Essential Eight (Australia): Fabrikam Dental Group ================================================== Prepared 14 October 2026 by Harbour IT. Microsoft 365 data from 13 Oct 2026. Not ready. Fabrikam Dental Group has 3 controls to fix before reaching Maturity Level One. Controls: 1 Pass, 3 Fail, 4 Your evidence FIX THESE FIRST 5 Restrict administrative privileges - 1 guest with admin roles. - g#EXT#@fabrikam.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. 6 Patch operating systems - 36 of 54 Windows computers past end of support. - LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 31 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. 7 Multi-factor authentication - Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. - breakglass@fabrikam.example: Excluded from "CA002 — All users: Require MFA" - 1 admin not covered by MFA. - breakglass@fabrikam.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block - Legacy authentication is allowed. - No enabled policy blocks legacy authentication for all users Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. PREVENT MALWARE RUNNING (YOUR EVIDENCE) 1 Application control Verdict: Your evidence Requirement: Only approved programs, scripts and installers can run on workstations, including from user folders. Text to paste: Application control ([App Control for Business, AppLocker or product]) lets only approved programs, scripts and installers run on [workstations and servers], including from user profile and temporary folders. Blocked attempts are logged and reviewed by [team]. What Microsoft 365 can't show: All of this. Answer from Intune, Group Policy or the tool that sets it. 2 Patch applications Verdict: Your evidence Requirement: Internet-facing services, browsers, Office, PDF software and email clients are patched promptly, and unsupported applications are removed. Text to paste: Applications update automatically where they can (Microsoft 365 Apps, web browsers and [other software]). Updates that can't install automatically are applied within 14 days of release by [process or tool]. What Microsoft 365 can't show: All of this. Answer from Intune, Group Policy or the tool that sets it. 3 Configure Microsoft Office macro settings Verdict: Your evidence Requirement: Macros are blocked for users who don't need them, macros from the internet are blocked, and users can't change the settings. Text to paste: Microsoft Office macros are [blocked for all users, or allowed only for (group) from trusted locations or signed by a trusted publisher], macros in files from the internet are blocked, and users can't change these settings. This is set by [Intune or Group Policy]. What Microsoft 365 can't show: All of this. Answer from Intune, Group Policy or the tool that sets it. 4 User application hardening Verdict: Your evidence Requirement: Browsers don't process Java or ads from the internet, and users can't change browser security settings. Text to paste: Web browsers block Java and web advertisements from the internet and don't process them, Microsoft Office blocks OLE packages, PowerShell 2.0 is removed, and users can't change these settings. This is set by [Intune or Group Policy]. What Microsoft 365 can't show: All of this. Answer from Intune, Group Policy or the tool that sets it. LIMIT THE EXTENT OF INCIDENTS (FAIL) 5 Restrict administrative privileges Verdict: Fail Requirement: Privileged access is validated when first asked for, limited to what's needed, held by separate accounts that don't read email or browse the web, and removed when it's no longer needed. - 2 Global Administrators. - Cloud-only tenant: no accounts are synced from on-premises AD. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 - 1 guest with admin roles. - g#EXT#@fabrikam.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. Text to paste: Most administrator accounts are separate from day-to-day accounts. There are exceptions. 1 of 2 admin accounts also has a licence or mailbox, so it looks like an everyday account: anna.kowalski@fabrikam.example. What Microsoft 365 can't show: Judged from Microsoft 365 and Entra ID admin roles. Add local and server admins. 6 Patch operating systems Verdict: Fail Requirement: Operating systems are patched promptly and versions no longer supported by the vendor are replaced. - But: 5 devices haven't checked in for 30+ days. - Computers managed by Intune: 54 - Of which encrypted: 48 - Windows computers out of support: 36 - Not compliant: 9 - 36 of 54 Windows computers past end of support. - LAPTOP-HARRIS31 (noah.harris@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JACKSON49 (chloe.jackson@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-OKAFOR (ben.okafor@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-SMITH13 (owen.smith@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-WALKER04 (rhys.walker@fabrikam.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - and 31 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. Text to paste: Managed Windows computers run versions of Windows that no longer receive security updates. 36 of 54 Windows computers past end of support. What Microsoft 365 can't show: Judged from the Windows versions Intune reports. Add servers and devices it doesn't manage. 7 Multi-factor authentication Verdict: Fail Requirement: Users authenticate with MFA to online services holding sensitive data, and admins use phishing-resistant MFA at higher maturity levels. - But: 2 admins without a phishing-resistant method. - But: 4 people can only use a text or call as a second factor. - Users with an MFA method registered: 50.9% of 55 - Accounts covered by an enforced MFA policy: 54 of 55 - Not covered: breakglass@fabrikam.example - Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. - breakglass@fabrikam.example: Excluded from "CA002 — All users: Require MFA" - 1 admin not covered by MFA. - breakglass@fabrikam.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block - Legacy authentication is allowed. - No enabled policy blocks legacy authentication for all users Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. Text to paste: Multi-factor authentication (MFA) is enforced through Microsoft Entra ID for Microsoft 365 email and cloud applications, with exceptions. Enforced by Conditional Access ("CA002 — All users: Require MFA"), but with 12 exclusions to review: breakglass@fabrikam.example (break-glass), Application Administrator (role), Cloud Application Administrator (role), Conditional Access Administrator (role), Exchange Administrator (role), Global Administrator (role), Password Administrator (role), Privileged Authentication Administrator (role), Privileged Role Administrator (role), Security Administrator (role), SharePoint Administrator (role), User Administrator (role). What Microsoft 365 can't show: Judged for Microsoft 365 sign-ins. Add other online services. RECOVER DATA AND AVAILABILITY (PASS) 8 Regular backups Verdict: Pass (decided by demo) Requirement: Backups of data, applications and settings are made, kept, protected from change and deletion, and restores are tested. Text to paste: Microsoft 365 mail, OneDrive, SharePoint and Teams data is backed up daily by Datto SaaS Protection to storage separate from Microsoft 365, kept for 12 months, with credentials separate from the Microsoft 365 administrator accounts. The last restore test was on 2 September 2026. What Microsoft 365 can't show: Microsoft 365 doesn't back itself up for this purpose; describe the backup of Microsoft 365 too. ABOUT THIS EVIDENCE Maturity Level One is met only when all eight strategies meet it. Higher levels add requirements (such as phishing-resistant MFA and 48-hour patching) this pack doesn't judge. Requirements: ASD Essential Eight Maturity Model, Maturity Level One. Strategies are ASD's, numbered in their usual order; requirements are paraphrased. Check the current maturity model on cyber.gov.au before an assessment. Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; nothing was changed. Answers marked [in brackets] still need completing.