RemoteASD Essentials series guide
ASD Essentials for cloud, in plain English
If your business runs on Microsoft 365, one stolen password can open your email, files and finance apps from anywhere. ASD's cloud chapter says what to lock down first. Most of it is already in your licence. It just isn't switched on yet.
- Published by
- Australian Signals Directorate
- Released
- 15 October 2026
- Written for
- Businesses run on SaaS and PaaS
- Structure
- 8 domains, 3 priority phases
- Status
- Guidance, not law, for most private businesses
- Cost to read
- Free on cyber.gov.au
Key: who does the work
- CCustomerYou deliver and run the control yourself.
- SSuppliedThe provider supplies it. You switch it on, set it up and run it.
- PProvider-inheritedThe provider delivers it. You check their evidence.
In short
- The cloud chapter is for businesses that run on cloud services and own no servers.
- Start with phase 1: identity services and boundary services.
- Most key actions are marked S. The provider built the feature, and you have to switch it on.
- Backups must sit outside your tenant and be tested. That part is yours.
- The phases are an order of work, not a compliance score.
Average self-reported cost per cybercrime report, 2025-26
Reports made to ASD through ReportCyber. Medium business was up 45% on the year before and large business down 27%. ASD says most cybercrime is likely unreported, so treat these as a floor.
Show as a table
| Item | Value |
|---|---|
| Individuals | $33,000 |
| Small business | $55,400 |
| Medium business | $141,300 |
| Large business | $148,100 |
Microsoft built the protection. Switching it on is your job.
Every action in ASD's matrix is marked C, S or P to show who does the work. The one that catches businesses out is S.
S is the marker that catches businesses out. The feature exists in a product you already pay for, so it feels covered. ASD's small business guidance on shared responsibility boils the job down to four actions: review the model for every cloud service you use, choose providers that publish security documentation and independent assurance, turn on strong authentication and protect credentials, and back up important data and test the restore. It also asks a question worth putting to every provider: does the provider back up your data, or do you need to?4
What this means for a Microsoft 365 business
Most of what decides whether a tenant gets breached is marked S. Microsoft built it. Someone at your business, or your IT provider, has to turn it on and keep it on.
Require phishing-resistant MFA for admins
- Name
- Require phishing-resistant MFA for admins
- Users
- Include: administrator directory roles. Exclude: emergency access accounts
- Target resources
- All resources
- Grant
- Require authentication strength: Phishing-resistant MFA strength
What the cloud chapter is, and why ASD wrote it
A chapter built for businesses that rent their technology rather than run it.
The Australian Signals Directorate published Essentials for cloud on 15 October 2026, alongside chapters for enterprise IT and operational technology. It is written for organisations whose technology is delivered entirely through software as a service (SaaS) and platform as a service (PaaS): the Microsoft 365 or Google Workspace tenant, the accounting package, the booking system, the CRM.1
For those businesses, parts of the enterprise IT guidance describe work the provider now does and the customer cannot do or prove, such as hardening servers, running networks and maintaining platform runtimes. The cloud chapter moves the effort to where a cloud customer's security is actually decided: who can sign in, how services are configured, what is connected to them, and whether the provider can show its own controls work.1
Is this your chapter?
If your business runs on Microsoft 365 or Google Workspace, a cloud accounting package and a few other cloud apps, with no server in the cupboard, yes. Test and development copies of those services count too: ASD puts non-production environments in scope. ASD wrote the chapter with large organisations, critical infrastructure and government in mind, but says smaller businesses can use it where relevant.
Left to the provider
- Servers
- Hardening and patching the operating system
- Networks
- Running the network the service sits on
- Platform
- Maintaining runtimes and infrastructure
Where your effort goes
- Identity
- Who can sign in, and how
- Configuration and data
- How each service is set up and what it holds
- Apps and integrations
- What is connected to your tenant
- Provider assurance
- Evidence the provider's controls work
Cloud chapter or enterprise IT chapter?
ASD designed the chapters to be used on their own, in whatever order suits your environments, obligations and risk. For most businesses the answer comes from what you run.
Hybrid is normal
ASD says organisations with on-premises, hybrid or infrastructure as a service environments should start with the enterprise IT chapter. A business with Microsoft 365 and one on-premises file server starts there, then uses the cloud chapter for the tenant. Our ASD Essentials tracker has a longer chapter chooser if you are unsure.
Why sign-in security comes first
For a cloud-only business, the sign-in page is the front door. There is no office network to get through first, so a stolen or guessed password goes straight to mail, files and finance systems, from anywhere in the world.
Microsoft's 2025 Digital Defense Report says more than 97 percent of identity attacks are password attacks, and that phishing-resistant MFA can stop over 99 percent of them. Ordinary MFA helps, but text codes and push approvals can be relayed through a fake sign-in page. Passkeys and security keys cannot, because they only answer to the real site.6
That lines up with ASD's own reason for the phase order: put the effort where it gives the most protection against how attackers work today. Identity services sit in phase 1 for that reason.1
Eight domains, three phases, one order of work
Scroll through how ASD's chapter fits together: the domains, the order to tackle them, and who does each action.
Two capability domains cover how you run security: governance and culture, and visibility and response. Six technical domains cover what you secure, from identity services to the laptops and phones staff sign in on.
Step 1 of 3. Keep scrolling to move through each step.
Capability domains: how you run security
Technical domains: what you secure
Phase 1 in a Microsoft 365 business, step by step
The order we work in. Each step is an ASD action, with the Microsoft 365 setting that does the job.
- 1Make the list
Record every identity, including service accounts and app identities, every integration, where your data sits and which cloud regions it is in. ASD marks this C and suggests automated discovery where you can.
In Microsoft 365: the Entra enterprise apps list, app registrations and sign-in logs show what is connected and still in use.
- 2Require phishing-resistant MFA
Marked S. Passkeys, security keys and Windows Hello for Business only answer to the real sign-in page.
In Microsoft 365: a Conditional Access policy using the built-in Phishing-resistant MFA authentication strength. Start with admins. Conditional Access needs Entra ID P1, which is in Business Premium.
- 3Block legacy sign-in
ASD asks you to disable legacy authentication protocols, or where that is not possible, restrict and monitor them, add other controls and set a date to retire them.
In Microsoft 365: check sign-in logs for anything still using legacy protocols, then block them with Conditional Access.
- 4Take control of app consent
ASD action PRO-16, marked C: assess and approve applications, integrations and consent grants before they get access, and review them regularly.
In Microsoft 365: by default users can consent to apps for some permissions, such as reading their own mailbox. Microsoft recommends allowing user consent only for verified publishers and turning on the admin consent workflow.
- 5Tidy secrets and service accounts
Keep credentials, keys and secrets in approved stores, and limit non-person identities to what they need.
In Microsoft 365: review app secrets and certificates for owners and expiry dates, and remove access nobody can explain.
- 6Turn on logging you can use
ASD action DET-01, marked S, applies across all six technical domains: provider audit logging at a tier and retention that supports an investigation, forwarded to a central place.
In Microsoft 365: Audit (Standard) keeps records for 180 days. E5 keeps Entra, Exchange, SharePoint and OneDrive records for a year by default. Forward logs if you need them longer.
Check your phase 1 basics
0 of 8 actions in place
Not yet in place
- Build a list of accounts, apps and integrations. ASD action IDE-01, marked C.
- Move staff to phishing-resistant MFA. Identity services, phase 1, marked S.
- Block legacy sign-in. Identity services, phase 1, marked S.
- Route app consent through an approver. ASD action PRO-16, marked C.
- Review app secrets and service accounts. Identity services, marked S.
- Confirm audit logging and retention. ASD action DET-01, marked S.
- Isolate backups and test a restore. ASD action PRO-10. Isolation and testing are marked C.
- Put AI features behind an approval. Governance and culture, marked C.
You have 8 gaps. Send us this list and an engineer will tell you which to fix first and what it involves.
Get my gap list reviewedAdmin accounts come next
Separating admin accounts belongs to privileged environments in phase 2. Many businesses do it alongside phase 1 because it is quick and the risk is high.
Backups: five actions, two of them entirely yours
ASD lists five backup and recovery actions under PRO-10. The provider supplies the capability for three. Isolating the backups and testing the restore are yours.
| Action | Marker | Who does the work |
|---|---|---|
| Back up important data and settings to immutable storage | S | Provider supplies it, you set it up, or you add your own backup |
| Isolate backups from production | C | You: separate account, subscription or tenant with its own access |
| Test backups and restores against your recovery times | C | You |
| Set up recovery arrangements with the provider | S | Provider supplies it, you agree the terms |
| Be able to rebuild critical capability with another provider | S | Provider supplies it, you plan for it |
Recycle bins are not backups
A backup that lives inside the same tenant, behind the same admin password, does not meet the isolation action: an attacker who takes the tenant takes the backup too. Microsoft 365 retention and recycle bins help with accidental deletion, but in our view they do not replace a separate copy held outside the tenant.
How we help, and what it costs
After phase 1, a stolen password on its own no longer gets anyone into your mail. You know every app that can read your data, you have restored from a backup an attacker could not reach, and your insurer can see what changed.
- 1A read-only look at your tenant
Accounts, apps, sign-in methods, logging and backups, without changing anything.
- 2A written gap list
Each gap tied to the ASD action and marked C, S or P, with a quote for the work.
- 3The fixes, in a safe order
Policies run in report-only mode first so nobody gets locked out. An engineer approves every change.
- 4Evidence you can hand on
What changed and when, ready for a client, insurer or board.
| Route | What it costs | What you get |
|---|---|---|
| Do it yourself | Free guidance, your team's time | ASD's chapter, matrix and planning guides |
| With Real Bytes | Quoted for your tenant before we start | A read-only review, a gap list and the fixes, signed off by an engineer |
| Do nothing | $55,400 average per small business cybercrime report | The same open doors |
Real Bytes holds CyberCert SMB1001 Gold and is an ACSC Network Partner.
Questions about ASD Essentials for cloud
What is ASD Essentials for cloud?
It is one of three chapters in the ASD Essentials series, published by the Australian Signals Directorate on 15 October 2026. It sets out principles, actions and a recommended order of work for organisations whose technology is delivered entirely through software as a service and platform as a service, such as Microsoft 365, Google Workspace and cloud business apps.
Should we use the cloud chapter or the enterprise IT chapter?
If everything you run is a cloud service, use the cloud chapter. If you run on-premises servers or virtual machines in Azure or AWS, the enterprise IT chapter covers those, because you still own the operating systems and network. Many businesses use both.
Does it replace the Essential Eight?
ASD says it has evolved the Essential Eight into the ASD Essentials for enterprise IT, and it has published a guide to moving across. The cloud chapter covers the same ground for businesses that run on cloud services. Our ASD Essentials tracker covers what is confirmed and what is still open, so we keep that detail in one place.
Microsoft looks after Microsoft 365 security, doesn't it?
Only part of it. Most of the identity, logging and backup actions in the cloud chapter are marked S for supplied: Microsoft provides the feature, but you have to turn it on, set it up and keep it running.
Do we need Microsoft 365 Business Premium?
Not to read the guidance. The Conditional Access policies that enforce phishing-resistant MFA and block legacy sign-in need Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Security defaults give smaller tenants a basic level of protection without it.
Is the cloud chapter mandatory?
Not for most private businesses. It is ASD guidance. Some government agencies, contracts and insurers may ask for it, so check what your clients and policies require.
How is the chapter structured?
Three layers. Principles are security objectives from ASD's Information Security Manual, each with an identifier such as GOV-01 that is there for traceability, not order. Actions say what to do without naming a product. Domains say where each action applies. Where it fits, each technical action is mapped to the MITRE ATT&CK techniques it defends against.
How long does phase 1 take?
It depends on how many people, apps and integrations you have, and how many staff need new sign-in methods. We scope it after a read-only look at your tenant, so the quote reflects what is actually there.
Know which doors are open before someone else does.
Tell us which cloud services you use. We will tell you what phase 1 looks like for your business, in plain English, before you spend anything.
- ASD Essentials trackerThe whole series and what is still open.
- Essentials for enterprise ITFor servers, hybrid and IaaS.
- Passkeys in Microsoft EntraMoving staff to phishing-resistant MFA.
- Microsoft 365 backupNative retention or third-party backup.
- Tenant health checkA read-only review of your tenant.
- SMB1001 certificationTurn the work into a certificate.
Sources
See all 12 sourcesChecked 10 November 2026. The small numbers in the page link here.
- ASD, Essentials for cloud. Australian Signals Directorate, 15 October 2026
- ASD, Which chapter should I start with?. Australian Signals Directorate, October 2026
- ASD, Transitioning from the Essential Eight. Australian Signals Directorate, October 2026
- ASD, Cloud shared responsibility model: Guidance for individuals and small and medium businesses. Australian Signals Directorate, 20 October 2025
- ASD, Annual Cyber Threat Report 2025-26: Year in review. Australian Signals Directorate, October 2026
- Microsoft, Digital Defense Report 2025 summary. Microsoft On the Issues, 16 October 2025
- Microsoft Learn, Conditional Access authentication strengths. Microsoft
- Microsoft Learn, Configure how users consent to applications. Microsoft
- Microsoft Learn, Manage audit log retention policies. Microsoft
- ASD, Essentials for enterprise IT. Australian Signals Directorate, 15 October 2026
- ASD, Annual Cyber Threat Report 2025-26: Cybercriminals. Australian Signals Directorate, October 2026
- Microsoft Learn, Require phishing-resistant multifactor authentication for administrators. Microsoft