Zero Trust in Microsoft 365 and Azure: a practical guide

How to apply Zero Trust to a specific work path

Zero Trust in Microsoft 365 and Azure is more understandable when applied to real access. An employee who opens a document from outside the office uses an identity, device, application, and resource with their permissions. Each element provides different information to decide access and limit what can be done later with the data.

The first check is whether the account belongs to the intended person and uses the required authentication. The device and session conditions that the design has established are then evaluated. Finally, the permission on the document is reviewed. Passing authentication should not grant access to all company information: the resource still requires appropriate authorization for that user and that task.

In an illustrative example, a purchasing person can view a file and collaborate with their team without having permissions on other departments’ contracts. If you change roles, the access review process should reflect this. This lifecycle control prevents a well-configured access policy from coexisting with historical permissions that no longer have an operational justification.

How to prioritize without turning security into a general block

The plan should start with the accesses and resources with the greatest exposure or impact, and with the controls that the organization can operate. A device condition that cannot yet be met in a large part of the park needs preparation before being expanded. The pilot serves to discover these requirements and to provide instructions that allow the user to recover a correct situation.

Validation combines tests that are allowed and tests that should be prevented. The policy that intervened, the result and the reason are documented. Addressing an incident is also rehearsed and exceptions are reviewed. This monitoring avoids measuring progress by the number of products deployed and relates it to accesses that are now better controlled and can be explained with evidence.

What Zero Trust really is

Zero Trust does not mean that a company “trusts no one.” It means that trust is not granted solely by a static condition such as being connected from the office. Each access request must be evaluated using the available context.

Microsoft Entra Conditional Access brings together many of these signals and acts as a decision engine for access. But Zero Trust doesn’t end at Conditional Access. A properly authenticated account from a compromised laptop still poses a risk. A legitimate user who has access to too much data as well. And an application with excessive permissions can access without any interactive login.

Official reference: Microsoft – Zero Trust adoption framework.

The three principles of Zero Trust

1. Verify explicitly. The decision should use as many relevant signals as is reasonable. It is not enough to check username and password. We can assess: MFA, phishing-resistant authentication, device, location, application, risk and resource sensitivity. 2. Use least privilege. The user should only have the access they need. This affects both: administrative roles, Azure permissions, SharePoint, groups, business applications, service principals and local privileges in Windows.

3. Assume gap. The architecture must be considered taking into account that any credential, device, application or session may end up being compromised. That means limiting lateral movement, reducing privileges, segmenting access, recording activity, and having the ability to investigate and respond.

Pillars of a Zero Trust architecture in Microsoft 365 and Azure

Where to start: risk before product

One of the most common mistakes is to start by asking: “What E5 features can we activate?” Ask instead: “What are the most likely ways to compromise our environment right now?” In many organizations the initial priority is usually here.

1. Identity: the new security perimeter

Microsoft Entra ID controls much of the access to Microsoft 365, Azure, and numerous SaaS applications. That’s why any Zero Trust strategy should start by understanding identities. Minimum inventory.

Remove unnecessary identities before adding policies. An old account that retains permissions is a risk even if you have MFA. Before sophisticated authentication, it is worth eliminating: obsolete users, unnecessary administrators, abandoned applications and permissions that no longer have an owner.

MFA: necessary, but not all methods offer the same level of protection

Multi-factor authentication should be part of the Microsoft 365 baseline. Microsoft is also progressively applying mandatory MFA to different Azure and administrative experiences. Therefore, there is no point in waiting for the platform to impose it. The goal shouldn’t just be “activate MFA.” We also have to decide which methods we consider appropriate for each profile.

Authentication Strengths. Microsoft Entra currently offers three integrated strengths: MFA, passwordless MFA and phishing-resistant MFA. It also allows you to create custom combinations. For administrators. Microsoft currently recommends using phishing-resistant authentication for sensitive administrative roles. Suitable methods include scenarios based on: FIDO2/passkeys and Windows Hello for Business when they meet the requirements of the organization. Prepare the methods first.

A policy that requires phishing-resistant authentication before administrators have the proper method can block access. The order should be: registration → pilot → Report-only → validation → enforcement. Official references:

• Microsoft – Require phishing-resistant MFA for administrators
• Microsoft – Authentication strengths

Conditional Access: the Zero Trust policy engine

Microsoft Entra Conditional Access evaluates signals and decides what requirements an access must meet. You can use information related to: users, groups, roles, resources, applications, device, location, risk, platform and authentication method. Conceptual example.

Conditional Access requires licensing. Conditional Access policies require Microsoft Entra ID P1 or a product that includes that capability. For example: Microsoft 365 Business Premium and Microsoft 365 E3. Official reference: Microsoft – Conditional Access Overview.

Which Conditional Access policies would you raise first?

We do not recommend creating 30 policies on the first day. A simpler starter set is easier to understand, test, and maintain.

Report-only before blocking. The mode Report-only allows you to evaluate what would have happened to a policy without applying control during most scenarios. The results appear associated with the login records. This allows detecting: affected users, incompatible applications, special accounts and legitimate exceptions. What If. Conditional Access’ What If tool also helps evaluate how policies might apply to a given scenario.

Official reference: Microsoft – Conditional Access report-only mode.

Identity Protection and risk-based policies

Microsoft Entra ID Protection analyzes signals to identify login risk and user risk. Sign-in risk. Represents the probability that a given authentication attempt is not legitimate. User risk. Represents the probability that the user’s identity is compromised. Adaptive response. We can design policies that, depending on the level of risk: allow, require MFA, require remediation, request a secure password change, or block access.

Important change of 2026. The former standalone Identity Protection risk policies are being retired on October 1, 2026. Microsoft recommends moving those controls into risk policies within Conditional Access. Licensing. Identity Protection’s risk capabilities require appropriate licensing, typically associated with Microsoft Entra ID P2 or products that include it. Official reference: Microsoft – Risk-based access policies.

PIM: Just because an administrator can manage doesn’t mean they have to be an administrator all day

Permanent privileged roles increase the potential impact of a compromised account. Microsoft Entra Privileged Identity Management allows certain permanent assignments to be transformed into eligible access. Example. Instead of: user → Permanent Global Administrator we can propose: user → eligible role → activation when needed → MFA → justification → limited duration. PIM can provide.

Not every administrator needs Global Administrator. We should also use specific roles: Exchange Administrator, SharePoint Administrator, Teams Administrator, Intune Administrator, Security Administrator when they cover the necessary task. Updated licensing. PIM can currently be used by Microsoft Entra ID P2 or Microsoft Entra ID Governance, depending on the scenario and licensing requirements. Official reference: Microsoft – Privileged Identity Management.

Emergency Accounts: Prepare for the Error of Our Own Policies

Conditional Access is a very powerful tool. This is precisely why incorrect configuration can block the administrators themselves. Emergency access. Microsoft recommends having carefully protected and monitored emergency accounts. These accounts are not normal users. They should not be used for: daily mail, browsing, Teams or routine administration. What should we control?

Guests and collaboration external

Zero Trust should also cover external users. SharePoint, Teams and other applications allow you to collaborate with customers, suppliers and partners. The goal should not be to disable all external collaboration, but to govern it. Important questions.

Access Reviews. Access reviews allow you to periodically recertify whether certain users still need to belong to groups or access resources. Official reference: Microsoft – Access Reviews.

Enterprise applications, OAuth and core services: the access we don’t always see

A good Zero Trust architecture cannot focus solely on human users. Apps also get permissions. Enterprise Applications. It is advisable to review periodically: active applications, assigned users, permissions granted, owners and last use. App registrations. An application record can have: delegated permissions, application permissions, secrets and certificates. Application permissions are especially sensitive. An app with permissions such as broad access to mail, SharePoint sites, or directory can act without a user pressing any buttons.

Good design decisions.

2. Devices: the identity may be correct and the computer may be compromised

If an attacker controls an endpoint that already has a valid session, MFA alone may not be enough. That’s why Zero Trust incorporates the state of the device into the access decision. Microsoft Intune. Intune can manage: configuration, compliance, applications, updates, encryption and different security policies. Compliant does not mean “safe forever.” Compliance is the result of a policy at a given time.

We must combine: management, updating, endpoint protection, Conditional Access, monitoring. Example of compliance.

Microsoft Defender for Endpoint

Defender for Endpoint provides endpoint protection, detection, and response capabilities within supported plans. The combination with Intune is especially useful because we can incorporate certain device risk signals into access policies. A compromised endpoint should not retain unlimited access. A mature architecture tries to connect: detection → device status → access policy → response.

Endpoint Privilege Management: fewer permanent local administrators

Many users have local administrator privileges because some application needed them at some point. This increases the impact of malware, script execution and lateral movement. Microsoft Intune Endpoint Privilege Management allows the user to work as standard and only perform controlled tasks. Do not remove local admin first and ask later. Implementation should begin by observing what elevations are performed.

Licensing 2026. Endpoint Privilege Management requires a specific license capacity. It can be purchased as an add-on/Intune Suite and, following packaging changes in 2026, is also part of Microsoft 365 E5 in the new commercial package. Official reference: Microsoft – Endpoint Privilege Management.

Hotpatch: reduce certain reboots, not eliminate them

Hotpatch can apply certain quality updates without performing the usual reboot of a full cumulative update. But it doesn’t mean: “Windows never restarts.” Current requirements. Microsoft currently documents Hotpatch for certain devices with: Windows 11 24H2 or later, eligible license and Intune to manage policy. Documented eligible licenses. Among the current ones are: Windows Enterprise E3/E5, Microsoft 365 F3, Microsoft 365 Business Premium, and Windows 365 Enterprise, in addition to certain Education plans.

Baseline updates. Devices still require periodic baseline updates that may require rebooting. Official reference: Microsoft – Hotpatch updates.

3. Mail: Exchange Online and Defender for Office 365

Email continues to be one of the most relevant attack vectors for any organization. Zero Trust should consider: phishing, Business Email Compromise, malware, malicious URLs, attachments, impersonation and abuse of compromised accounts. Exchange Online Protection. Cloud mailboxes have base protection capabilities through Exchange Online Protection. Defender for Office 365 Plan 1. Adds additional controls for email and collaboration, such as functionality related to: Safe Links, Safe Attachments and protection against certain advanced threats.

Defender for Office 365 Plan 2. Adds superior capabilities related to: investigation, hunting, automation, response and Attack Simulation Training. Standard and Strict. Microsoft publishes recommended configurations grouped into two levels: Standard and Strict. Policies should be tailored to risk and user experience, but starting from the manufacturer’s recommendations is preferable to creating all values from scratch without reference.

Official reference: Microsoft – Recommended security settings for EOP and Defender for Office 365.

SPF, DKIM and DMARC: Protect domain identity

A secure email architecture doesn’t end at Defender. We also need to demonstrate which services can legitimately send on behalf of our domains.

Do not implement DMARC blindly. Before applying p=reject We should know all the legitimate sources: Microsoft 365, CRM, ERP, web, marketing, tickets and any SaaS platform. Practical sequence. inventory → SPF/DKIM → DMARC monitoring → analysis → quarantine/reject. Official references:

• Microsoft – Configure SPF
• Microsoft – Configure DKIM
• Microsoft – Configure DMARC

4. Data: Zero Trust should also ask what information we are protecting

A user can successfully bypass MFA, use a compliant device, and still have access to information they should never have seen. Data protection therefore needs its own strategy. Microsoft Purview. Purview brings together different solutions related to:

Don’t start with 20 labels. An overly complex classification causes users to stop understanding the system. It is preferable to start with a simple taxonomy and expand it when there is a real need. DLP first in test mode. A policy that blocks identification numbers or financial information can generate false positives. Before blocking we should: detect → measure → adjust → communicate → apply.

Official references:

• Microsoft – Sensitivity Labels
• Microsoft – Data Loss Prevention
• Microsoft – Retention

SharePoint, OneDrive and Teams: historical permission is also a risk

A very important part of data security is not in Purview, but in the permissions. Examples of risk.

Review before adding AI. The better SharePoint is organized and governed, the easier it is to later implement search, Copilot, Purview, and other reporting capabilities.

Zero Trust and Microsoft 365 Copilot

AI experiences further increase the importance of controlling identity, permissions, and data. Microsoft 365 Copilot uses information that the user has access to. Therefore: Copilot doesn’t itself create incorrect permission, but it can make it much easier to find information that was already overshared. Before wide deployment.

5. Zero Trust in Azure

Azure considerably expands the surface we must protect. In addition to users we have: subscriptions, resources, virtual machines, applications, networks, storage accounts, databases, Kubernetes, Key Vault, managed identities and service principals. A good Azure architecture should ask yourself.

RBAC, PIM and Managed Identities in Azure

The principle of least privilege is especially important in Azure. Avoid Owner global for convenience. Assigning Owner at the subscription level to resolve any issues quickly creates excessive privilege surface. It is advisable to use: specific roles, specific scopes, PIM when applicable. Managed Identities. When an Azure resource needs to authenticate against another service, a Managed Identity can avoid storing credentials or secrets in code.

Main services. When it is necessary to use an application: limit permissions, use certificates when appropriate, rotate credentials, and assign owners.

Network and public exposure in Azure

Zero Trust doesn’t mean the network stops mattering. It means that the network is no longer the only frontier of trust. Review exhibition. In particular: RDP, SSH, databases, storage, APIs, web applications and administrative panels. PaaS services. When justified, controls such as: Private Endpoints, service firewall, IP restrictions and Managed Identities. Segmentation. Networks should be designed to limit lateral movement and separate workloads with different needs.

Microsoft Defender for Cloud

Defender for Cloud helps evaluate the security posture of resources and workloads. Provides recommendations related to: configuration, vulnerabilities, identity, exposure, encryption, endpoints, logging and other controls. Microsoft Cloud Security Benchmark. Enabling Defender for Cloud uses the Microsoft Cloud Security Benchmark as the default benchmark to evaluate in-scope resources. More than Azure. Defender for Cloud can also be extended to supported multicloud environments such as AWS and Google Cloud.

Relevant change in 2026. Starting in June 2026, more multicloud recommendations contribute to the Defender for Cloud Secure Score. Therefore, a percentage change does not always mean that security has worsened; It may be because we are now evaluating more assets and recommendations. Official reference: Microsoft – Defender for Cloud Secure Score.

6. Monitoring and response: assuming a gap means being able to see it

Zero Trust does not end up blocking access. We must also respond to the possibility of a control failing. Microsoft Defender XDR. It allows signals from different compatible areas of the Microsoft environment to be correlated. Microsoft Sentinel. It can be used as a SIEM/SOAR when the organization needs to centralize logs, correlate events, and automate certain response processes. What should exist as a minimum.

Microsoft Secure Score: use it as a compass, not an exam score

Microsoft Secure Score measures security posture based on recommended actions within supported Microsoft products. You can help us: identify improvements, prioritize actions, observe trends and compare status over time. There is no universally correct percentage. An arbitrary goal like: “we have to reach 90%” can lead to applying controls that do not make sense for our context.

Evaluate each recommendation.

Secure Score does not guarantee security. Microsoft makes it expressly clear that the score does not represent an absolute probability of whether or not you will be breached. Official reference: Microsoft – Microsoft Secure Score.

Cloud Secure Score: The Defender for Cloud model is also evolving

In 2026 it is advisable to distinguish between different scoring models. Classic model. It remains available from Azure and is based on recommendations grouped within security controls. New Cloud Secure Score. Microsoft now has a risk-based model within the Defender portal. In addition to the number of open recommendations, you can consider factors such as: criticality of the asset, exposure and risk.

The values are not directly equivalent. Therefore, we should not compare the classic model number with the new Cloud Secure Score without context.

Licenses: what capabilities each level requires

Microsoft security licensing is one of the parts that changes the most. The table below reflects the current approach in 2026 and should be re-validated before hiring.

Business Premium remains especially interesting for SMEs. Because it brings together in the same suite: Microsoft Entra ID P1, Intune, Defender for Business, Defender for Office 365 Plan 1 in addition to the corresponding productivity applications and services. E3 has changed a lot in 2026. Many old benchmarks have become obsolete because Microsoft 365 E3 now includes additional capabilities such as: Defender for Office 365 Plan 1, Intune Plan 2, Intune Remote Help, and Intune Advanced Analytics.

E5

The new packaging adds to E3 capabilities such as: Security Copilot, Endpoint Privilege Management, Cloud PKI and Enterprise Application Management. Official reference: Microsoft – Microsoft 365 Packaging and Pricing Updates 2026.

90-Day Zero Trust Roadmap

There is no universal roadmap, but this sequence allows you to move from the most critical identity controls to devices, data, applications and cloud without trying to transform the entire environment simultaneously. Days 1–15: Know what we have.

Days 16–30: protect identity.

Days 31–45: email and domain.

Days 46–60: endpoints.

Days 61–75: information and applications.

Days 76–90: Azure and continuous improvement.

Zero Trust does not end: it evolves

Not all companies need to immediately reach the last level. Appropriate maturity depends on the risk, size, regulation, available resources and complexity of the organization.

Common mistakes when implementing Zero Trust

Zero Trust Checklist for Microsoft 365 and Azure

Frequently asked questions about Zero Trust in Microsoft 365 and Azure

Is Zero Trust achieved by purchasing a specific license?

A license can provide necessary capabilities, but Zero Trust requires coordinated decisions about identity, devices, applications, data and operation. First, the priority routes and risks are defined; Then you check which functions are needed. Purchasing products without assigning responsibility or validating their use does not demonstrate that these accesses are better protected.

Does having MFA mean that data is already protected?

MFA helps protect authentication, but it doesn’t alone decide which documents a person can open or how they are shared. Permissions, device status, and information protection all need their own review. The design must check these layers together in the accesses made by the company.

Should the same control be required from all users?

Requirements must respond to the risk and context of access. Privileged accounts and sensitive resources may require more stringent conditions. Still, every difference must be documented and operable; A collection of permanent, unreviewed exceptions makes it difficult to know what protection each account actually receives.

How do you demonstrate improvement with Zero Trust?

The initial state is compared with access and permission tests defined for priority resources. Both authorized actions and those that the control must prevent must be verified. Logs, permission reviews, and the ability to address incidents provide more useful evidence than a list of enabled tools.

Final Recommendations: Zero Trust is a way to manage risk, not a list of products

Implement Zero Trust in Microsoft 365 and Azure It does not consist of activating all the options available in Microsoft Defender, Entra, Intune or Purview. The goal is to build a system where each access has adequate justification and where the compromise of an identity, a device or an application does not automatically imply unlimited access to the rest of the environment. The starting point is usually identity.

Users and administrators must be properly inventoried, MFA must be part of the baseline, and privileged access should be reduced to the minimum necessary. For administrators and sensitive resources, it is worth moving towards phishing-resistant authentication methods. Conditional Access then allows you to incorporate signals such as risk, device and application. But these policies should be tested in Report-only and deployed progressively to prevent a security check from becoming an operational outage.

Devices are the next component. Intune, Defender for Endpoint, compliance, and Endpoint Privilege Management allow you to reduce dependency on local administrators and use the state of the computer in access decisions. Email requires its own strategy with Defender for Office 365, anti-phishing protection, and proper SPF, DKIM, and DMARC settings. And protecting access doesn’t do much good if data is overshared.

SharePoint, OneDrive, Teams, and Microsoft Purview require a consistent permissions, classification, and lifecycle model, especially before expanding your use of Microsoft 365 Copilot. In Azure, Zero Trust should extend to RBAC, PIM, Managed Identities, Networking, Secrets, Policies, Public Exposure, and Defender for Cloud. Finally we need to measure. Microsoft Secure Score and Cloud Secure Score can help identify areas for improvement, but should not become a competition for the highest percentage.

The important metric remains another: what risk are we reducing, what control mitigates it, what impact does it have on the business and how do we know it is still working in six months. That cycle of inventory, protection, validation, and continuous review is what turns a collection of Microsoft products into a true Zero Trust strategy.

Recommended official documentation

Zero Trust.

• Microsoft – Zero Trust Adoption Framework
• Microsoft – Zero Trust deployment plan with Microsoft 365

Microsoft Entra ID and Conditional Access.

• Microsoft – Conditional Access
• Microsoft – Report-only mode
• Microsoft – Authentication Strengths
• Microsoft – Phishing-resistant MFA for administrators
• Microsoft – Mandatory MFA

Identity Protection and PIM.

• Microsoft – Risk-based access policies
• Microsoft – Privileged Identity Management
• Microsoft – Entra ID Governance licensing
• Microsoft – Access Reviews

Microsoft Defender for Office 365.

• Microsoft – Defender for Office 365
• Microsoft – Recommended EOP and Defender settings
• Microsoft – Safe Links
• Microsoft – Safe Attachments

SPF, DKIM and DMARC.

• Microsoft – Configure SPF
• Microsoft – Configure DKIM
• Microsoft – Configure DMARC

Microsoft Intune.

• Microsoft – Intune Licensing
• Microsoft – Endpoint Privilege Management
• Microsoft – Deploy Endpoint Privilege Management
• Microsoft – Hotpatch

Microsoft Purview.

• Microsoft – Sensitivity Labels
• Microsoft – Data Loss Prevention
• Microsoft – Retention

Azure and Defender for Cloud.

• Microsoft – Defender for Cloud Secure Score
• Microsoft – Defender for Cloud Recommendations

Secure Score.

• Microsoft – Microsoft Secure Score
• Microsoft – Assess your security posture

Licensing 2026.

• Microsoft – Microsoft 365 Packaging and Pricing Updates 2026
• Microsoft – Microsoft 365 Packaging Update FAQ