ASD Essentials for Microsoft 365 and Microsoft Sentinel

Entra ID, Intune, Defender and Microsoft 365 can enforce many Essential Eight controls and record whether they operate across the systems in scope. Microsoft Sentinel adds centralised logging, detection, investigation and response evidence.

The applicable chapter depends on the environment, whichever Microsoft products are deployed, and an ASD Essentials rating takes more than configuration settings or a Sentinel workspace. An environment delivered predominantly through SaaS and PaaS services starts with the cloud chapter, covered in the ASD Essentials for cloud guide.

A Microsoft component is scoped by what it does: its security function, the assets it protects and the systems it administers. That can put one component in more than one domain. ASD’s asset scoping guidance identifies Entra ID as an identity service and looks at how devices are used, including whether they support privileged administration.

Intune shows why product-based scoping falls short. Managed laptops belong in User devices, dedicated administrative devices also need consideration under Privileged environments, and the Intune service itself may be a business system when daily operations depend on it.

Microsoft operates the cloud services. The organisation stays accountable for the capabilities it enables and configures, and under ASD’s outsourced-services guidance that holds when another provider manages the tenant. ASD states that when a capability is offered but the organisation has not enabled or configured it, the responsibility has not been fulfilled. An available licence, a Conditional Access policy left in report-only mode and an audit setting that was never switched on are capabilities on offer. None is an operating control.

For each component, name who maintains the configuration, which systems receive it and which record confirms it is working.

Privileged Identity Management (PIM) in Microsoft Entra ID makes an administrator activate a role, for a limited time, before doing privileged work. That supports ASD’s secure administration actions, which include “time-bound privilege grants” before privileged actions are permitted. ASD’s indicators treat standing privileged access as not effective outside approved emergency arrangements.

PIM activation history shows who activated which role and for how long. Review it alongside the active assignments. An account with a standing assignment has no reason to activate, so an activation report alone will not show it.

Privileged work should run from dedicated, hardened environments separated from ordinary user workloads. Conditional Access can restrict administration to compliant, dedicated devices. Each administrative record identifies the user, timestamp and target of a change. Entra ID and Microsoft 365 logs capture many such events, but privileged administration may also occur through other platforms.

For assessment, trace a piece of privileged work end to end where the records allow: the role assignment, the activation, the administrative session and the change that resulted.

Application control and Office macro restrictions are both deployed through Intune and Microsoft Defender, and both contribute to Trustworthy software and Secure configuration management in ASD Essentials. ASD’s Trustworthy software action is to Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed.

On managed Windows devices, Intune can deploy App Control for Business policies, and Defender for Endpoint attack surface reduction rules can restrict Office child processes and macros that call Win32 APIs. Intune and the Cloud Policy service for Microsoft 365 can also manage Office macro settings centrally, including blocking macros in files from the internet.

Assess the two controls separately. Blocking internet-origin macros does nothing to stop unapproved executables, scripts or administrative utilities from running. ASD’s transition guide warns that Office macro controls address only part of the broader requirement to control software execution.

Validate application control against the approved software inventory, the deployed policies and what actually ran. Defender advanced hunting shows allowed and blocked activity on onboarded devices. Check each of the following:

For Exchange Online, SharePoint, OneDrive and Teams, the relevant ASD Essentials actions cover inbound content inspection, exposed credentials and protected backups. The evidence needed is set by the content channels and important data in scope, whatever Microsoft licences are held.

Inbound content inspection (IT.PRO-09.3) applies in Boundary services and Critical processes and services. Exchange Online filtering, Microsoft Defender for Office 365 or a mail gateway can inspect inbound email, and attachment and link inspection in collaboration tools may help address other channels.

ASD also calls for identifying unsecured keys, secrets and credentials across codebases, configuration files, file shares and collaboration platforms. A password pasted into a Teams channel or saved in a SharePoint document is a typical case. Assess SharePoint, OneDrive and Teams content against the organisation’s scanning arrangements, and record when scans ran, which repositories were covered and whether exposed credentials were rotated or revoked.

Important Microsoft 365 data also needs protected backups, with restoration tested against the organisation’s recovery objectives. Retention policies preserve information within Microsoft 365. They do not show that a mailbox, site or other important data can be restored after an incident.

Microsoft Sentinel supports ASD Essentials in centralised event logging, detection, incident identification and documented response. ASD’s actions are technology-agnostic. No SIEM product is required or endorsed, and a deployed Sentinel workspace is not compliance in itself.

Sentinel aligns most directly with the detect principles, DET-01 to DET-05, and supports the respond principles, RES-03 to RES-05. Most of these actions sit within Visibility and response, a capability domain applying throughout the priority phases. Some are also assessed in technical domains, and these placements matter most for Sentinel:

Existing Essential Eight logging and detection is the starting point. Check it against the applicable actions and domains.

DET-02 covers detection from normalised, time-synchronised and enriched logs. DET-03 covers identifying incidents from those detections and recording how they are investigated and classified. Microsoft Sentinel can support both. ASD’s IT.DET-03.1 action asks organisations to triage alerts and events in a timely manner.

ASIM parsers and ingestion-time transformations help normalise records from different sources, while UEBA, watchlists and threat intelligence add context for separating expected activity from events needing investigation.

Record Investigation Decisions

A Sentinel incident keeps its alert details, classification, assignments and investigation activity. Automation rules can assign, tag and close incidents. A rule that closes routine alerts still needs a documented basis, and the case history it leaves has to make sense to a reviewer who was not involved.

For assessment, follow representative incidents from creation through triage, classification and closure, examining the supporting events, analyst decisions, automated changes and recorded outcomes.

Measure Triage Timeliness

ASD’s fully effective indicators for IT.DET-03.1 expect alerts to be triaged within the organisation’s defined timeframes, with performance tracked and reported.

This starting-point KQL query measures time from incident creation to first recorded modification, by severity, over the previous 30 days. It uses FirstModifiedTime as a proxy for the first analyst action. Automated incident updates can change that timestamp, so validate the result against the actual investigation workflow before using it as evidence of analyst response.

// Starting point: time from incident creation to first action, by severity SecurityIncident | where CreatedTime > ago(30d) | summarize arg_max(TimeGenerated, *) by IncidentNumber | extend MinutesToFirstAction = datetime_diff('minute', FirstModifiedTime, CreatedTime) | summarize Incidents = count(), MedianMinutes = percentile(MinutesToFirstAction, 50), P90Minutes = percentile(MinutesToFirstAction, 90) by Severity 

Monitor High-Risk Software Execution

DET-04 addresses baselined high-risk access activities, including malicious use of otherwise legitimate software and utilities. Defender for Endpoint process events show software execution on onboarded devices, while Entra ID records, Defender for Identity and UEBA provide identity context and behavioural baselines.

Check which endpoints produce process telemetry, which events are monitored and whether an investigator can tell approved activity from suspicious use. Privileged environments in ASD Essentials covers the baselines expected under DET-04, while ASD Essentials and SIEM covers KQL analysis of administrative tool execution.

Respond Within Approved Procedures

Sentinel playbooks and supported Defender capabilities can isolate devices, disable accounts and revoke sessions. Each action, automated or started by an analyst, follows an approved procedure. The record names the incident, the authority to act, the action performed and the outcome observed.

Incident comments and tasks can also hold post-incident findings and records of external notifications. An assessor can then follow one incident from detection through investigation and response to follow-up. ASD Essentials and the SOC covers incident response planning, exercises and reporting obligations.

ThreatDefence operates a 24x7 SOC with its team based in Australia, a 3 min average response under guaranteed SLAs, and threat hunting and an incident response retainer included in the standard service.

Response actions remain within the authority approved by each customer. Case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia.

ThreatDefence does not certify organisations. The assessor determines ASD Essentials ratings.

The ITDR module monitors risky app consents, session token replay and new MFA methods. The SOC can revoke sessions, remove an MFA method or block a sender within the customer’s approved response authority.

Through Microsoft Sentinel MDR, ThreatDefence operates on top of the customer’s existing Microsoft Sentinel workspace as a Microsoft Solutions Partner for Security. Data remains in the customer’s workspace, while AI agents and analysts query it in place using least-privilege roles assigned by the customer’s team.

In most environments, routing data to the appropriate Sentinel tier typically reduces Sentinel data costs by 50 to 70%.

Organisations can also review their current position action by action using the free ASD Essentials Navigator. Principle and domain results update as the assessment progresses. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.

Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance