Zero Trust is on every board deck in 2021. Most posters are correct and non-actionable. This post is a practical sequence for Microsoft-centric estates — Azure AD, Microsoft 365, hybrid servers — that raises assurance without a multi-year science project.
Identity before network poetry
You cannot Zero-Trust your way out of password spray on basic auth. Order:
- MFA for users (phased)
- Block legacy authentication where inventory allows
- Conditional Access for Exchange/SharePoint/Teams
- Privileged identity / limited standing admin
- Device compliance for high-value apps when endpoints allow
Network microsegmentation can follow. It rarely should lead for cloud-first productivity.
Assume breach for admin
Tier-0 admin workstations, separate accounts, no daily email on domain admin. PIM if licensed. Break-glass monitored. This is Zero Trust for the people who can destroy the tenant.
Devices
Intune compliance, hybrid join realities, BYOD with app protection vs full device management. Be honest about field devices that will never be compliant — VDI or accepted risk.
Apps
Move SaaS SSO to Azure AD where possible; retire shared passwords in spreadsheets. Each app with its own MFA island is not Zero Trust — it is fatigue.
What we defer deliberately
- Full east-west encryption everywhere on day one
- Rebuilding every legacy VPN use case
- Perfect continuous access evaluation everywhere before basics exist
Write deferrals so they do not become denial.
90-day program shape
Days 1–30: inventory legacy auth + admin accounts; report-only CA
Days 31–60: enforce MFA rings; block legacy for clean protocols
Days 61–90: device compliance for core workloads; admin tiering
Report-only evidence packs
Before enforcing a blocking Conditional Access policy, export a week of would-block events and review with app owners. Attach the pack to the change record. This single habit prevents the political death of Zero Trust programs.
Service accounts as a program
Non-human identities need owners, password rotation or certificate auth patterns, and exclusion reviews. A shared “svc_mail” account is not an architecture. Inventory them like privileged users.
Guest and external access
Zero Trust includes B2B guests. Review guest access to Teams and SharePoint, access reviews if licensed, and partner domain allow lists. External collaboration without governance recreated the perimeter problem inside the tenant.
Continuous improvement backlog
After the first ninety days, backlog: session controls, risk-based policies, token protection features as they become available to your license, and tighter admin RBAC. Do not start there. Start with MFA and legacy auth.
Table: first-quarter control order
| Order | Control | Success signal |
|---|---|---|
| 1 | MFA for interactive users (phased) | Coverage percent by ring |
| 2 | Legacy auth block (after inventory) | Basic auth sign-ins near zero |
| 3 | CA for core M365 apps | Report-only then enforce |
| 4 | Admin tiering + break-glass | Standing GA count reduced |
| 5 | Device compliance for high-value apps | Compliant device share rising |
Scenario walkthrough
Consider a mid-size organization with hybrid identity, mixed desktop delivery, and a mandate to reduce risk without stopping the business. Week one is inventory and sponsor alignment. Week two is a written target state with two options and explicit out-of-scope items. Weeks three and four are pilot build and measurement. Only then does broad change begin. Compressing that sequence into a single weekend is how outages are born.
Along the way, three conversations dominate: who owns identity decisions, who pays for platform capacity, and what residual risk leadership accepts in writing. When those conversations are avoided, engineers improvise under pressure and the organization inherits accidental architecture.
We keep a living risk register with severity, mitigation, residual risk, and owner. The register is reviewed in the same meeting as the delivery burn-down. Risks that never move owners are the ones that become incidents.
If you're facing this
If Zero Trust is a mandate without a backlog, start with identity controls you can measure. We design Conditional Access and hybrid identity hardening for Microsoft estates — bring license SKUs and a list of standing global admins.