Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.
Why the evidence pack matters
Australian organisations seeking to demonstrate Microsoft 365 Copilot alignment to ASD Essential Eight Maturity Level 2 will, at some point, encounter the assessment moment — an internal audit, an IRAP scope review, a board risk committee report, or a tender response. In every case, the artefact that determines the outcome is the evidence pack. Controls without consolidated evidence may be technically in place but cannot be efficiently demonstrated; controls with consolidated evidence can be reviewed in minutes.
The Australian Government Information Security Manual (Australian Signals Directorate — ISM, accessed 16 June 2026) and the ASD Blueprint for Secure Cloud both anchor the evidence expectation. An IRAP assessor will request documented policy, current configuration evidence, the name of the control owner, and the attestation cadence — not for every conceivable control, but for the controls in scope for the assessment. For a Copilot deployment, the Essential Eight Maturity Level 2 controls described in the 2026 control mapping define that scope.
This how-to is the operational checklist. It describes the folder structure, the artefact set, the cross-cutting artefacts, the attestation log format, and the rhythm of maintenance. It is written for the security engineer or compliance manager who has to assemble the pack and present it to an internal or external reviewer.
Where this fits: the Copilot scope sits inside the wider Maturity Level 2 programme. The pillar guide on mapping Microsoft 365 Copilot to Essential Eight Maturity Level 2 walks every control and the assessor mindset. Before you assemble the pack, run the free Copilot and Essential Eight Alignment audit to confirm which control is your current gate.
The folder structure
The recommended folder structure for the Copilot scope is one parent folder per Essential Eight control, with three cross-cutting folders for evidence that applies across multiple controls. Each control folder contains the same five artefacts.
/Essential-Eight-Evidence-Pack/
/00-Control-Mapping-and-Scope/
01-Scope-Statement.docx
02-Copilot-Configuration-Inventory.xlsx
03-Control-Mapping-Document.docx
/01-Application-Control/
01-Control-Summary.docx
02-Policy.docx
03-Configuration-Screenshots/
04-Owner-and-Attestation.docx
05-Attestation-Log.xlsx
/02-Patch-Applications/
... same five-artefact pattern ...
/03-Configure-Microsoft-Office-Macro-Settings/
/04-User-Application-Hardening/
/05-Restrict-Administrative-Privileges/
/06-Patch-Operating-Systems/
/07-Multi-Factor-Authentication/
/08-Regular-Backups/
/99-Cross-Cutting-Evidence/
01-Purview-Audit-Exports/
02-Customer-Lockbox-Events/
03-Privileged-Identity-Management-Activations/
The folder structure should be hosted in a SharePoint document library with sensitivity-labelled access (Confidential or higher) and Restricted Access Control applied to the parent site. Apply Restricted Content Discovery to the library's site so that Copilot cannot ground responses against the evidence pack itself.
The five artefacts per control folder
Each control folder contains the same five artefacts. Consistency is what makes the pack reviewable.
Control summary (one page): A one-page document that states the Essential Eight Maturity Level 2 requirement in the assessor's language, the Microsoft 365 configuration that delivers it, the named control owner, and the current attestation status (Aligned · Partially Aligned · Non-Aligned). The summary should be readable by someone without deep Microsoft 365 knowledge — board members and IRAP assessors are both potential readers.
Policy document: The organisational policy that mandates the control. For Copilot scope, this is typically a one-page extension of the broader Acceptable Use Policy, the Information Security Policy, or the Cloud Services Policy. It states what is required and who is responsible. It should reference the ASD Essential Eight Maturity Model (Australian Cyber Security Centre — Essential Eight maturity model, accessed 16 June 2026) by version date and the ASD Blueprint for Secure Cloud where applicable.
Configuration screenshots (dated): Current screenshots of the Microsoft 365 administrative configuration that delivers the control. Each screenshot should include a visible date — either from the administrative interface itself or as a file metadata timestamp — within the last ninety days. Stale screenshots are a finding; an assessor cannot verify that the configuration is current without a recent timestamp.
Owner and attestation: A short document naming the control owner (role and individual), the approver, and the attestation date of the most recent ninety-day review. The named role should align with the organisational chart current at the assessment date.
Attestation log: A spreadsheet with one row per ninety-day review going back at least twelve months. Columns: review date, reviewer, configuration state, material changes since last review, finding (Aligned · Partially Aligned · Non-Aligned), remediation actions if any, next review date. The log is the rhythm artefact — it shows the assessor that attestation is operational, not theatrical.
Control-specific artefacts for the Copilot scope
Beyond the five-artefact pattern, certain controls have Copilot-specific configuration evidence that should be included in the configuration screenshots folder.
Control 1 (application control): Screenshot of Copilot Control System publishing gates configuration showing the approver group and logging setting. Screenshot of the Power Platform data loss prevention policy showing connector classification. The current agent register with all rows. The companion how-to on application control for Copilot Studio agents documents these artefacts in detail.
Control 2 (patch applications): Screenshot of the Microsoft 365 Apps update channel assignment for the Copilot-licensed population. Screenshot of the Edge for Business update policy. Intune device compliance report exported within the last ninety days showing Microsoft 365 Apps and Edge version compliance.
Control 4 (user application hardening): Screenshot of the Restricted Content Discovery settings for each protected site, and the list of sites with Restricted Access Control applied. The ninety-day review record for those sites. Screenshot of the Office Cloud Policy configuration applied to the Copilot-licensed population.
Control 5 (restrict administrative privileges): Screenshot of the Privileged Identity Management role configuration for Copilot Administrator, SharePoint Administrator, Global Administrator, and Privileged Role Administrator showing eligible-not-permanent assignment. PIM activation log export for the last ninety days. Customer Lockbox enabled-state screenshot and event log export.
Control 7 (multi-factor authentication): Screenshot of the Conditional Access policy set covering Copilot endpoints — the Require multi-factor authentication for all users, Require phishing-resistant authentication for administrators, and Block legacy authentication policies are the minimum set. Sign-in log export filtered for failed authentication attempts in the last ninety days.
Control 8 (regular backups): Screenshot of the Microsoft 365 Backup configuration (or the third-party backup vendor's equivalent) showing daily backup of SharePoint, OneDrive, Exchange, and Teams. Most recent restoration test record — the document that records a tested restoration of a known-good item, including the requestor, the item recovered, and the verification outcome.
Cross-cutting artefacts
Three artefacts apply across multiple controls and warrant their own folder.
Purview Audit exports: The unified audit log is the primary forensic record for both Copilot and the configuration controls around it. A ninety-day audit log export filtered for the relevant event categories — Copilot interactions (where Audit for Copilot is enabled), agent publishing events, administrator role activations, Conditional Access policy changes, and changes to Restricted Content Discovery and Restricted Access Control settings — is the highest-value cross-cutting artefact.
Customer Lockbox events: Customer Lockbox event logs over the assessment period. In most Australian tenants this is a short log — most tenants have zero Microsoft engineer access requests during a quarter. The empty log is still the evidence; an assessor wants to see that the control is enabled and that the log is reviewed.
Privileged Identity Management activations: The PIM activation log for the assessment period showing every privileged role activation. Each activation should include a justification, a duration, and a record of multi-factor authentication. A PIM activation without a documented justification is a Control 5 finding worth resolving before assessment.
The attestation rhythm
The attestation rhythm is what carries the evidence pack forward through time. Practitioner experience suggests the following schedule for Australian organisations operating Microsoft 365 Copilot at Maturity Level 2.
Every thirty days: review the Purview Audit log for anomalous Copilot interactions, review the PIM activation log for activations without documented justification, and review the Conditional Access sign-in failure log for the Copilot-licensed population. Every ninety days: refresh the configuration screenshots for each control folder, complete the attestation log row for each control, review the sites protected with Restricted Content Discovery, and review the Copilot Studio agent register. Annually: full evidence pack refresh, including policy review, control owner reattestation, and ASD Essential Eight Maturity Model version-date alignment check.
Practitioner note: Microsoft typically refreshes the Microsoft Learn documentation for security controls every quarter. The annual policy review should include a documentation-currency check — references to Microsoft Learn URLs and the ASD Blueprint for Secure Cloud version date should be current within the last twelve months.
Common findings to address before assessment
Across Australian Microsoft 365 Copilot deployments, the most common evidence-pack findings at first assessment are: configuration screenshots older than ninety days; attestation logs with gaps in the ninety-day rhythm; the Copilot Studio agent register absent or incomplete; PIM activations without documented justification; protected-site review not on the ninety-day cadence; and the absence of a tested restoration record for Microsoft 365 Backup.
Each of these findings can be resolved within a single quarter of disciplined operation. Run the free EDUC4TE Copilot and Essential Eight Alignment audit to identify which of these gaps apply to your tenant before the assessor arrives.
Summary
An IRAP-format Essential Eight evidence pack for the Copilot scope is a folder structure, a consistent artefact set, and a documented attestation rhythm. One folder per control. Five artefacts per folder. Three cross-cutting artefact folders. A thirty- and ninety-day operational rhythm with an annual refresh. The work is overwhelmingly documentation rather than configuration — most Australian organisations targeting Maturity Level 2 already have most of the controls in place; what they lack is the consolidated evidence pack that lets an assessor verify alignment efficiently.
Assemble the pack once, then maintain it on the cadence. The first assessment is the hardest; every subsequent assessment becomes a refresh, not a rebuild.
Sources referenced in this article: Australian Government Information Security Manual (ISM), ASD Essential Eight Maturity Model, ASD Blueprint for Secure Cloud, Customer Lockbox (Microsoft Purview), Restricted Content Discovery (Microsoft Learn), Privileged Identity Management.
