Step-by-Step Implementation Guides
These aren't high-level overviews — they're the actual click-by-click instructions you'll follow to configure every relevant Essential 8 control on your specific platform. Written by consultants who do this work every day, designed for people who don’t.
What a Typical Guide Step Looks Like
Here's a real step pulled directly from the E3: Restrict Admin Privileges guide. Every step across all controls follows this same detailed pattern:
Assign Least-Privilege Entra ID Roles
Assign only the specific admin roles each person needs — not Global Admin for everyone. Navigate to Entra ID → Roles and administrators, select the role, and add the admin account. Cross-reference with your Privileged Access Register (Step 1) to ensure every role assignment has a documented business justification and approval.
ML1 Requirements Addressed: RA-01, RA-02
High Risk Global Administrator — limit to 1–2 accounts maximum. Can do everything.
Medium Intune Administrator — manages device policies, app deployments, compliance.
Medium Security Administrator — manages Defender, security policies, alerts.
Lower User Administrator — manages user accounts, password resets, group membership.
Lower Exchange Administrator — manages mail flow, spam filters, mailbox policies.
If your tenant has Entra ID P2 licences (not included in Business Premium), enable Privileged Identity Management (PIM) for time-bound, just-in-time admin activation. ML1 does NOT require PIM — permanent role assignments with regular review are sufficient.
The guides also flag the specific checks assessors run — including the exact PowerShell commands they use to catch common mistakes. Here's the very next step from the same guide:
Remove M365 Licences & Email from Admin Accounts
This is one of the most commonly failed ML1 checks. Navigate to M365 Admin Center → Users → Active users → select the admin account → Licenses tab. Confirm no M365 licences are assigned. No licence means no Exchange mailbox, no OneDrive, no Teams, no SharePoint — which is exactly what RA-03 requires.
ML1 Requirements Addressed: RA-03
Many SMBs assign admin roles to regular user accounts that have full M365 licences — meaning the admin account has a mailbox, Teams access, and internet browsing. Assessors specifically run this PowerShell command to catch it:
Get-MgUser -All | Where-Object { $_.AssignedLicenses.Count -gt 0 } | ForEach-Object { $roles = Get-MgUserMemberOf -UserId $_.Id | Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.directoryRole' }; if($roles) { [PSCustomObject]@{ User=$_.UserPrincipalName; Roles=($roles.AdditionalProperties.displayName -join ', '); Licences=($_.AssignedLicenses.Count) } } }
Any admin account with licences assigned = RA-03 failure.
Every Guide Includes
Every admin console, dialog box, and settings page — showing exactly what to click and what the result should look like.
Ready-to-run validation scripts for each control — PowerShell for Windows, shell scripts for macOS. Run them to verify your configuration is compliant.
Pre-built tracking spreadsheets for patching, privileged access, applications, macros, MFA, and backup registers.
Green callout boxes throughout every step explaining what reviewers check and what evidence to collect.
Dedicated troubleshooting sections for every control covering common issues and their solutions.
End-of-section checklists mapping every ACSC sub-requirement to the step that addresses it.
Step-by-step MFA and backup instructions for Xero, MYOB, ATO/myGovID, Australian banks, VentraIP, and other local services.
Every control section opens with a table mapping ACSC requirement codes (PA-01, MF-07, RB-05, etc.) to the specific steps that address them.
Professional-grade implementation guides — without the consulting invoice.
Get the DIY Package →