Zero Trust sounds like a big-enterprise project with endless budgets and consultants. In reality, small and mid-sized organisations in London are the ones that get hurt most when a single compromised account takes down email, files, and finance in one shot. You don’t need a greenfield Azure estate to move toward Zero Trust — you just need a clear, staged plan.

This guide lays out a practical, opinionated roadmap you can apply in a Microsoft 365 / Azure-focused environment. It’s written from the point of view of an IT Director / Solutions Architect who still has to deal with printers, finance apps, and users working from random home broadband.

What Zero Trust Actually Means for a Microsoft 365 / Azure Environment

Ignore the marketing diagrams for a moment. In a typical SME that lives in Microsoft 365 with a mix of on-prem bits, Zero Trust boils down to three questions:

  • Can I strongly verify who this user is? (identity)
  • Can I trust this device right now? (device health & compliance)
  • Does this user really need access to this thing? (least privilege & segmentation)

Every Zero Trust decision is really a combination of those three. The rest is plumbing and policy.

Step 1: Start with Identity – Because Everything Hangs Off It

If you try to start Zero Trust with firewalls and VPNs, you’ll stall. In a Microsoft-first stack, Azure AD / Entra ID is the control plane, so that’s where you begin.

1.1 Enforce Strong MFA Without Making Everyone Hate You

Don’t roll out MFA as a surprise to all staff on a Monday morning. Do it in two waves: IT & finance first, then the rest of the business.

  • Use: Microsoft Authenticator with push notifications (number matching enabled).
  • Avoid: SMS codes as the primary factor unless you have no choice.
  • Policy: Create a Conditional Access policy: “Require MFA for all cloud apps for users outside trusted locations”.

Run a 2–3 week awareness phase: screenshots, 60-second screen recording, and a clear “What you’ll see on your phone” email. You want confusion low when you flip the switch.

1.2 Kill Legacy Auth and Basic Protocols

Legacy authentication will quietly bypass your fancy MFA setup. This is a classic way attackers sit in mailboxes for months.

  • In Entra ID, disable basic auth for protocols like IMAP, POP3, and older Outlook clients.
  • Use the “Sign-in logs” and “Legacy authentication” reports to see who will break.
  • Give teams a deadline and migration plan (e.g. update scanners to use modern auth or relay via a secure connector).

This step alone dramatically reduces risk from password-spray and basic phishing campaigns.

Step 2: Get a Handle on Devices – Stop Trusting Any Laptop with a Browser

Zero Trust assumes any random device is hostile until proven otherwise. For most SMEs, that’s a big mindset shift. The move is from “if they can log in, they’re fine” to “they can’t reach sensitive data unless the device is known and healthy”.

2.1 Onboard Corporate Devices to Intune

If your laptops and mobiles aren’t in Intune yet, that’s your next milestone. Don’t try to solve every policy at once.

  • Start with Windows 10/11 and corporate iOS/Android.
  • Use Autopilot for new devices, but don’t delay rollout if you’re not ready — you can add Autopilot later.
  • Apply a light baseline first: full disk encryption, basic Defender AV, Windows Firewall on, OS up-to-date.

Your goal is not perfection. Your goal is to move devices from “mystery box” to “managed and visible”.

2.2 Introduce Conditional Access Based on Device Compliance

Once a decent chunk of your fleet is in Intune, you can start differentiating access based on device posture.

  • Create a Device Compliance policy: require encryption, minimum OS version, no jailbreaking/rooting.
  • Create a Conditional Access policy: “Require compliant or hybrid-joined device for access to Exchange Online and SharePoint”.
  • Start in report-only mode to see who will be blocked before you go hard enforcement.

Over time, sensitive apps (finance, HR, line-of-business) should be reachable only from compliant, known devices, not random home PCs.

Step 3: Shrink What Each Account Can Damage (Least Privilege in Practice)

Most breaches in SMEs don’t rely on exotic exploits. A single compromised account with far too much access is enough. Zero Trust wants every user and admin to be “worth less” to an attacker.

3.1 Clean Up Global Admins and Shared Accounts

Start with your own backyard: Microsoft 365 and Azure roles.

  • List all Global Administrators and ask: “Does this person need this level full-time?” The answer is almost always “no”.
  • Switch to Privileged Identity Management (PIM) if you have it: just-in-time elevation instead of standing admin rights.
  • Replace generic shared admin accounts with named accounts, MFA-enabled, and PIM-controlled.

This breaks the habit of “We’ll just make them Global Admin so it works”. Every time you do that, you write an attacker a winning lottery ticket.

3.2 Segment Data Access in Microsoft 365

In a lot of organisations, everyone has access to everything on SharePoint or the file server because it was “easier”. Zero Trust pushes you to narrow this.

  • Define a small set of data zones: Public, Internal, Confidential (HR/Finance), Highly Sensitive (board, M&A).
  • Map SharePoint sites and Teams to those zones and review membership.
  • For Confidential and Highly Sensitive zones, require MFA + compliant device + trusted location via Conditional Access.

This doesn’t need a six-month data classification project. Start with finance, HR, and leadership content, then move outward.

Step 4: Apply Zero Trust to Remote Access and Legacy Apps

Most SMEs still have one or more of the following: RDP, VPN, or a legacy line-of-business app sitting behind a static IP. That’s where a lot of real-world breaches begin.

4.1 Stop Exposing RDP and VPN Directly to the Internet

If you can Google your public IP and see RDP ports open, you’re already on someone’s target list. Move quickly.

  • Close direct RDP from the internet; require RDP via a secure jump host or Bastion, ideally with Azure AD authentication.
  • Upgrade VPN access to support Azure AD MFA and per-user roles, not shared credentials.
  • Limit VPN groups: HR, Finance, IT should not all sit in one “full access” role if you can avoid it.

Think of VPN as a temporary bridge while you move apps to more modern, identity-aware access patterns.

4.2 Front Door Legacy Apps with Azure AD

For the web apps that can’t move to SaaS yet, you can still bring them into your Zero Trust model.

  • Use Azure AD Application Proxy or a similar reverse proxy to publish apps with Azure AD sign-in.
  • Apply Conditional Access: MFA + device compliance for those apps.
  • Map app access to groups driven from HR or your identity lifecycle (joiners, movers, leavers).

Now, even your legacy systems participate in the same security posture as Microsoft 365.

Step 5: Visibility and Response – Because Something Will Still Go Wrong

Zero Trust reduces blast radius; it doesn’t guarantee perfection. You still need a realistic way to spot and respond when something slips through.

5.1 Turn On and Tune the Microsoft 365 Security Stack

Many SMEs pay for security features they never actually switch on. Start with the essentials you likely already own.

  • Enable Defender for Office 365 for phishing and attachment scanning.
  • Turn on Microsoft Defender for Endpoint for managed devices and integrate with Intune.
  • Use security baselines as a starting point, then tune to cut noise.

Even basic reports like “impossible travel” or “multiple failed sign-ins from unknown locations” are invaluable for SMEs.

5.2 Prepare a Simple Incident Playbook

When a mailbox is compromised or a device is suspected of malware, your team should not be improvising.

  • Write a one-page runbook for: compromised account, lost/stolen device, suspected phishing, ransomware on a server.
  • Include: who to call, which accounts to block, what to collect (logs, screenshots), and when to escalate to external partners.
  • Store it somewhere non-technical staff can find, and run a short tabletop exercise once or twice a year.

This turns chaos into a controlled response and buys you critical minutes when it matters.

How to Sequence This Work in the Real World

Most IT teams don’t have the luxury of pausing everything for a Zero Trust project. You need a sequence that fits around BAU support and projects.

  • Month 1–2: MFA rollout, kill legacy auth, start security reporting.
  • Month 3–4: Intune onboarding, basic compliance, device-based Conditional Access (in report-only, then enforce).
  • Month 5–6: Admin role clean-up, PIM, initial data segmentation for finance/HR/leadership.
  • Month 7–9: Remote access hardening, Azure AD Application Proxy for key legacy apps.
  • Ongoing: Tuning, incident playbooks, gradually expanding data and app coverage.

This isn’t theory. With a focused roadmap and business backing, a typical SME can get to a meaningful Zero Trust posture in under a year without rebuilding their entire stack.

One Strong Recommendation: Anchor Everything in Conditional Access

If you take only one thing from this article, let it be this: design and document your Conditional Access strategy early. Treat it as your central policy engine, not a side feature you bolt on later.

Map policies to business intent: which apps, what data, from where, on what devices, by which roles. When someone asks, “Can this partner get access from their own laptop?” your answer should be: “Yes, if they meet these conditions – and here’s the policy that enforces it.” That’s Zero Trust in practice, not just in slides.