Zero Trust for Microsoft 365: a pragmatic reference architecture and the order in which to build it
Zero Trust has become a sales pitch applied to almost everything. Behind the slogan, though, there is a precise architectural approach: never grant access based on network location alone, verify every request and limit the impact of a compromise. Here is how to translate it into Microsoft 365, pillar by pillar.
Three principles, six pillars
Zero Trust rests on three principles: verify explicitly every access using all available signals, apply least privilege in both duration and scope, and assume breach by designing the environment to contain and detect an attacker who is already inside. These principles apply to six areas: identities, devices, applications, data, network and infrastructure, and telemetry.
In Microsoft 365, the central decision point is Entra ID Conditional Access. It combines signals (identity, device, risk, location, application) to allow access, require extra verification or block.
Identities: the foundation
Without controlled identities, nothing else holds. The baseline includes:
- MFA for everyone, with phishing-resistant methods for administrators;
- blocking legacy authentication;
- Conditional Access policies organised by population, with limited and reviewed exclusions;
- just-in-time privileged roles, cloud-only admin accounts and monitored emergency accounts;
- governance of applications and consents.
Devices and applications
The second pillar makes device state an access criterion. With Intune you define compliance rules (encryption, OS version, active protection), and Conditional Access requires a compliant or joined device for sensitive resources. For personal devices, app protection policies protect data inside mobile apps without managing the whole device.
On the application side, the goal is to route every corporate application through Entra ID for authentication, so they all benefit from the same controls. Applications that escape Conditional Access are side doors.
A common mistake. Requiring a compliant device before the inventory and compliance rules are reliable leads either to mass lock-outs or to exclusions so broad that they cancel the control. Conditional Access report-only mode lets you measure the impact before enforcing.
Data and network
The data pillar relies on classification: sensitivity labels, data loss prevention, control of external sharing. The aim is not to label the entire estate at once, but to identify the most sensitive data and apply protections that travel with it outside the tenant.
The network pillar does not disappear with Zero Trust: its role changes. The internal network stops being a trusted zone; access to internal applications is granted app by app, with the same identity controls as for the cloud. Global Secure Access components and Entra application proxy fit this logic.
Telemetry: see in order to respond
Assuming breach means being able to detect. Entra ID sign-in and audit logs, the Microsoft 365 unified audit log, Defender XDR alerts and, where relevant, a SIEM must be used, not merely collected. Risk-based identity protection, where available, feeds those signals back into access decisions.
The build order
In our engagements, the order that delivers the most for the effort involved is:
- protect privileged accounts and emergency accounts;
- roll out MFA for everyone and block legacy authentication;
- structure Conditional Access by population;
- make logs usable and handle alerts;
- bring device compliance into access decisions;
- extend to internal applications and data sharing;
- classify and protect sensitive data.
Available features depend on licensing; check what your agreement covers before building the roadmap, rather than discovering a gap halfway through the project.
What an audit checks
- Actual MFA coverage and effective blocking of legacy authentication.
- The consistency of the Conditional Access policy set and the extent of exclusions.
- Use of device state in access decisions for sensitive resources.
- Applications that bypass Entra ID for authentication.
- Control of external sharing and protection of sensitive data.
- Effective use of logs and alerts.