Applying Essential Eight User Application Hardening to Microsoft Edge and Office Add-ins

User Application Hardening is one of the eight mitigation strategies in the Australian Signals Directorate Essential Eight, and it targets the everyday software that attackers most frequently abuse. Web browsers and productivity suites present a large attack surface because they routinely process untrusted content from the internet, execute extensions, and load add-ins that extend their functionality. For WA Government agencies and aged care providers pursuing a measurable uplift in Essential Eight maturity, translating this control into concrete configuration is where assurance is genuinely earned.

Microsoft Edge and the Microsoft 365 productivity applications sit at the centre of most Australian organisations, which makes them a sensible starting point for hardening work. The advantage of a Microsoft-native environment is that hardening can be delivered consistently through cloud configuration rather than device by device, reducing the risk of drift and undocumented exceptions. This article explains how the User Application Hardening control maps to specific Edge policies and Office add-in restrictions, and how to configure them in a way that stands up to assessment.

Understanding User Application Hardening in the Essential Eight

The Essential Eight Maturity Model describes User Application Hardening across maturity levels one to three, with each level adding requirements and reducing the tolerance for user override. At the lower levels the emphasis falls on web browsers, requiring that they do not process Java or web advertisements from the internet and that their security settings cannot be changed by users. As organisations progress, the control extends to blocking Microsoft Office from creating child processes or executable content, preventing the activation of object linking and embedding packages, and applying vendor and ASD hardening guidance more comprehensively.

The practical implication is that hardening cannot rely on a single toggle or a one-off configuration exercise. Maturity assessment looks for controls that are enforced centrally, cannot be circumvented by end users, and are supported by evidence such as policy exports and configuration baselines. For agencies and providers handling sensitive personal and health information, this rigour matters because a compromised browser session or a malicious add-in can become the entry point for broader intrusion. Treating the control as a set of enforceable, auditable policies rather than guidance is what separates genuine maturity from aspiration.

Hardening Microsoft Edge through cloud policy

Microsoft Edge exposes an extensive set of administrative policies that can be delivered through Microsoft Intune, the Microsoft Edge management service, or group policy for hybrid estates. To satisfy the browser requirements of User Application Hardening, administrators can enforce security settings so that users cannot lower them, disable legacy plug-in behaviour, and constrain how the browser handles content sourced from the internet. Modern Edge no longer supports Java applets or Adobe Flash, which addresses part of the control by design, but the settings that remain configurable should still be locked so that the security posture is deliberate and evidenced rather than incidental.

Extension governance is a further pillar of browser hardening because extensions run with significant access to browsing sessions and can exfiltrate data or inject content. Administrators can use the extension install allow list and block list policies, and the forced install policy, to permit only approved extensions and prevent users from adding their own. Complementary settings such as SmartScreen enforcement, tracking prevention, and restrictions on Internet Explorer mode reduce exposure to malicious advertising and legacy content that the control seeks to eliminate. Managing these policies from the cloud means the same baseline applies to every enrolled device, and any variance becomes immediately visible during review.

Restricting and governing Office add-ins

Office add-ins come in two broad forms, and each requires a different governance approach. Traditional COM and VSTO add-ins run as native code with the privileges of the host application, while web add-ins built on the Office JavaScript platform execute within a sandbox and are deployed through the Microsoft 365 admin centre. The Cloud Policy service for Microsoft 365 Apps allows administrators to control whether users can install their own web add-ins from the store and whether unmanaged add-ins are permitted at all, which directly supports the intent of the hardening control by removing uncontrolled extensibility.

Beyond add-in deployment, the broader Office hardening requirements of the maturity model call for configuration that constrains how the applications behave when they process untrusted documents. This includes preventing the activation of object linking and embedding packages, disabling or tightly controlling macros, and applying Attack Surface Reduction rules through Microsoft Defender to block Office applications from creating child processes, generating executable content, or injecting code into other processes. Delivering these settings through Intune and Cloud Policy produces a coherent, centrally managed baseline, and it generates the configuration evidence that assessors expect to see when verifying the control.

Measuring maturity uplift and maintaining assurance

Achieving a target maturity level is only meaningful if the configuration remains stable and can be demonstrated on request. Organisations should establish documented baselines for both Edge and Office, retain exports of the applied policies, and monitor for configuration drift as new features and settings appear in each product update. Regular review against the current Essential Eight Maturity Model is important because the model is refined over time, and controls that were sufficient previously may need adjustment to remain compliant.

For WA Government agencies and aged care providers, aligning these technical controls with governance processes turns a point-in-time configuration into ongoing assurance. Change management should record every deviation and its justification, and periodic testing should confirm that users genuinely cannot override the enforced settings. When browser and Office hardening are managed together through cloud configuration, the result is a defensible, repeatable posture that supports both security outcomes and the evidence requirements of formal assessment.

References

• ACSC Essential Eight Maturity Model
• Microsoft Edge policy reference
• Overview of Cloud Policy service for Microsoft 365