Frameworks, checklists and practical guides.
Substantial reference material for Microsoft 365 governance and security. Built for Australian businesses and IT teams making decisions about their Microsoft environment.
Microsoft 365 Security Assessment Costs in Australia
Microsoft 365 security assessments range from free MSP reviews to formal compliance-grade audits costing tens of thousands of dollars. The difference is not just price - it is scope, independence and what you actually receive. This guide explains what drives the cost, what each level includes, and how to evaluate whether you are getting value.
Microsoft Secure Score vs Essential Eight
Microsoft Secure Score and the Australian Signals Directorate Essential Eight are both used to measure cyber security posture. They are not the same thing, they do not measure the same controls, and improving one does not guarantee compliance with the other. This comparison explains what each measures, where they overlap and how to use both effectively.
Microsoft 365 Governance: Roles, Ownership & Decision Rights
Most Microsoft 365 environments have no clear governance ownership. Security settings were configured by whoever set up the tenant, policies were last changed years ago, and nobody has formal accountability for the current state of the environment. This is not unusual - it is what happens when a productivity tool becomes critical infrastructure without a corresponding governance structure. This guide covers who should own what, and how to assign that ownership in a small or mid-sized organisation.
Microsoft Entra Conditional Access Baseline for SMBs
Conditional Access is the policy engine that controls how and when users can access Microsoft 365 resources. It is the correct mechanism for enforcing MFA, blocking legacy authentication and requiring compliant devices - more reliable and more flexible than Security Defaults. This guide covers the minimum policy set every small or mid-sized organisation should implement, the correct deployment order and how to avoid disrupting your users during rollout.
Microsoft 365 Tenant Audit: Scope, Findings & Deliverables
A Microsoft 365 tenant audit is an independent review of your environment's configuration, security posture, governance and licensing. The term is used inconsistently in the market - some providers offer a 30-minute review as an 'audit'. This guide defines what a thorough audit should cover, what you should receive as a deliverable, and what separates a meaningful assessment from a surface-level sales exercise.
Microsoft 365 Security Assessment vs Penetration Test
If someone has told you that your organisation needs a penetration test and you are not sure whether they mean an M365 security assessment or an actual pen test, this guide is for you. They are different engagements, they answer different questions, they cost different amounts, and the right choice depends on what you are trying to find out.
Microsoft 365 Governance for Small Businesses
Microsoft 365 governance is not an enterprise concept. A business with 30 users needs governance just as much as one with 3,000 - it just looks different. The goal is not policies and procedures for their own sake. It is making sure the right people can make informed decisions about your environment, that those decisions are implemented consistently, and that the environment does not drift into a state that nobody can explain.
Microsoft 365 Security for Australian Healthcare Organisations
Healthcare organisations have legal obligations around health information that go beyond general cyber security best practice. Under the Privacy Act 1988 and the My Health Records Act 2012, health information requires specific protections. Microsoft 365 can be configured to meet these requirements - but the default configuration does not get you there. This guide covers the controls that matter and the gaps most commonly found in healthcare tenants.
Copilot Governance for Business: Policy, Oversight and Controls
Deploying Microsoft 365 Copilot without a governance framework is not a technical risk - it is a business risk. Copilot will surface content your employees have access to, generate outputs that could be shared externally, and enable the creation of agents that access sensitive data sources. The governance decisions are not complicated, but they need to be made explicitly before deployment, not after an incident.
Microsoft 365 Governance Framework: A Practical Australian Guide
The Evoltra Microsoft 365 Governance Baseline is the assessment and implementation model used in all Evoltra governance engagements. It structures Microsoft 365 governance across eight control domains, defines four maturity levels and establishes ownership, verification and review requirements for each. It is designed for Australian organisations using Microsoft 365 as their primary productivity and collaboration platform.
Microsoft 365 Security Baseline Checklist
This checklist covers the foundational security controls that every Microsoft 365 environment should have in place before anything more advanced is considered. It is not an exhaustive security audit - it is the minimum viable security configuration that protects against the most common attack vectors targeting Australian businesses on Microsoft 365.