[For IT Pros]

Zero Trust stopped being a buzzword a while ago. In 2026, it’s simply how you keep your environment alive while users, devices, apps, and data live everywhere. The problem is: most teams are half-way in, with a pile of policies, a confusing diagram, and no clear operating model.

This guide is the version you’d sketch on a whiteboard for a colleague: what to do first, how to phase it, and the minimum viable policies that actually reduce risk without breaking your users.

1. Start with a Realistic Zero Trust Blueprint

Zero Trust is not a product. It’s a set of decisions about identity, device, network, app, and data that you enforce consistently. If you can’t draw it on one page, it’s already too complex.

1.1 Define Your Security Planes

Use this simple model as your reference architecture:

  • Identity plane: Entra ID / IdP, Conditional Access, MFA, identity protection.
  • Device plane: Intune / MDM, compliance, patching, Defender, EDR.
  • Network plane: VPN/ZTNA, segmentation, private endpoints, reverse proxies.
  • App plane: SaaS, line-of-business apps, reverse proxy, app protection policies.
  • Data plane: labels, DLP, encryption, access reviews, governance.

Decide explicitly: Identity is the control plane. Everything else is either a signal or a policy target.

1.2 Pick a Narrow Initial Scope

Don’t “do Zero Trust” for the whole estate on day one. Choose a well-bounded scenario:

  • All corporate laptops accessing M365 and your main internal web app.
  • All admin identities and privileged access paths.
  • One critical business unit with clear apps and devices.

Define success in one sentence, e.g.: “All finance staff must use MFA, compliant devices, and cannot access finance apps from unmanaged devices or legacy protocols.”

2. Identity First: Conditional Access as Your Guardrail

If you only have capacity for one Zero Trust project this quarter, make it identity hardening. Everything else plugs into it.

2.1 Baseline Policies You Should Already Have

In Entra ID (Azure AD), these are the minimum 2026 baselines for most orgs:

  • Block legacy auth (POP, IMAP, basic auth) for all users.
  • Require MFA for all users, with phishing-resistant methods preferred.
  • Protect admin roles with conditional access + PIM.
  • Block risky sign-ins automatically using Identity Protection.

Sample policy (conceptual) using Entra Conditional Access in PowerShell (Microsoft.Graph):

Connect-MgGraph -Scopes 'Policy.ReadWrite.ConditionalAccess'

$policy = @{
    displayName = 'Require MFA for All Users - Cloud Apps'
    state       = 'enabled'
    conditions  = @{
        users = @{ includeUsers = @('All'); }
        applications = @{ includeApplications = @('All'); }
        clientAppTypes = @('browser','mobileAppsAndDesktopClients')
    }
    grantControls = @{
        operator     = 'AND'
        builtInControls = @('mfa')
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $policy

Do not push this live without exclusions for break-glass accounts, service principals, and automation accounts you’ve audited.

2.2 Phased MFA Strategy

Avoid the “MFA big bang”. Roll out in three waves:

  • Wave 1: IT + admins + high-risk roles (finance, HR). Enforce phishing-resistant methods first (FIDO2, platform biometrics, certificate-based).
  • Wave 2: Remaining staff, with temporary SMS/voice as fallback, but set a deprecation date.
  • Wave 3: External/guest users who access sensitive apps (B2B collaboration, supplier portals).

Pair each wave with a specific comms pack: screenshots, short clip, 2–3 FAQs. People accept friction when they’re not surprised by it.

3. Device Trust: From “Any Device” to “Healthy Device”

Zero Trust breaks quickly if your devices are unmanaged and untrusted. You don’t need perfection, but you do need a minimum hygiene bar.

3.1 Define Device Compliance Once

In Intune or your MDM, create a small number of compliance policies:

  • OS hygiene: supported OS version, max patch age (e.g. 14 days), disk encryption.
  • Security controls: EDR/Defender running, firewall enabled, no high-severity security findings.
  • Configuration: device is corporate-owned or user-enrolled with company profile, no jailbreak/root.

Example: Intune compliance settings for Windows 11:

// Conceptual: Intune GUI equivalents
- Require BitLocker = On
- Require Secure Boot = On
- Minimum OS version = 11.24.x
- Mark device noncompliant if more than 14 days behind on quality updates
- Require Microsoft Defender for Endpoint = On, risk score <= Medium

3.2 Tie Compliance to Access

Once compliance is defined, make it meaningful with Conditional Access:

  • Policy: Require compliant device for all “Tier 0/1” apps (M365 admin portals, finance ERP, HRIS).
  • Exception path: For break-glass, field workers, or BYOD scenarios, use app protection policies instead of full device compliance.

Example conceptual CA logic:

IF user in <HighValueAppUsers>
AND app in <FinanceApps>
THEN
    require MFA
    AND require device to be marked as compliant

Start with “report-only” mode to see who will be blocked. Remediate before you flip it to “on”.

4. Network: Shrink the Blast Radius, Don’t Chase Perfection

Network Zero Trust in 2026 is less about castle-and-moat and more about minimising implicit access. Your aim is: if an identity or device is compromised, damage is limited and observable.

4.1 Minimum Network Controls for a Hybrid World

  • Remove flat networks: Segment user VLANs, server VLANs, management networks, and OT/IoT.
  • Replace full-tunnel VPN for everything: Move to ZTNA / per-app VPN where possible.
  • Use private endpoints / service tags: For PaaS, avoid exposing control planes on public internet where feasible.
  • Lock admin pathways: Jump hosts, just-in-time (JIT) access, and privileged access workstations (PAWs) on dedicated segments.

Example Azure network segmentation (high-level):

- Hub VNet: shared services, firewalls, inspection, DNS
- Spoke VNet: per-app or per-business-unit workloads
- Use Azure Firewall or NVA: restrict East-West traffic using app rules
- Force-tunnel on-prem to inspection in hub VNet for sensitive traffic

4.2 Treat On-Prem Like an Untrusted Segment

By 2026, most attacks pivot through on-prem AD or legacy file servers. Treat on-prem as an external network from the perspective of cloud workloads:

  • Use Application Proxy / reverse proxy for internal web apps.
  • Limit direct inbound VPN/RDP to servers; route via brokered services.
  • Use conditional access for on-prem apps integrated with Entra.

This feels harsh, but it aligns with where your new investments already are: identity-first access, regardless of physical location.

5. Data & App Layer: Make Access Intentional, Not Accidental

Zero Trust at the data layer is where many programmes stall. Keep it extremely pragmatic: protect the top 10 data sets that would hurt most if leaked or tampered with.

5.1 Classify First, Automate Later

Don’t try to auto-label every document in your organisation on day one. Instead:

  • Define 3–4 labels: Public, Internal, Confidential, Restricted.
  • Map labels to policies: sharing rules, encryption, external access, download controls.
  • Work with two business teams (e.g. Finance, HR) to manually label their high-value content.

Example policy mapping:

Label: Restricted
- External sharing: Block
- Access only from: Compliant devices
- Download from web: Block; web-only
- Email: Encrypt + Do Not Forward by default

5.2 Secure Critical Apps with Stronger Signals

For your most sensitive apps (ERP, EHR, trading, R&D systems):

  • Use step-up authentication: require phishing-resistant MFA per session.
  • Enforce device and location constraints: corporate device, compliant, trusted network or ZTNA.
  • Enable session controls (M365 Defender / CASB) for risky activities like mass downloads or sharing to personal email.

Scenario example: A user in Finance tries to export 5,000 records to CSV. The session policy prompts for re-auth and logs a high-risk event to your SIEM for review.

6. Operations: Make Zero Trust a Daily Habit, Not a Project

The biggest failure mode of Zero Trust is treating it as a one-off programme. You need a repeatable operating rhythm that your team can sustain.

6.1 Build a Simple Zero Trust Scorecard

Track a handful of metrics monthly:

  • % of users with phishing-resistant MFA enabled.
  • % of devices compliant / enrolled / with EDR active.
  • Number of apps behind conditional access policies.
  • Number of privileged accounts without PIM / MFA (should trend to zero).
  • Number of blocked risky sign-ins and risky users remediated.

Put this in Power BI or your reporting tool, not a static slide. This becomes your argument for more budget and for deprecating legacy patterns.

6.2 Standardise Change Patterns

Zero Trust changes can break things if done ad-hoc. Create standard change templates:

  • New app onboarding: SSO integration, groups, CA policies, data classification requirements.
  • New device type: compliance policy mapping, enrollment steps, security baselines.
  • New external partner: B2B setup, guest access level, lifecycle & review schedule.

Store these in your internal runbook / knowledge base and make sure every project uses them by default.

7. A Concrete 90-Day Zero Trust Action Plan

If you want something you can actually execute, here’s a realistic 90-day plan for a typical mid-size org that already uses Microsoft 365 and Intune.

Days 1–30: Stabilise Identity

  • Audit existing Conditional Access policies, document them, and remove dead/duplicate ones.
  • Block legacy authentication for all users except a handful of documented service accounts.
  • Enable MFA for IT, admins, and high-risk roles with phishing-resistant methods.
  • Set up Identity Protection policies to block high-risk sign-ins and users.

Days 31–60: Enforce Device & App Guardrails

  • Define and deploy Intune compliance policies for Windows, macOS, iOS, and Android.
  • Turn on EDR/Defender across corporate endpoints and integrate with your SIEM.
  • Create Conditional Access policies requiring compliant devices for key apps (M365 admin portals, finance, HR).
  • Move a small set of internal web apps behind Application Proxy with SSO + CA.

Days 61–90: Tighten Network & Data, Formalise Ops

  • Segment at least one high-value on-prem environment (e.g. finance servers) and lock admin RDP behind a broker or PAW model.
  • Define 3–4 sensitivity labels and apply them to critical finance/HR libraries.
  • Deploy a basic session policy for high-risk behaviour (mass download/export) on M365.
  • Publish your Zero Trust scorecard and review it monthly with security + infra leads.

One Clear Next Step

Don’t start with a 50-page Zero Trust strategy deck. Start with one concrete action this week: review your Conditional Access policies, and design the next policy you’ll put into “report-only” mode. Once that’s stable, enforce it, measure the impact, and use that momentum to tackle the next control.