Zero trust in Microsoft 365

"Zero trust" is one of the most overused phrases in security. In a Microsoft 365 context it has a specific, useful meaning: every access decision is made at request time based on user, device, app, and risk signals, and no implicit trust is granted by being inside the corporate network.

The three principles

Microsoft frames zero trust as three principles:

1. Verify explicitly — every access decision uses all available signals (identity, device, location, risk, app, data sensitivity).
2. Use least privilege — just-in-time, just-enough access; PIM and entitlement management.
3. Assume breach — minimise blast radius, segment, encrypt, monitor.

These principles are intentionally generic. The interesting question is what they look like as specific controls in Microsoft 365.

Zero trust in practice

Identity

• MFA enforced everywhere.
• Conditional Access as the policy decision point for every Microsoft 365 sign-in.
• Passwordless for as many users as possible (Microsoft Authenticator, Windows Hello, FIDO2).
• PIM for privileged roles — no standing Global Admins.
• Identity Protection policies for risky users / sign-ins.

Devices

• Intune managing every endpoint, with compliance policies feeding Conditional Access.
• Defender for Endpoint with EDR, ASR rules, tamper protection.
• App protection policies for personal devices (MAM-WE).

Data

• Sensitivity labels classifying data at creation, with encryption attached.
• DLP policies preventing exfiltration through Exchange, Teams, SharePoint, OneDrive, and endpoints.
• Retention policies preserving and disposing data on a clear schedule.
• SharePoint Advanced Management restricting high-risk site access.

Apps

• Defender for Cloud Apps monitoring SaaS posture.
• Conditional Access App Control for session-level controls on SaaS.
• App consent policies limiting which third-party apps users can grant Graph permissions to.

Network

• Network protection in Defender for Endpoint blocking malicious destinations.
• Defender for Cloud Apps identifying shadow IT via firewall/proxy logs.
• Microsoft Entra Private Access and Internet Access (Microsoft's SSE / SASE offerings) replacing legacy VPN and adding identity-aware network controls.

What zero trust replaces

Zero trust replaces the network-as-trust-boundary model: where being on the corporate VPN gave broad access to internal apps. In a zero-trust model, every app is published through Entra ID with Conditional Access — including legacy on-premises web apps via Entra Application Proxy or Entra Private Access.

Where to start

If you're at the beginning: get to the Tier 1 baseline in the Microsoft 365 security baselines guide. That's already 80% of practical zero trust for most organisations. The rest is iterative refinement, not a separate project.

Measuring progress without a single "zero trust score"

Unlike Secure Score, there's no single built-in number for "how zero trust are we" — zero trust maturity is better tracked as a small set of concrete, checkable facts across the five areas above: what percentage of sign-ins are covered by a Conditional Access policy (ideally close to 100%, with named, monitored exceptions only for break-glass accounts); what percentage of admin roles are standing-active versus PIM-eligible; what percentage of managed devices are enrolled and compliance-evaluated versus unmanaged; and what percentage of the tenant's most sensitive data locations carry a sensitivity label. Tracking these four numbers quarterly gives a genuinely actionable maturity signal without needing a vendor's proprietary scoring model layered on top.

A common misreading of "assume breach"

"Assume breach" is sometimes read as fatalism — as if the model concedes that a breach is inevitable and not worth preventing. The more accurate reading is architectural: design every control (segmentation via sensitivity labels and DLP, Continuous Access Evaluation shortening a stolen token's useful life, PIM limiting how much any single compromised account can do) so that if a breach occurs despite the preventive controls, its blast radius and duration are both minimised. Preventive controls (MFA, Conditional Access) and contain-the-blast-radius controls (segmentation, monitoring, short-lived privilege) are complementary, not sequential — a mature zero-trust posture invests in both simultaneously rather than treating detection-and-containment as a fallback only worth building once prevention is somehow "finished."