Compliance case study

Essential Eight Level 2 in One Microsoft Tenant for Defence-Related Work

Novaguard built a scoped Essential Eight Maturity Level 2 environment for a consulting firm with Defence employee-placement requirements. Device controls and restricted project access separated the relevant work within its existing Microsoft tenant. The client’s evidence was submitted to Defence.

By Michael Jordison, Director, Novaguard Technology Group

Brisbane-based, with remote support Australia-wide. Client details are anonymised.

The challenge

The consulting firm needed to meet an Essential Eight Maturity Level 2 requirement for Defence employee placements. Its wider workforce included substantial project-hire and labour-hire populations with different access needs.

The design needed to protect the relevant environment while keeping administration and access practical across the business.

What Novaguard changed

Scoped the environment within one tenant

We retained a single Microsoft tenant and one identity per person. The design combined device posture, access conditions, and data classification to restrict access to the relevant environment.

Configured devices and Conditional Access

Intune profiles applied the required configuration to devices accessing the scoped environment. Conditional Access required the appropriate device compliance state. The wider device fleet was managed to its own requirements.

Restricted project data

Sensitivity labels and SharePoint site-level restrictions supported classification and access control for project information. Access depended on the authorised user population and device requirements.

Prepared control evidence

We documented the controls and how they applied to the client's scoped environment. Security controls were also improved across the wider organisation.

Results and verification

The client's Essential Eight Maturity Level 2 evidence was submitted to Defence.

The scoped environment operated within the existing Microsoft tenant.
Staff retained one identity across the business.
The wider workforce did not need the same configuration as devices accessing the restricted environment.

The client was very pleased with the outcome and the supporting evidence, which they successfully submitted to the Department of Defence.

What this means for a similar organisation

Begin with the required scope and access boundaries. A single-tenant design may suit some environments; others may need stronger separation. The architecture and evidence must address the actual requirement.

Explore Essential Eight compliance. For a separate DISP requirement, see DISP support.

Questions about this engagement

Did this engagement use a second Microsoft tenant?

No. It used device controls, Conditional Access, sensitivity labels, and SharePoint restrictions within the existing tenant. That architecture was specific to the engagement scope.

Was this DISP accreditation?

No. The client’s Essential Eight Maturity Level 2 evidence was submitted to Defence. DISP is a separate requirement.

What needs to be scoped before designing a restricted environment?

Identify the work covered by the requirement, the information involved, and the staff or contractors who need access. Devices and shared services also need to be considered. In this engagement, the consulting firm had different requirements across its workforce, so scoping was central to the design. The written requirement should guide those decisions before configuration begins.

Did every employee need the same device configuration?

No. Devices accessing the scoped environment had the required configuration, while the wider fleet was managed according to its own requirements. That distinction supported a mixed permanent, project-hire, and labour-hire workforce. For another organisation, access rules and device requirements need to be designed together so the relevant information is available only through the intended access path.

What did the client gain from the evidence work?

The client received supporting evidence explaining the controls applied to the scoped environment. They were very pleased with the outcome and successfully submitted the evidence to the Department of Defence. For a similar engagement, agree who will receive the evidence and what they are asking for so the deliverable addresses the actual requirement.

Can this approach suit an organisation outside Defence-related work?

The scoping questions are useful wherever a particular project or dataset has different access requirements from the rest of the business. The architecture still needs to be assessed for that environment; a single Microsoft tenant is one option to consider. Start with the contractual requirement, user groups, and information involved, then decide how the boundary should be implemented.

Need Essential Eight without locking down your whole workforce?

Request a free call and we'll walk through what's actually being asked of you, and where the boundary should sit.

Request a free call