What an Essential 8 ML2 uplift actually looked like in a real Microsoft 365 environment

Most Essential 8 conversations sound cleaner than the work ever is.

On paper, the business thinks it is not far off. MFA is enabled. Intune is in place. Devices are enrolled. Patching is happening. Administrative accounts exist. Backups exist. Defender is turned on. There is a sense that the business is “probably around ML1 or ML2 already”.

Then you get into the environment properly.

That is usually where the confidence drops.

This is a walkthrough of how an Essential 8 uplift can look in the real world when the environment is built around Microsoft 365, Entra ID, Intune, Windows endpoints, and a few years of inherited decisions. It is not a formal case study, and some details here are intentionally generalised, but the pattern is real and common enough that many businesses will recognise themselves in it.

The situation

The client was a growing business with a Microsoft 365-centric environment and a genuine desire to improve security. They had already done meaningful work internally and with external IT support. MFA had been rolled out to most users. Intune was in place. Endpoint protection existed. Patch management was happening. Conditional Access had been partially implemented. There was a sense that the foundations were there.

Leadership’s view was understandable.

They did not think they were perfect, but they assumed they were close enough that an Essential 8 uplift would mostly be about tightening a few settings, documenting what had already been done, and closing a handful of obvious gaps.

The real challenge was that they did not yet have a clear, defensible view of current state.

That is the first thing many businesses miss. Essential 8 is not just about whether individual controls exist somewhere in the tenant. It is about whether those controls are implemented consistently, governed properly, and supported by evidence strong enough to survive scrutiny.

What we found

The environment was not insecure in the dramatic, headline-worthy sense. The bigger issue was that it lacked consistency and control.

There were pockets of maturity and pockets of drift.

MFA was enabled, but not in a way that gave clean confidence across all identities. Standard users were mostly covered, but administrative pathways were weaker than they should have been. Some older accounts had inconsistent treatment. A handful of legacy conditions and exclusions existed because someone had needed something to work at some point. Security looked good at a glance, but under pressure it would have been harder to explain and defend.

Privileged access was another problem area. Administrative access existed, but the separation between everyday accounts and higher-privilege accounts was not as disciplined as it needed to be. In smaller businesses, this is common. The same people are often wearing multiple hats, and operational convenience starts to blur security boundaries. From an Essential 8 perspective, that matters because administrative controls are one of the first places confidence starts to wobble.

Device management looked healthy on the surface, but the closer review showed uneven policy application. Some baseline hardening controls were well handled. Others had grown organically and were not clearly tied back to a defined maturity target. Devices were enrolled, but the business did not yet have the sort of evidence set that would make a strong external conversation easy.

Patch management was happening, but reporting discipline and exception handling needed work. This is another classic Essential 8 issue. An organisation may genuinely be patching, but still struggle to prove cadence, coverage, outliers, and remediation discipline in a way that builds confidence.

Backups existed, but the more important question was whether they were protected in a way that reduced attacker access risk and whether restore confidence matched leadership assumptions. Again, this is where many maturity conversations go sideways. The business thinks “we have backups” is the answer. Under scrutiny, the real questions become who can tamper with them, how they are separated, whether restores are tested, and how much of the recovery story is assumed rather than proven.

None of these issues on their own were shocking. That was precisely the point. The environment did not need panic. It needed clarity.

Why this mattered

The business was not trying to chase a theoretical security ideal. It needed a clearer answer to a more practical question.

How close are we really, and what would stop us from confidently standing behind that answer?

That is where Essential 8 work becomes commercially important.

Leadership did not need a vague list of security observations. They needed to know:

• what was actually working
• what was only partially working
• where confidence was justified
• where assumptions were doing too much work
• what needed to change first

Without that clarity, uplift efforts tend to become noisy. Teams work hard. Technical changes happen. But the business still struggles to explain current state cleanly, and that is usually the real problem.

How we approached it

The first step was not to jump straight into remediation. It was to get a clearer current-state picture.

That meant looking at the environment through two lenses at once.

The first lens was technical reality. What was actually configured? How were identities handled? What did device management and patching really look like? How were controls operating in practice?

The second lens was confidence and evidence. Could the business explain these controls coherently? Was ownership clear? Was there enough structure around the implementation to support the maturity claim being targeted?

That distinction matters. A lot of Essential 8 work fails because organisations look only at settings and not at confidence.

Once we had a clearer picture, the uplift work became easier to prioritise.

1. Tightening identity and MFA confidence

The first focus area was identity assurance. MFA needed to be treated not as a feature that had been turned on, but as a control that needed to be consistently governed.

That meant reviewing:

• user versus admin account treatment
• Conditional Access coverage
• exclusions and legacy policy leftovers
• old accounts and edge cases
• whether administrative identities were protected appropriately

The point was not to create perfect beauty in the tenant. The point was to reduce ambiguity.

2. Re-establishing privileged access discipline

Administrative access needed clearer separation and a more deliberate model.

In many small and mid-sized businesses, privilege evolves through necessity rather than design. Over time, that creates exactly the kind of weakness that makes Essential 8 maturity hard to defend. We focused on reducing blurred lines between standard user activity and administrative authority, tightening how higher privilege was granted and used, and making the environment easier to explain.

3. Turning device management into something more defensible

Device management was not absent. It just was not yet structured tightly enough around an uplift objective.

This meant reviewing baseline settings, policy consistency, hardening expectations, compliance logic, and the way the organisation understood its own fleet. It is one thing to say “Intune is deployed”. It is another to show that endpoint controls are being applied in a disciplined, measurable way that aligns to the maturity target.

4. Making patching easier to stand behind

Patch management discussions are often misleading because the business equates activity with confidence.

The question is not whether patching happens. The question is whether the organisation can demonstrate:

• coverage
• timeliness
• prioritisation
• exception management
• remediation discipline

That shifted the conversation from “we do patching” to “can we show patching in a way that stands up to scrutiny?”

5. Treating backup protection as a control, not a comfort blanket

Backups were present, but confidence in backups is not the same as backup maturity.

We looked at whether the backup story actually reduced operational and attacker risk, how well the control was governed, and whether the business could credibly support its assumptions around recoverability and protection. This matters more than many organisations realise, especially once security work is being discussed with leadership, auditors, or customers.

What people usually get wrong

There are a few mistakes that come up again and again in Essential 8 uplift work.

The first is assuming that because Microsoft 365 security features are licensed and partially configured, the maturity problem is mostly solved. It usually is not. Capability availability is not the same as control maturity.

The second is treating the uplift as a purely technical exercise. Essential 8 is deeply influenced by technology, but the confidence problem is often about governance, ownership, discipline, and evidence. If those parts are weak, the organisation still ends up with a security posture that feels harder to explain than it should.

The third is chasing maturity labels too early. Teams start asking whether they are ML1 or ML2 before they have done the slower work of understanding how well the controls are actually operating. That can lead to false confidence or shallow uplift priorities.

The fourth is underestimating the drag created by exceptions, legacy decisions, and inherited operational shortcuts. Most businesses do not fail because they ignored security entirely. They struggle because small inconsistencies accumulate until the whole control picture becomes harder to govern.

What ML2 looked like in practice

For this client, ML2 was not about claiming perfection. It was about reaching a position where the business could stand behind the controls with more confidence and less ambiguity.

That meant a more disciplined approach to:

• MFA enforcement across users and administrators
• separation and treatment of privileged access
• endpoint management and baseline control consistency
• patching cadence and evidence
• backup protection and confidence
• clearer ownership around the controls that mattered most

The result was not just a stronger technical position.

It was a stronger leadership position.

The organisation was easier to brief. The current state was easier to explain. The next priorities were easier to defend. The conversation moved away from “we think we are doing okay” and toward “here is what is working, here is what still needs attention, and here is the path forward”.

That is what many businesses are really buying when they ask for Essential 8 help.

Not just settings.

Control.

What good looks like

A good Essential 8 uplift does not leave the business with a prettier dashboard and the same uncertainty.

It leaves the business with:

• a more realistic view of current state
• less ambiguity around key controls
• better separation between strong controls and weak assumptions
• clearer ownership
• better evidence
• a roadmap that reflects actual risk and effort

That is the difference between security activity and security confidence.

Final thought

Most Essential 8 environments are not broken in obvious ways. They are messy in ordinary ways.

That is why the work matters.

The challenge is rarely awareness. It is clarity. It is understanding where the gaps really are, where confidence is justified, and what needs to happen next if the organisation wants a more defensible position.

If your Essential 8 effort feels busy but still lacks confidence, that is usually the point where a more structured, grounded view becomes valuable.