What is Zero Trust?
Zero Trust is a security philosophy built on one principle: never trust, always verify. Traditional security assumed that anything inside the corporate network was safe. Zero Trust assumes breach — every request, from every user, from every device, must be continuously verified regardless of where it originates.
In a world of remote work, cloud services, and sophisticated attacks, the network perimeter no longer exists. Zero Trust is the response to that reality.
The Three Pillars of Zero Trust
- Verify explicitly — always authenticate and authorise based on all available data points: identity, location, device health, service, workload, data classification, and anomalies
- Use least privilege access — limit user access with just-in-time (JIT) and just-enough-access (JEA) policies. Risk-based adaptive policies. Data protection
- Assume breach — minimise blast radius, segment access, encrypt end-to-end, use analytics to get visibility and drive threat detection
Zero Trust on Azure — The Six Pillars
1. Identity
Azure Active Directory is the foundation. Every user and workload identity is verified with MFA, Conditional Access policies, and Privileged Identity Management (PIM). Legacy authentication protocols are blocked. Passwordless authentication is enforced where possible.
2. Endpoints / Devices
Microsoft Intune enforces device compliance. Only compliant, managed devices can access corporate resources. Device health signals feed into Conditional Access — a non-compliant device is denied even with valid credentials.
3. Applications
Application access is brokered through Azure AD Application Proxy or Microsoft Entra Private Access. Shadow IT is discovered and governed through Microsoft Defender for Cloud Apps. App permissions follow least privilege.
4. Network
Micro-segmentation replaces flat network trust. Azure Firewall Premium with IDPS, network security groups, and private endpoints ensure no lateral movement. Outbound traffic inspection is mandatory.
5. Infrastructure
Azure Policy enforces configuration compliance. Microsoft Defender for Cloud provides security posture management. JIT VM access eliminates persistent management ports.
6. Data
Microsoft Purview classifies and labels sensitive data. Encryption at rest and in transit is enforced. Data Loss Prevention policies prevent exfiltration.
Zero Trust Maturity Model
Microsoft defines three stages: Traditional, Advanced, and Optimal. Most enterprises I work with are between Traditional and Advanced. The goal is not to reach Optimal overnight — it is to have a clear roadmap and make consistent progress.
Where to Start
Identity is always the starting point. If you do nothing else, enabling MFA and Conditional Access across all users delivers the single highest security ROI of any Zero Trust control. In my experience with government and enterprise customers in APAC, identity hardening stops the vast majority of attacks.
