Identity and security
Zero Trust
Zero Trust is a security architecture built on the premise that no user, device, or network location should be trusted by default, regardless of whether it sits inside or outside a traditional network perimeter.
Why Zero Trust matters in a Microsoft estate
Zero Trust matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How Zero Trust shows up in practice
It replaces the older model where anything already inside the corporate firewall was implicitly trusted, a model that stopped matching reality once remote work, cloud-hosted applications, and personal devices meant most access no longer traversed that firewall at all. Microsoft's framing of Zero Trust rests on three operating principles: verify explicitly, meaning every access request is authenticated and authorised based on all available signals, identity, device health, location, and data sensitivity, rather than being granted on the basis of network position alone; use least privilege access, limiting what any given identity can reach to only what its current task genuinely requires, ideally through just-in-time rather than standing access; and assume breach, designing controls on the expectation that some compromise will eventually occur and that its impact should be minimised through segmentation, monitoring, and rapid detection rather than relying entirely on prevention succeeding.
These principles get applied across six generally recognised pillars, identities, endpoints, applications, data, infrastructure, and network. Zero Trust is deliberately not a single product that can be purchased and switched on; it is a strategy realised through the coordinated configuration of existing tools, Conditional Access enforcing per-request identity and device signals, Multifactor Authentication and phishing-resistant credentials strengthening the identity pillar, Intune-enforced device compliance feeding into access decisions, Purview sensitivity labels and DLP protecting data regardless of where it moves, and network micro-segmentation limiting lateral movement once a foothold is gained. None of these delivers Zero Trust in isolation.
The most common implementation failure is treating Zero Trust as a single project with a completion date, deploying Conditional Access and calling the initiative finished, when in practice the assume-breach principle demands ongoing work: continuous monitoring, regularly re-evaluated trust signals, and periodic access reviews that catch privilege creep, since a security posture that was correctly configured on day one degrades steadily as roles change, new applications get added, and exceptions accumulate if nothing revisits it. For organisations coming from a VPN-centric, perimeter-based model, the transition is as much cultural and procedural as it is technical, since it requires accepting that internal network traffic gets scrutinised with the same rigour as external traffic, and that 'the user is already on the corporate network' stops being treated as a legitimate access justification on its own.