, or remove any Conditional Access policy, role assignment, or Intune configuration.
- Deploy patches, enforce application control, or change macro settings.
- Export user content, mailbox data, or personal information.
- Grant, elevate, or activate any privileged role.

## Sources and compliance

- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model) — defines the eight strategies and Maturity Levels 1 to 3 used for scoring.
- [ACSC Essential Eight on Microsoft Learn](https://learn.microsoft.com/en-us/compliance/anz/e8-overview) — maps each strategy to Microsoft 365 controls and ISM controls.
- Maps to the eight ASD mitigation strategies and their associated ISM controls (for example, ISM-1657 application control, ISM-1667 to ISM-1669 user application hardening, ISM-1883 restrict administrative privileges).
- Output in Australian English.