The Essential Eight evidence checklist

• An export showing the registered authentication methods for every account, including service, shared and break-glass accounts
• The conditional access or equivalent policy showing multi-factor authentication is enforced rather than merely available, exported as configured
• Sign-in log evidence over a defined window, interpreted rather than pasted, with service accounts, non-interactive authentication and token flows identified and explained
• For shared mailboxes, evidence that direct sign-in is disabled rather than an attempt to show a registered second factor

Identity provider administration centre, under authentication methods and sign-in logs. Export as CSV with the generated timestamp intact.

"Multi-factor authentication is enabled for all staff." This describes intent, not state. It also usually turns out to exclude the accounts that matter most, being service accounts, shared mailboxes, the founder, and whoever complained loudest during rollout.

Registration state offered as proof of enforcement. Registration shows a method exists on the account. Enforcement is a policy question, and the two diverge more often than people expect.

An export with its own header block intact, carrying the source system, a generation timestamp, the query scope, the row count against the directory total, and the person who ran it. An assessor can tell what population it covers without asking a single follow-up question.

Level Two extends multi-factor authentication to privileged and unprivileged users of systems generally, requires it to be phishing-resistant, and adds central logging of successful and unsuccessful events. If your evidence shows SMS as the second factor for administrators, you are at Maturity Level One on this control regardless of coverage.