Does ASD Essentials for cloud apply to a Microsoft 365 Business Premium business?

Usually yes, if you run no servers of your own. ASD Essentials for cloud, launched by the Australian Signals Directorate on 15 October 2026, is written for organisations whose technology is delivered entirely as subscribed cloud services such as Microsoft 365, including the laptops and phones staff use to reach them. Keep an on-premises server, an on-premises Active Directory or Azure virtual machines, and ASD points you to the enterprise IT chapter instead. Neither chapter changes DISP's Essential Eight Maturity Level 2 requirement today.

What ASD launched on 15 October 2026

ASD Essentials is the successor to the Essential Eight, published as a series of chapters for different kinds of technology environment. The first three are Essentials for enterprise IT, which ASD calls an evolution of the Essential Eight; Essentials for operational technology, for critical infrastructure operators; and Essentials for cloud, which ASD's launch announcement describes as "support for organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS)". In plain terms, software-as-a-service is software you subscribe to and use rather than run yourself (Microsoft 365, Xero, a practice-management system), and platform-as-a-service is a provider-run platform you build your own applications on. ASD also published supporting guides on transitioning from the Essential Eight, implementation planning, assessment, and AI. See ASD's launch announcement and the ASD Essentials home page.

For the broader picture of what changes from the Essential Eight, including maturity levels and the transition, see is the Essential Eight being retired, and what is ASD Essentials?

Cloud chapter or enterprise IT chapter: how to decide

ASD's own test turns on how much of the technology you actually operate. Its which chapter should I start with guidance sends organisations running on-premises infrastructure, a hybrid environment or infrastructure-as-a-service (rented virtual machines, such as Azure VMs) to the enterprise IT chapter, because they still run the operating systems, identity infrastructure and network that chapter addresses. Organisations operating predominantly on SaaS or PaaS start with the cloud chapter, which deals directly with the split of responsibilities between customer and provider. The cloud chapter itself adds that you should judge "what they actually operate rather than what the procurement label says".

For a typical Microsoft 365 Business Premium business, that plays out like this:

No servers, staff sign in with Microsoft Entra ID, laptops and phones managed through Intune, files in SharePoint and OneDrive: the cloud chapter is the natural starting point. The cloud chapter's User devices domain explicitly covers the desktops, laptops and mobile devices used to reach cloud services, so your endpoints are not left out.

A file or application server still in the office, an on-premises Active Directory synchronised to Entra ID, or workloads on Azure virtual machines: start with the enterprise IT chapter, because you still run infrastructure the cloud chapter assumes a provider runs.

Either way, ASD is blunt that the choice is about order, not exclusivity: "Most organisations will need both chapters over time."

What "Supplied" means for a Business Premium tenant

The most useful detail in the cloud chapter for a Microsoft 365 business is its responsibility marker on every action. (C) Customer means you deliver and operate the control. (S) Supplied means the provider supplies the capability but you must enable, configure and operate it. (P) Provider-inherited means the provider delivers the outcome and your job is to verify it through assurance evidence, such as an IRAP assessment covering the services you use. Most identity, privileged access and logging actions in the SaaS column are marked Supplied, and ASD spells out the consequence: "A capability that exists but has been left at an insecure default, or applied inconsistently, is not yet effective."

That sentence is the gap between owning Business Premium and being secure. Conditional Access, Intune compliance policies, Defender for Business and audit logging are all in the licence; none of them count until they are switched on, tuned to the business and kept that way.

What the cloud chapter asks that the Essential Eight never did

Several cloud chapter actions have no Essential Eight equivalent and land directly on Microsoft 365 administration. Quoted from ASD's Essentials for cloud chapter:

Third-party app consent: "Assess and approve applications, integrations and consent grants before permitting access, and review them on a regular basis." In Microsoft 365 terms, that means controlling which apps staff can grant access to their mailbox and files, and reviewing the ones already granted.

AI features: "Require executive or delegate approval before enabling SaaS or PaaS AI functions." For most of our clients that means Microsoft 365 Copilot and the AI features now appearing in line-of-business SaaS. See our Microsoft 365 Copilot readiness guides for the data-exposure work that should sit behind that approval.

Admin from managed devices: "Ensure administrative activities against cloud management planes are performed only from managed, compliant, hardened devices." The Entra, Intune and Microsoft 365 admin centres are the management plane, so Conditional Access should block administration from personal or unmanaged machines.

Backups outside the tenant: "Isolate backup repositories from production cloud environments through separate accounts, subscriptions or tenants with independent access controls, preventing unauthorised modification or deletion." Microsoft 365's own retention and recycle bins live inside the same tenant an attacker would be in, so they do not meet this action on their own.

Provider register: "Maintain a register of inherited and retained security responsibilities per provider, and review it as services change." A written record of what Microsoft, your line-of-business vendors and your managed service provider each do for you, and what is left with you.

Time-bound admin rights: the chapter calls for explicit session establishment controls before privileged actions, "including the use of time-bound privilege grants". In a Microsoft tenant that is Privileged Identity Management, which Microsoft Learn's Entra ID Governance licensing fundamentals lists under Microsoft Entra ID P2, Entra ID Governance and the Entra Suite, not under the Entra ID P1 that Business Premium includes. Budget for it, or document a compensating control.

Familiar controls carry straight across. The cloud chapter keeps the action "Use phishing-resistant MFA for users authenticating to systems" and still requires that only supported, verified and organisation-authorised software runs, so phishing-resistant MFA and application control work done for the Essential Eight is not wasted.

Where to start: the priority phases

The cloud chapter groups its six technical domains into three priority phases, the same order the enterprise IT chapter uses. Phase 1 is Boundary services (integrations, APIs and anything internet-facing) and Identity services (Entra ID and anything else that authenticates users). Phase 2 is Critical processes and services and Privileged environments, which ASD defines to include SaaS administration interfaces and cloud control planes. Phase 3 is Business systems and User devices. Two capability domains, Governance and culture, and Visibility and response, run across all three phases. ASD stresses that "Priority phases are a sequencing mechanism, not a rating", so a business working on phase 1 is not operating at a lower standard; it is at a different point in the same program. For a Microsoft 365 business, phase 1 is mostly Entra ID, Conditional Access and app consent. ASD's reasoning for putting identity first is that "Compromise of identity services can enable an adversary to gain persistent or privileged access to cloud services and organisational data."

Using a managed service provider does not move the accountability

ASD addresses outsourcing head-on, which matters to every business that relies on an MSP such as Blue Arc IT Solutions. Its chapter selection guidance says "outsourcing a service does not transfer accountability for the security outcomes that service is expected to achieve", and that "A domain should not be considered effective, simply because responsibility for it has been assigned to a third-party." The practical consequence: ask your provider for current evidence that the controls they run are working, not a statement that they are responsible for them. That is the right standard, and the one Blue Arc IT Solutions expects to be held to.

Do existing Essential Eight ML2 programs need to change?

Not immediately. ASD's launch announcement states: "Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations." ASD will maintain both the Essential Eight and the Essentials on cyber.gov.au during the transition, and its Essentials FAQ says ASD "does not recommend slowing or stopping the roll-out of pre-approved cyber security initiatives". It also says Essential Eight maturity levels "do not automatically convert" into Essentials effectiveness ratings, so an ML2 result is a starting point for a gap analysis, not a finished answer.

For DISP members the position is settled for now. As at 19 October 2026, Defence's DISP cyber and assurance page still states that all DISP members "are now required to achieve and maintain compliance with the full E8 Maturity Level 2 standard", assessed through the Cyber Security Questionnaire, and makes no reference to ASD Essentials. Keep building to ML2. See DISP IT support in Canberra.

How Blue Arc IT Solutions helps

Most of our clients run Microsoft 365 Business Premium, so the cloud chapter describes their world more closely than the Essential Eight ever did. We help clients work out which chapter fits their environment, map their existing Essential Eight controls and evidence against it, and close the cloud-specific gaps above, while keeping DISP members on Essential Eight ML2 for as long as Defence requires it. See our Essential Eight compliance overview, managed services, or get in touch.

Last reviewed: 19 October 2026, against ASD's Essentials launch announcement, the Essentials for cloud chapter, the which-chapter guidance and the Essentials FAQ (all published 15 October 2026), Defence's DISP cyber and assurance page, and Microsoft Learn's Entra ID Governance licensing fundamentals (updated 29 July 2026). ASD has not yet published a transition timeline; we will refresh this page when it does, or when Defence updates DISP.

Frequently asked questions

Does ASD Essentials for cloud replace Essential Eight Maturity Level 2 for DISP members?

No, not today. ASD says organisations should keep meeting their current regulatory obligations until regulators communicate changes, and as at 19 October 2026 Defence still requires every DISP member to achieve and maintain the full Essential Eight at Maturity Level 2. Defence has not yet said how DISP will reference ASD Essentials.

Is ASD Essentials only for large organisations?

It is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. ASD says small and medium businesses can still use it where relevant, and that the security outcomes it describes are equally important for smaller organisations; what differs is how they are achieved and how much sits with providers.

Does Microsoft 365 Business Premium meet ASD Essentials for cloud out of the box?

No. Business Premium supplies many of the capabilities the cloud chapter asks for, but ASD marks most of those actions as supplied capabilities the customer must enable, configure and operate, and says a capability left at an insecure default is not yet effective. Some actions, such as time-bound privilege grants through Privileged Identity Management, need licensing beyond Business Premium.