Most organisations now run on Microsoft 365 and Azure AD, but still protect them like a classic on-prem network: big firewall at the edge, lots of trust inside. That model breaks the moment a laptop is stolen, a password is phished, or a contractor VPN is compromised.

This is where Zero Trust actually matters in a very practical way. Not as a marketing buzzword, but as a blueprint: never trust, always verify, and minimise blast radius. This article walks through a realistic Zero Trust rollout for Microsoft 365 and Azure AD that a mid-sized UK business can execute without a huge security team.

What Zero Trust Really Means in a Microsoft 365 World

Zero Trust is less about “new tech” and more about changing assumptions. Instead of trusting anything because it is on your corporate network or joined to your domain, you assume every request could be hostile until proven otherwise.

In Microsoft 365 and Azure AD, this shows up as:

  • Identity-centric security: Users and service principals are your new perimeter.
  • Conditional access: Access is granted based on risk, device state, location, and sensitivity of the app/data.
  • Least privilege: Admin rights and access scopes are as small and time-bound as you can realistically manage.

Think of it this way: if an attacker steals one password, how far can they get? Zero Trust is about making the answer “not very”.

Step 1: Get Your Identity and MFA Baseline Right

You cannot do Zero Trust on shaky identity foundations. The first phase is to stabilise Azure AD and remove obvious gaps.

1.1 Enforce strong MFA for everyone (with a rollout plan)

Skip the half-measures like “MFA just for IT”. In 2025, MFA is table stakes. However, you need a rollout that doesn’t break your business.

  • Phase 1 – Visibility: Turn on Azure AD Sign-in logs and risky sign-in reporting. Identify high-risk users, legacy protocols, and locations.
  • Phase 2 – Admins first: Enforce MFA on all privileged accounts using Conditional Access and Security Defaults or equivalent custom policies.
  • Phase 3 – Everyone else: Roll out MFA to all users with clear communications, a support plan, and a cutover date.

Prefer passwordless where possible: Microsoft Authenticator (number matching), FIDO2 keys, or Windows Hello for Business on corporate devices. You reduce both friction and phishing risk.

1.2 Remove legacy authentication paths

Zero Trust and legacy auth cannot co-exist. POP, IMAP, and older Office clients bypass most modern controls.

  • Use the Azure AD sign-in logs to find which accounts and apps still use legacy protocols.
  • Create a Conditional Access policy that blocks legacy authentication for all users, with temporary exceptions only where absolutely needed.
  • Set a hard deadline to remove the last exceptions and communicate it repeatedly.

Every day legacy auth stays alive is an open side door for attackers.

Step 2: Build Smart, Layered Conditional Access Policies

Conditional Access is where your Zero Trust model comes to life. The goal is to shape access based on risk, not have one blanket rule for everyone everywhere.

2.1 Start with three core policies

A good starting set for most organisations using Microsoft 365:

  • Policy 1 – Require MFA for all cloud apps
    Target: All users (exclude break-glass accounts), all cloud apps
    Conditions: Any location, any device
    Grant: Require MFA
    Note: Pair this with blocking legacy auth as described earlier.
  • Policy 2 – Block risky sign-ins
    Target: All users
    Conditions: Sign-in risk = Medium and above
    Grant: Block access
    Extra: Tune using Identity Protection signals if licensed.
  • Policy 3 – Restrict access from non-compliant devices
    Target: Core business apps (Exchange Online, SharePoint, Teams, key SaaS apps)
    Conditions: Device platform = Windows, macOS
    Grant: Require device to be marked as compliant (via Intune)

Test these in report-only mode first to understand business impact, then move to enforce.

2.2 Use named locations and country filtering sensibly

If your staff is mostly UK/EU-based, you can block most of the planet and still keep legitimate work going.

  • Create named locations for your offices, trusted partners, and known VPN egress points.
  • Set a policy to block high-risk countries or require step-up authentication when accessing from them.
  • Avoid over-relying on IP alone; it is just another signal, not the source of truth.

Location is useful as a hint, not as a primary security control.

Step 3: Device Trust with Intune Compliance

Zero Trust doesn’t mean ignoring devices; it means not assuming a device is safe just because it is “ours”. You want Azure AD and Intune to prove a device is healthy before it touches sensitive data.

3.1 Define a realistic compliance baseline

Avoid jumping straight to 15-compliance-policy perfection. Start with a simple baseline that is easy to understand:

  • Require disk encryption (BitLocker/FileVault).
  • Require OS up-to-date (e.g. not more than N days behind on security updates).
  • Require antivirus enabled and real-time protection on.
  • Block jailbroken/rooted mobile devices.

Mark devices that pass this as compliant, then use Conditional Access to allow sensitive app access only from compliant devices.

3.2 Separate corporate and personal device strategies

Do not treat a director’s personal iPhone the same as a corporate laptop holding financial models.

  • For corporate devices: Enroll into Intune, fully manage them, and require compliance for core business apps.
  • For BYOD/mobile: Use app protection policies (MAM) on Outlook, Teams, OneDrive instead of full device management.
  • Restrict copy/paste and local file saves for corporate data on unmanaged devices where possible.

This keeps staff flexible while still putting a fence around company information.

Step 4: Shrink Admin Blast Radius with Privileged Access Controls

In most incidents I’ve seen, the real damage happens when an attacker gets admin-level access. Zero Trust means making admin abuse difficult, visible, and short-lived.

4.1 Remove standing global admin rights

Permanent global admins are a liability. Move to Just-in-Time access using Privileged Identity Management (PIM) if licensed, or at minimum, separate admin accounts.

  • Create dedicated admin-only accounts for IT staff with no mailbox or normal usage.
  • Use PIM to make roles eligible, requiring approval and MFA for activation, with clear time limits.
  • Enable alerts for role activation, especially for high-privilege roles like Global Admin, Privileged Role Admin, and Security Admin.

Your goal: an attacker who phishes a normal user should not automatically inherit admin power.

4.2 Use admin-specific Conditional Access

Admins should live under stricter rules than normal users.

  • Require MFA on every admin sign-in, even if you allow some non-MFA flows for other users.
  • Limit admin sign-ins to trusted locations or a secure admin workstation profile where possible.
  • Block high-risk sign-ins to admin accounts, with no option for self-remediation.

This creates a clearly higher bar an attacker must clear to move laterally.

Step 5: Protect Data Directly in SharePoint, OneDrive, and Teams

Zero Trust doesn’t stop at sign-in; it extends to what happens after access is granted. Microsoft 365 gives you several layers to keep data from walking out the door.

5.1 Classify and label sensitive data

Most businesses have never formally labelled their data. As a result, everything is treated like it is equally important, which usually means equally exposed.

  • Define 3–4 sensitivity labels (e.g. Public, Internal, Confidential, Highly Confidential).
  • Apply basic rules: e.g. Confidential cannot be shared externally; Highly Confidential requires encryption and no external sharing at all.
  • Use auto-labelling for obvious patterns (payroll, passport numbers, etc.) to reduce manual effort.

Even if the labels are simple at first, you’ve started moving security closer to the data itself.

5.2 Tame external sharing

SharePoint and OneDrive can turn into a leak if you don’t control who can share what, and how.

  • Set organisation-wide sharing defaults to the least open level that still lets the business function.
  • Use different sharing settings for “project” sites vs sensitive departments like Finance or HR.
  • Review external users and guest accounts on a regular schedule and expire dormant access.

Try a short pilot: tighten sharing for a single department, measure the noise from users, then adjust before scaling out.

Step 6: Make Monitoring and Response Part of Daily Operations

Zero Trust is not a one-off project. It lives or dies based on how well you watch and respond to what happens in your tenant.

6.1 Use the built-in security centre properly

Even without fancy add-ons, Microsoft 365 gives you a decent starting toolkit.

  • Enable unified audit logging if it isn’t already.
  • Regularly review Identity Protection alerts, impossible travel events, and unusual app consent.
  • Treat risky sign-ins and repeated MFA fatigue prompts as incidents, not noise.

Assign someone (internal or partner) to own this process. Logs no one reads are just expensive storage.

6.2 Create a simple incident playbook

You don’t need a 60-page document. You need a short, clear playbook that anyone in IT can follow under pressure.

  • Define steps for what to do when an account is suspected compromised: reset password, revoke sessions, review sign-ins, check mailbox rules, etc.
  • Define who can make the call to block a user or shut down sharing in a critical scenario.
  • Run at least one tabletop exercise a year walking through a realistic breach scenario.

The test of Zero Trust is not whether a breach happens; it is how far it spreads and how quickly you contain it.

Where to Start This Month

If you are looking at all this and wondering where to dive in, start with one concrete move: design and deploy a small set of Conditional Access policies that enforce MFA and block legacy auth, backed by a basic Intune compliance rule.

That alone will radically reduce your attack surface without changing every process overnight. From there, grow into admin hardening, data protection, and more nuanced device controls. A practical Zero Trust strategy for Microsoft 365 is not about perfection; it’s about making it significantly harder for a real attacker to turn a single mistake into a full-blown incident.