Most small and mid-sized organisations in London now live in a hybrid world: a bit of on-prem, a lot of Microsoft 365, and staff working from everywhere. That mix is exactly where attacks thrive. Zero Trust isn’t a buzzword here – it’s a very practical way to stop one compromised account or laptop from becoming a full-blown incident.

This guide walks through how to apply Zero Trust principles in a realistic way for SMEs using Microsoft 365/Azure AD, Intune and a handful of sensible policies. The goal: better security, minimal user friction, and something your IT team can actually manage.

What Zero Trust Really Means for a Small or Mid-Sized Business

Classic IT security assumed that once you were on the corporate network, you were trusted. That model is broken in a world of home routers, coffee shop Wi‑Fi and SaaS apps. Zero Trust flips this: never trust by default, always verify identity, device and context.

For an SME, Zero Trust usually comes down to three core questions for every access request:

  • Who is requesting access? (identity & authentication)
  • From what are they accessing? (device health & compliance)
  • To which data or system? (app & data sensitivity)

If you can reliably answer those three questions and enforce policies accordingly, you are already a long way along the Zero Trust path.

Step 1: Make Identity the New Perimeter

In a cloud-first world, identity is your real perimeter. Your accounts in Azure AD / Entra ID are more important than any firewall rule you’ve ever written. Most compromises start with a phished password or reused credentials.

1.1 Enforce Strong MFA Everywhere (But Make It Tolerable)

If you’re not already enforcing MFA for all staff, this is your highest-impact change. The key is to do it in a way that doesn’t turn staff against IT.

  • Use modern methods: Push notifications or number matching in Microsoft Authenticator, not SMS where possible.
  • Require MFA for all accounts, but add sign-in frequency policies so users don’t get hammered every hour.
  • Protect high-risk roles (finance, HR, IT admins) with stricter policies and potentially hardware keys (FIDO2) if budget allows.

Mini-scenario: A London-based recruitment firm was hit by invoice fraud after a mailbox was compromised via reused passwords. After rolling out mandatory MFA with authenticator apps and number-matching, similar attempts failed because attackers couldn’t complete the second factor.

1.2 Conditional Access as Your Policy Engine

Conditional Access (CA) in Azure AD is where Zero Trust becomes real. It lets you evaluate user, device, location and risk signals for every login and apply policies automatically.

Core starter policies for most SMEs:

  • Block legacy authentication (POP, IMAP, basic auth) – attackers love these protocols.
  • Require MFA for all cloud apps, with exceptions only for service accounts you fully understand.
  • Block high-risk sign-ins or require password reset when Azure AD Identity Protection flags them.
  • Require compliant or hybrid-joined devices for access to sensitive apps (finance, HR, CRM).

Move from “global policies” to tiered access: standard users get baseline policies, privileged users get stricter ones, and highly sensitive apps require compliant devices plus MFA every time.

Step 2: Make the Device a First-Class Citizen

Zero Trust is not just about who the user is; it’s also about the state of the device. A fully patched, encrypted, managed laptop from your London office is not the same as a ten-year-old home PC.

2.1 Standardise on Managed Devices with Intune

Where possible, move away from unmanaged BYOD for core work. Use Intune (Microsoft Endpoint Manager) to bring Windows, macOS, iOS and Android under management.

Core baseline for laptops/desktops:

  • Disk encryption enabled (BitLocker/FileVault) with recovery keys escrowed in Azure AD or Intune.
  • OS patching with update rings to keep devices close to current without disrupting key business hours.
  • Endpoint protection (Defender for Endpoint or your chosen AV) with sensible, monitored policies.
  • Local admin removal from end-user devices; use Just-In-Time elevation where possible.

Once devices are enrolled and evaluated, you can use device compliance policies as a powerful lever in Conditional Access.

2.2 Device Compliance as a Gate

Create a set of compliance policies that define the minimum bar for device trust. Examples:

  • Device must have disk encryption enabled.
  • Device must not be jailbroken or rooted (for mobile).
  • Device must have real-time protection enabled.
  • Device must not be too many days behind on OS updates.

Then in Conditional Access, enforce: “Require compliant device” for key apps like SharePoint, Exchange Online, Teams, finance systems and line-of-business web apps. An out-of-date, half-broken laptop suddenly loses its access until it’s brought back into line.

2.3 Handling Realistic Exceptions

You will always have edge cases: contractors, directors on personal iPads, or third-party support teams. For these, use a mix of:

  • App Protection Policies for mobile – protect corporate data within apps like Outlook and Teams without managing the whole device.
  • VDI or Azure Virtual Desktop for high-risk, external access into sensitive apps.
  • Tightly scoped guest accounts and separate Conditional Access policies for partners.

The aim is to make exceptions deliberate, documented and controlled, not silently accepted risks.

Step 3: Protect Data Where It Lives and Travels

Identity and device controls reduce blast radius, but data is what attackers (and regulators) care about. A Zero Trust approach assumes data will move – your job is to make sure it remains controlled, even outside your immediate boundary.

3.1 Classify and Label Data in Microsoft 365

Start simple. Define 3–4 sensitivity labels in Purview (or the legacy Security & Compliance Center):

  • Public
  • Internal
  • Confidential
  • Highly Confidential

Attach policies to these labels such as:

  • Confidential: Require encryption for external sharing.
  • Highly Confidential: Block external sharing by default, watermark documents, and log all access.
  • Prompt users to label documents and emails at creation time, nudging them into good habits.

This gives you a language to talk about data with both users and auditors, and a mechanism to enforce meaningful controls.

3.2 Control Access to SaaS and Shadow IT

SaaS sprawl is real in modern SMEs. Marketing signs up to one tool, HR to another, and suddenly critical data lives in personal accounts. Use a Cloud Access Security Broker (CASB) like Microsoft Defender for Cloud Apps to regain visibility.

At minimum:

  • Discover shadow SaaS usage via sign-in logs or network logs.
  • Standardise on a small portfolio of approved apps.
  • Enforce Single Sign-On (SSO) and Conditional Access for those apps via Azure AD.

Staff still get the flexibility of web tools, but access is governed by the same identity and device rules as your core Microsoft 365 services.

Step 4: Reduce Privilege and Improve Admin Hygiene

Zero Trust fails instantly if an attacker lands on an admin account with standing global rights. SME environments often grow organically, leaving a handful of over-privileged accounts and service identities.

4.1 Move to Just-In-Time Admin Access

Use Privileged Identity Management (PIM) in Azure AD (where licensing allows) to move away from always-on admin roles. Admins should work as standard users and elevate only when needed.

Key practices:

  • Remove permanent Global Admin roles from everyday accounts.
  • Require MFA and approval for elevation to high-privilege roles.
  • Log and review privileged role usage regularly.

If you don’t have PIM, still create separate admin accounts with strict Conditional Access, and only sign into them when necessary.

4.2 Clean Up Service Accounts and Legacy Integrations

Service accounts often have broad, forgotten permissions. Audit them thoroughly:

  • List all service principals and app registrations in Azure AD.
  • Check what API permissions they hold and whether they’re still required.
  • Rotate secrets and certificates regularly; move to Managed Identities where possible.

Align each integration with the principle of least privilege: the minimum rights needed for the job, nothing more.

Step 5: Monitor, Respond and Iterate

Zero Trust is not a one-off project. Once you’ve set the core controls, you need visibility and the ability to respond quickly when something looks off.

5.1 Centralise Security Signals

Microsoft 365 already gives you a lot of signal; the trick is to make it usable. If possible, feed logs into a central solution like Microsoft Sentinel or another SIEM.

At a minimum, monitor:

  • Sign-in logs and Conditional Access failures for unusual patterns.
  • Identity Protection alerts (risky users, risky sign-ins).
  • Defender alerts from endpoints and email.

Define a short, written playbook: what to do when you see a risky sign-in, a suspected business email compromise, or a malware alert on a director’s laptop.

5.2 Tune to Avoid User Fatigue

An effective Zero Trust rollout must be palatable to staff. Too many MFA prompts or access blocks and people start bypassing or complaining loudly.

Practical tuning ideas:

  • Use sign-in frequency and persistent browser sessions for low-risk, managed devices.
  • Apply stricter policies only to risky locations and unmanaged devices.
  • Run small pilots with friendly teams, adjust policies based on feedback, then scale up.

The aim is for most staff to barely notice the framework – they just work, and it quietly protects them.

Where to Start This Month

Zero Trust can feel huge, but most SMEs can make real progress in 30–60 days by focusing on a few concrete moves. Don’t aim for theoretical perfection; aim for visible risk reduction.

If you do nothing else, focus on these three actions:

  • Enforce MFA and Conditional Access for all users, starting with blocking legacy auth and requiring MFA for cloud apps.
  • Bring core devices under management with Intune, enforce encryption and basic compliance, then require compliant devices for sensitive apps.
  • Reduce standing admin rights and introduce just-in-time elevation for high-privilege roles.

Once those are in place, you can layer on data classification, SaaS control and better monitoring. The key is to start, be deliberate, and treat Zero Trust as an ongoing way of running IT – not a one-off project.