Your Essential Eight action plan, written out

Sequencing depends on the gaps you already have, and this business reported exposed administrative access: everyday accounts holding admin rights, and admin accounts still active for people who have left. That is dealt with before the usual order. If the account reading email is also the account that can reconfigure your tenant, a single successful phish is a full compromise rather than an inconvenience.

• Requests for privileged access are validated when they are first requested
• Privileged users hold a dedicated privileged account used solely for duties that require it
• Privileged accounts are prevented from reaching the internet, email and web services, unless explicitly authorised and then limited strictly to what is needed
• Privileged users work in separate privileged and unprivileged operating environments

Annual revalidation and phishing-resistant multi-factor authentication are Maturity Level Two, not Level One. Both are sensible to do early and we recommend them below, but they are recommendations rather than Level One requirements, and a document that conflates the two will not survive an assessor.

A typical small Microsoft 365 environment under 50 users, cloud-native and without complex legacy dependencies, runs to roughly one to three consulting days plus a pilot and communication period. The part people underestimate is not technical. Two or three people will need a second account and will find that irritating for about a week.

A dated export of every privileged role assignment, including service, vendor and break-glass accounts, reconciled against a list of who should hold them. The policy blocking mail and web access for those roles, exported as applied rather than as written. A named owner for each exception, with a compensating control and a review date.