---
name: IRAP Control Evidence
description: Produce control-by-control IRAP assessment evidence for in-scope Microsoft 365 security controls, read-only, mapped to the ISM.
---

# IRAP Control Evidence

> **TL;DR:** This skill inspects your Microsoft 365 tenant read-only and produces structured, control-by-control evidence that supports an IRAP assessment against the Australian Government Information Security Manual.

## What does control-by-control IRAP evidence for Microsoft 365 mean?

The Infosec Registered Assessors Program (IRAP) is the independent assessment process the Australian Cyber Security Centre uses to measure a system against the Information Security Manual (ISM). This skill gathers evidence from the modern Microsoft cloud, including Microsoft Entra ID, Exchange Online, Microsoft Teams, Microsoft Purview, and Microsoft Defender XDR, and presents each in-scope security control with its observed configuration. It is designed to give an IRAP assessor verifiable, current-state evidence rather than narrative claims.

## When should you run this skill?

- "We have an IRAP assessment booked and need evidence for our Microsoft 365 controls."
- "Show me which ISM controls our tenant configuration currently satisfies."
- "Prepare control-by-control evidence before our assessor arrives."
- "Map our Microsoft Purview and Microsoft Entra settings to the ISM."
- "We are seeking authorisation to operate at the OFFICIAL: Sensitive or PROTECTED level."
- "Refresh our IRAP evidence pack ahead of the annual reassessment."
- "Identify gaps between our tenant and the in-scope IRAP controls."

## How this skill works, step by step

1. Confirm the assessment scope and target classification level, then enumerate the in-scope Microsoft 365 controls to be evidenced.
2. Read Microsoft Entra ID configuration, including Conditional Access policies, authentication methods, and multifactor authentication coverage.
3. Inspect Exchange Online and Microsoft Teams settings relevant to data handling, external sharing, and transport security.
4. Read Microsoft Purview configuration for sensitivity labels, data loss prevention policies, and audit logging.
5. Inspect Microsoft Defender XDR and Microsoft Defender for Cloud Apps posture for threat protection and monitoring controls.
6. Record the observed value, the mapped ISM control identifier, and the source of each evidence item.
7. Compare each observed value against the expected configuration for the target classification level.
8. Derive a per-control risk score from the gap between observed and expected state, the control's maturity weighting, and its exposure (for example, an unmet phishing-resistant MFA control scores higher risk than a cosmetic gap).
9. Compile the findings into a control-by-control evidence table with an overall residual risk summary.

## Output format

The skill emits one row per in-scope control, mapping the observed configuration to its ISM control identifier with a derived risk rating.

| ISM control | Microsoft 365 source | Observed state | Expected (target level) | Evidence status | Risk |
| --- | --- | --- | --- | --- | --- |
| ISM-1680 | Microsoft Entra Conditional Access | MFA enforced for all users | MFA enforced for all users | Met | Low |
| ISM-1682 | Microsoft Entra authentication strengths | Password plus SMS permitted | Phishing-resistant MFA required | Not met | High |
| ISM-1683 | Microsoft Entra sign-in logs | Sign-in events centrally logged | Events centrally logged | Met | Low |

A short summary accompanies the table:

- Total in-scope controls evidenced and the count Met, Partially met, and Not met.
- The highest residual risk controls requiring remediation before authorisation.
- The target classification level the evidence was assessed against.
- A note on any control that could not be evidenced read-only and needs manual attestation.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Conditional Access and authentication strengths | Microsoft Entra ID P1 |
| Sensitivity labels and data loss prevention evidence | Microsoft 365 E3 |
| Advanced audit and long-term log retention | Microsoft 365 E5 or Microsoft Purview Audit (Premium) |
| Microsoft Defender XDR posture evidence | Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 |

### Least-privilege roles

- Global Reader
- Security Reader

### Microsoft Graph permissions (read-only)

- `Policy.Read.All` — reads Conditional Access and authentication method policies.
- `AuditLog.Read.All` — reads sign-in and directory audit logs as evidence.
- `Directory.Read.All` — reads users, groups, and role assignments for access control evidence.
- `InformationProtectionPolicy.Read.All` — reads published sensitivity label configuration.
- Microsoft Purview data loss prevention policy detail and Defender XDR secure score are read through the Microsoft Purview and Microsoft Defender portals or their PowerShell modules rather than a dedicated Microsoft Graph read scope.

## Scope and safety

This skill is read-only by default and changes no tenant configuration.

This skill does NOT:

- Modify, create, or delete any policy, label, role, or setting.
- Issue or grant an IRAP authorisation; only an endorsed IRAP assessor can assess controls.
- Export or copy customer content or message bodies; it reads configuration metadata only.
- Evaluate on-premises or non-Microsoft systems outside the Microsoft 365 tenant.

## Sources and compliance

- [Infosec Registered Assessors Program (IRAP)](https://www.cyber.gov.au/resources-business-and-government/asds-cyber-security-frameworks/irap) — the ACSC programme this evidence supports.
- [Microsoft IRAP overview](https://learn.microsoft.com/en-us/compliance/anz/irap-overview) — Microsoft guidance on IRAP for the modern cloud.
- Maps to the Essential Eight control Multifactor Authentication and to ISM controls including ISM-1680, ISM-1682, and ISM-1683 where genuine to the evidenced configuration.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model) — maturity reference used for control weighting.
- Output in Australian English.