TenuVaultDesktopPractical guide
Essential Eight Intune checks
Essential Eight Intune checks show how selected tenant settings map to the ASD framework at a chosen target maturity level. TenuVault provides configuration findings; you still need evidence of implementation and effectiveness to assess maturity.
Which Essential Eight maturity level am I targeting?
An administrator may have application restrictions, update policies and authentication settings spread across several profiles. Start with the ASD Essential Eight maturity model and agree the target with the person responsible for the assessment. ASD describes the strategies as complementary and recommends reaching the same maturity level across all eight before moving higher.
TenuVault supports a native ASD Essential Eight comparison with a target maturity level from 1 to 3. That selector changes the comparison target; it does not award a maturity level. Keep the chosen target with the platform scope so reviewers can distinguish an intentional boundary from evidence you have not collected.
Where do I check the Essential Eight in Microsoft tools?
For a Windows review, start with application control in Intune Endpoint security. App Control for Business policies govern which applications may run; inspect the assigned policy rather than assuming an application inventory proves control. For Office macros, review the relevant Settings Catalog settings and any Administrative Templates already used for those users. Record permitted exceptions so the application control and macro reviews do not contradict each other.
Next examine Windows update rings for deferrals, deadlines and restart behavior. Rings govern when Windows updates install; they do not establish that every application is patched. Keep application patching as its own operational check and use device update results when investigating overdue operating system updates.
Multifactor authentication needs a separate look in Microsoft Entra Conditional Access, including the chosen authentication strength and exclusions. A device configuration report cannot answer which cloud resources that policy protects. These are starting points for the ASD strategies, not a replacement for the maturity model: backup recovery tests and checks that protections work still need their own records.
How do I select the Essential Eight comparison target?
1. Open ASD Essential Eight under Frameworks for the selected tenant. Read About this comparison before choosing a Target maturity level from 1 to 3.
2. Set Platforms in scope to the systems you are examining and include Conditional Access for the authentication portion. Start the read-only run with Compare settings.
3. Use the result tiles to find missing or different capabilities at that target. In Setting-by-setting evidence, inspect the policy values and assignments behind the application, update or authentication finding.
4. Check Framework references to connect those observations to the model. Export the saved comparison and keep its target level with your list of operational checks.
The Essential Eight comparison and its three export formats are available in Community; a target selection is not a paid maturity assessment.
Which Essential Eight Intune checks need device testing?
Review application control, patching, macro restrictions, application hardening, administrative privileges, multifactor authentication and backup practices against the owner's model. Treat those as review areas, not a claim that every requirement has an Intune detector. A configured update policy does not establish patch timeliness. A backup schedule does not establish recovery effectiveness. Arrange operational checks for both, and follow ASD assessment guidance when deciding what evidence is sufficient.
If macro restrictions match but an approved exception group is broader than intended, investigate that group before treating the observation as resolved. If an update policy matches, ask whether devices installed updates within the required process. In both cases the policy value answers only part of the practical question.
Use the ASD assessment process to decide how to test effectiveness at the chosen target. TenuVault does not determine an achieved maturity level. Keep unknown results visible until you can explain the missing information, and distinguish them from platforms deliberately excluded from the comparison.
How can I try an Essential Eight check?
Try TenuVault on a Windows scope with a named Essential Eight target level. Review one macro, application control or update finding with the administrator who owns that protection.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Does a matching result mean maturity level 1 is achieved?+
No. The selected level is a comparison target. An achieved maturity level requires assessment beyond configuration mapping.
Should I include Conditional Access?+
Include it when it is inside your review scope. Record the selection so an excluded capability is not mistaken for a checked one.
Can Intune policy evidence prove recovery works?+
No. Keep recovery tests and operational records alongside configuration findings, using the assessment methods appropriate to your scope.