Book a demo

Constant vs Microsoft for Essential Eight Compliance

Constant and Microsoft security tools can both contribute to Essential Eight work, but they solve different problems. This page compares Microsoft implementation guidance with maturity assessment, assurance, Australian operations, reporting, and pricing based on publicly available information.

Last reviewed: Sources linked below

A factual comparison

Constant

Constant is an Australian compliance platform designed around continuous evidence collection, AI-assisted pre-review, and certified assessor review. It supports Essential Eight alongside additional security and compliance frameworks.

Microsoft

Microsoft publishes Essential Eight implementation guidance for its own tools, including Intune, Microsoft Defender, Windows Defender Application Control, and Microsoft Entra. Purview Compliance Manager has Essential Eight templates for ongoing monitoring.

The primary difference

Microsoft tools implement and monitor the technical controls. Constant sits above those tools to assess maturity, link evidence to requirements, manage gaps, and produce a reviewed assurance outcome. The products are designed to be used together.

At a glance

Six major differences for a quick first read. Detailed comparisons and sources follow.

Capability Constant Microsoft
Primary focus Continuous compliance and assurance 3 Security configuration and control implementation 7
Essential Eight Supported 1 Guides for all eight strategies; not an assessment platform 7
Automated evidence collection Automated where connected 3 Configuration and vulnerability data can be used as evidence 9
Certified assessor review Certified assessor review included 2 Guidance for assessors, not an included assessor 7
Australian operations Designed and operated in Australia 4 Essential Eight guidance is written for Australian organisations 7
Published pricing Public pricing planner 5 Depends on Microsoft 365, Intune, Defender, and Entra licences 7
✓ Verified in published information – Not publicly stated × Explicitly not offered or a different function

Essential Eight and assurance

Framework coverage is different from having a person review whether the evidence supports the claimed maturity level.

Capability Constant Microsoft
Essential Eight Supported 1 Guides for all eight strategies; not an assessment platform 7
Maturity assessment ML1, ML2, and ML3 1 Implementation guidance and templates for all three maturity levels 7
Certified assessor review Certified assessor review included 2 Guidance for assessors, not an included assessor 7
Ongoing reassessment Continuous reassessment workflow 1 Purview Compliance Manager templates for continuous assessment 7
ASD Essentials Included in the price with Essential 8 6 , 5 Not publicly stated

Evidence and automation

This separates connected collection and automated checks from uploaded evidence and final assessment judgement.

Capability Constant Microsoft
Automated evidence collection Automated where connected 3 Configuration and vulnerability data can be used as evidence 9
Microsoft integrations Supported Microsoft security tooling 1 Intune, Defender, Entra, and Windows security controls 7 , 8
Evidence uploads Manual upload where not connected 3 Not publicly stated
AI evidence review AI pre-review, then assessor review 2 Copilot for Microsoft 365 inherits existing Essential Eight controls 7
Continuous monitoring Live posture and gap visibility 3 Compliance Manager monitoring and configuration drift checks 7
Evidence history Evidence linked to the assessed record 3 Remediation activity can be tracked in Defender and Intune 9

Compliance management

Planning, ownership, risk, and framework breadth shape how the platform supports work after the first assessment.

Capability Constant Microsoft
Control owners Control and remediation owners 3 Administrative roles are described; a compliance owner workflow is not 10
Planner, tasks and due dates Built-in planner, tasks, and due dates 3 Defender remediation requests can create Intune activities 9
Reporting On-demand, scheduled, customisable 3 Compliance Manager and Defender views 7 , 9
Risk management Structured risk assessments 3 Device risk can feed Conditional Access; not a compliance risk register 11
Multiple frameworks Essential 8 and additional frameworks 3 Essential Eight guides, plus IRAP templates in Compliance Manager 7
Framework mapping Framework-specific control workflows 3 Controls mapped to Essential Eight maturity levels 7 , 9

Australian operations

Ownership, operations, data residency, assessors, and support are separate claims and are compared separately.

Capability Constant Microsoft
Australian ownership Australian-owned by Steltek Pty Ltd 4 US company, not Australian-owned 7
Australian operations Designed and operated in Australia 4 Essential Eight guidance is written for Australian organisations 7
Australian data residency Australian data residency 4 Australian customer-data hosting is not stated on the Essential Eight guides
Onshore assessors Australian assessor review 2 Guidance for assessors, not an included assessor 7
Australian support hours Australian business-hours support 3 Australian Essential Eight support hours not stated on the guides

Commercial

Published pricing and included services can materially change the cost of reaching a reviewed outcome.

Capability Constant Microsoft
Published pricing Public pricing planner 5 Depends on Microsoft 365, Intune, Defender, and Entra licences 7
Implementation assistance Clear assessor-written control guidance 3 Step-by-step Intune and Defender configuration guidance 7 , 8
Assessor costs Assessor review included in paid plans 5 Guidance for assessors, not an included assessor 7
Target customer Teams that need reviewed compliance outcomes 3 Organisations implementing Essential Eight with Microsoft tools 7

Key differences explained

Different job

Microsoft shows how to configure Intune, Defender, Entra, and Windows so the eight strategies can be implemented. Constant records whether that implementation meets a maturity level, keeps the evidence with the control, and has a certified assessor review the result.

Point in time, then monitoring

Microsoft says following the Essential Eight documents is a point-in-time activity. It recommends Purview Compliance Manager templates, at all three maturity levels, to watch for configuration drift. That monitoring still sits in the Microsoft security stack rather than in an assessment record.

Using both

A team can enforce application control, patching, macros, hardening, admin rights, MFA, and backups with Microsoft tools, then use Constant to assess maturity and report it. The Microsoft licence map for Essential Eight is described by Microsoft as a community project, not an official price list.

Which approach may fit?

Neither approach is presented as universally better. They are designed around different priorities.

Constant may suit organisations looking for

  • Essential Eight maturity assessment across the controls Microsoft has implemented
  • Certified assessor review included in the workflow
  • Australian ownership, operations, data, and support
  • One record when evidence also comes from other tools

Microsoft may suit organisations looking for

  • Native controls for the eight Essential Eight strategies
  • Intune, Defender, and Entra configuration guidance by maturity level
  • Compliance Manager templates for monitoring and drift
  • The security tools many Australian organisations already license

Methodology and sources

How we compared the platforms

This comparison uses publicly available product documentation, vendor websites, security information, and published pricing paths reviewed on 23 September 2026. Where a capability could not be verified, it is marked “Not publicly stated” rather than treated as unavailable.

  1. 1 Constant: Essential Eight compliance software
  2. 2 Constant: Essential Eight with assessor review
  3. 3 Constant: Platform workflow and features
  4. 4 Constant: Security and Australian operations
  5. 5 Constant: Public pricing planner
  6. 6 Constant: ASD Essentials transition tracker
  7. 7 Microsoft: Essential Eight overview
  8. 8 Microsoft: Application control guidance
  9. 9 Microsoft: Patch applications guidance
  10. 10 Microsoft: Restrict administrative privileges
  11. 11 Microsoft: Defender and Intune integration

Questions answered

What is the difference between Constant and Microsoft?

Microsoft tools implement and monitor the technical controls. Constant sits above those tools to assess maturity, link evidence to requirements, manage gaps, and produce a reviewed assurance outcome. The products are designed to be used together.

Do Constant and Microsoft support Essential Eight?

Constant supports Essential Eight maturity assessment with evidence, AI pre-review, and certified assessor review. Microsoft: Guides for all eight strategies; not an assessment platform.

Does Microsoft include certified Essential Eight assessor review?

Microsoft: Guidance for assessors, not an included assessor. Constant includes certified assessor review in its paid-plan workflow.

Can Constant automatically collect Essential Eight evidence?

Yes. Constant collects evidence automatically where a supported integration is connected. Teams can upload evidence where a connector is not used. AI pre-reviews either source before a certified assessor reviews the result.

Where does Constant store Australian customer data?

Constant publishes Australian data residency and says the platform is designed, owned, and operated in Australia by Steltek Pty Ltd.

Does Constant support ASD Essentials?

ASD Essentials is included in the price with Essential 8. Constant continues to assess Essential Eight until ASD publishes requirements that can be implemented and assessed, and the transition tracker is updated as official information is released.

Is Constant a GRC platform?

Constant supports compliance and risk workflows, but its published focus is continuous evidence and reviewed compliance outcomes. It combines framework guidance, evidence, remediation, AI pre-review, certified assessor review, and reporting in one workflow.

How does Constant use AI differently from Microsoft?

Constant uses AI to pre-review compliance evidence before a certified assessor reviews the result. Microsoft says Copilot for Microsoft 365 inherits the Essential Eight controls already configured in Office, and does not run on a macro-enabled document.

Related comparisons

Comparisons

Factual comparisons of Constant with other Essential Eight approaches.

Constant vs Huntress

Managed detection and log evidence compared with Essential Eight assurance.

Evidence collection

Automated Essential Eight evidence collection, plus upload where needed.

Assessor review

Automated evidence, AI pre-review, and a certified assessor behind the result.

Start your compliance journey today

Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.

Ready to simplify your compliance process?

Book a demo and see constant in action.

Book a Demo Explore More

All Paid Plans Include

  • Unlimited human assessor reviews

  • Evidence collection

  • AI-assisted pre-reviews

  • Compliance dashboards

  • Australian business-hours support

  • On-demand reporting

  • Control owners and tasks

  • Evidence uploads

  • Maturity and gap tracking

  • Role-based access controls

  • Framework guidance

  • 5×5 Risk Matrix

  • Australian data residency