Zero Trust in the Real World: How to Actually Implement It Across Azure AD, Intune, and Your Network

[For IT Pros]

Zero Trust stopped being a buzzword around the time your CEO started asking why VPNs are still falling over every Monday. In 2026, most attacks you’ll deal with are token theft, consent phishing, and lateral movement from one compromised endpoint. Network perimeters aren’t saving you.

This guide is a practical walkthrough of how to implement Zero Trust using what you already have: Azure AD (Entra ID), Intune, Conditional Access, and some sensible network design. Think of it as a minimum viable Zero Trust you can roll out in months, not years.

1. Start With Principles, Not Products

You can burn a year buying tools and still not be closer to Zero Trust. Start with 3 non-negotiable principles that drive every design decision:

  • Never trust by default: Identity, device, location, and risk must be evaluated on every access attempt.
  • Assume breach: Design as if an attacker already has a device, a token, or a low-privileged account.
  • Least privilege everywhere: Access is specific, time-bound, and monitored. No standing god accounts.

Translate that into a one-page internal statement you can point to when you get pushback:

  • “No unmanaged device can access corporate data without going through approved paths.”
  • “All external access is conditional, MFA-backed, and logged.”
  • “Admin access is just-in-time and just-enough.”

2. Build a Zero Trust Identity Core in Azure AD (Entra ID)

2.1 Identity Hygiene Before Fancy Policies

Don’t stack Conditional Access on top of a dirty directory. Fix basics first:

  • Ban legacy auth: Disable POP, IMAP, and basic auth protocols for all but well-documented exceptions.
  • Normalise accounts: One user = one identity. Kill shared accounts and generic mailboxes used as logins.
  • Clean up guest sprawl: Review B2B guests, expire or remove idle ones.

Use PowerShell to quickly identify legacy auth usage:

Install-Module ExchangeOnlineManagement
Connect-ExchangeOnline
Get-AuthenticationPolicy | ft Name, AllowBasicAuth* -Auto

# Sign-in logs filter (Entra ID)
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) \
  -Operations UserLoggedIn | \
  Where-Object {$_.AuditData -match 'LegacyProtocol'} | \
  Select-Object -First 50

2.2 A Baseline Conditional Access Strategy That Works

In 2026, Conditional Access is your new perimeter. Aim for 5–8 well-designed policies, not 50 overlapping ones. A proven baseline set:

  • CA01 – Block legacy auth: All users, all apps, client app = legacy, grant = block.
  • CA02 – Require MFA for all users: All users except break-glass; all cloud apps; grant = require MFA.
  • CA03 – Require compliant or hybrid-joined device for high-value apps: Groups = Finance, HR, IT; apps = Exchange Online, SharePoint, ERP; grant = require compliant or hybrid Azure AD joined device.
  • CA04 – Block high-risk sign-ins (Identity Protection): All users; condition = sign-in risk high; grant = block.
  • CA05 – Require passwordless for admins: Roles = privileged roles; grant = require phishing-resistant MFA / passwordless.

Always deploy in report-only first. Watch the sign-in logs for at least one week, then flip to On during a maintenance window.

2.3 Break-Glass and Admin Access Done Properly

You cannot talk Zero Trust and still have a full-time global admin that never expires.

  • Create two break-glass accounts, cloud-only, with long, offline-stored passwords, MFA excluded from CA.
  • Use Entra Privileged Identity Management (PIM) to make all admin roles eligible, not permanent.
# Example: make GA role eligible for a security group via PIM (conceptual)
Connect-MgGraph -Scopes 'RoleManagement.ReadWrite.Directory'
$role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Global Administrator'"
$group = Get-MgGroup -Filter "displayName eq 'PIM-GA-Admins'"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest `
  -Action 'adminAssign' `
  -PrincipalId $group.Id `
  -RoleDefinitionId $role.Id `
  -ScheduleInfo @{ startDateTime = (Get-Date); expiration = @{ type = 'noExpiration' } }

3. Make Devices First-Class Citizens With Intune

3.1 Decide Your Device Trust Model

Zero Trust breaks if your devices are wide open. Pick a model and commit to it:

  • Corporate-owned only: All Windows/macOS/iOS/Android enrolled in Intune. Strongest posture, more management work.
  • Hybrid: Corporate devices enrolled; BYOD gets App Protection Policies (MAM) and limited data access.

Rule of thumb for 2026: full MDM for corporate, MAM for BYOD. Stop pretending unmanaged personal laptops are safe access points for finance data.

3.2 Baseline Hardening for Windows With Intune

Build a standard device configuration that enforces Zero Trust assumptions:

  • Security baselines: Start with Microsoft Security Baseline for Windows and Edge; layer custom policies on top.
  • Local admin removal: Use Endpoint Privilege Management or LAPS; normal users should not be local admins.
  • Disk encryption: Require BitLocker with recovery keys in Azure AD.
  • Defender for Endpoint: Onboard all devices; block access from devices with high risk.

Example: enforce BitLocker via Intune Device Configuration (simplified OMA-URI):

./Device/Vendor/MSFT/BitLocker/RequireDeviceEncryptionOnCapableDevices = 1
./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption = 1
./Device/Vendor/MSFT/BitLocker/OSDriveRecovery = 2   # store in AAD

3.3 Tie Device Compliance Into Conditional Access

Compliance is the bridge between Intune and CA. Define simple, defensible rules:

  • Device is encrypted.
  • Defender is running and healthy.
  • No critical security updates missing.

Then enforce in Conditional Access:

  • Policy: Require compliant devices for Office 365.
  • Users: All employees.
  • Conditions: Any location, any device.
  • Grant: Require device to be marked compliant.

For BYOD, flip the pattern: allow access via approved apps with app protection policies, block browser and native app access from unmanaged endpoints.

4. Network and Application Access: From Flat LANs to Segmented, App-Centric Access

4.1 Clean Up Your Network Story

Zero Trust doesn’t mean the network disappears. It means the network stops being your only defence. Baseline actions:

  • Segment by function: Users, servers, OT/IoT, management. No shared flat /16 campus VLANs.
  • Harden core services: DCs and management interfaces live on separate, locked-down subnets.
  • East-west filtering: Use firewall policies or NSGs (if Azure) to control lateral movement between segments.

Example VLAN layout (on-prem):

  • VLAN 10 – User endpoints
  • VLAN 20 – Servers
  • VLAN 30 – Management / jump hosts
  • VLAN 40 – OT/IoT

Between them: deny by default, allow by need, monitored in your SIEM.

4.2 Modern Remote Access: Publish Apps, Not Networks

Legacy VPN gives an attacker a free lateral movement ticket. Replace “full tunnel for everyone” with app-centric access:

  • Use Azure AD Application Proxy or reverse proxies for line-of-business web apps.
  • Consider SSE/ZTNA solutions to give remote access to specific apps, not entire subnets.
  • Protect everything with Entra ID, Conditional Access, and per-app logging.

For on-prem web apps using Azure AD App Proxy:

  1. Install the App Proxy connector inside the network.
  2. Register the app in Entra ID, set pre-authentication to Azure Active Directory.
  3. Bind a CA policy that requires compliant devices and MFA.

4.3 Micro-Segmentation Where It Matters

Full micro-segmentation everywhere is a multi-year project. Start with high-value assets:

  • Domain controllers
  • Backup infrastructure
  • Tier-0 admin systems and jump hosts

For those, enforce:

  • Network ACLs limiting which subnets can talk to them.
  • Access only through hardened jump hosts.
  • Strong MFA-backed admin accounts managed by PIM.

5. Data and SaaS: Protect the Thing That Actually Matters

5.1 Classify and Label Data

Zero Trust aims to protect data, not just endpoints. Use Purview / sensitivity labels to classify:

  • Public
  • Internal
  • Confidential
  • Highly confidential

Then tie sharing and access rules to labels. Example: “Highly confidential” cannot be downloaded to unmanaged devices and cannot be shared externally.

5.2 App Governance and Shadow IT

It’s 2026; users have connected a small forest of SaaS apps to your tenant. You can’t ignore it.

  • Use Entra ID Enterprise Apps and Defender for Cloud Apps (if you have it) to inventory OAuth grants.
  • Block risky consent (e.g., offline_access, Mail.ReadWrite) from unverified publishers.
  • Implement an approval flow for new enterprise apps.

Configure admin consent workflow so that high-permission consents require security review instead of being auto-approved.

6. Monitoring, Detection, and Recovery: Assume You’ll Be Wrong Sometimes

6.1 What to Actually Monitor

Zero Trust without visibility is theatre. At a minimum, ingest into your SIEM/XDR:

  • Entra ID sign-in logs and audit logs
  • Defender for Endpoint alerts
  • Key network firewall logs (north-south and critical east-west)
  • SaaS security logs for critical apps (M365, CRM, HR systems)

Prioritise detections around:

  • Impossible travel and atypical locations
  • Token theft patterns (same token used from multiple IPs)
  • Privilege escalation and new admin assignments
  • Mass file exfiltration from SharePoint/OneDrive

6.2 Basic Zero Trust Incident Response Playbook

You don’t need a 50-page document, but you do need a repeatable playbook. For identity-centric incidents, define a quick flow:

  1. Contain: Revoke sessions, reset password, disable account if needed.
  2. Scope: Check sign-in logs, devices used, apps accessed, consents granted.
  3. Eradicate: Remove malicious OAuth apps, wipe compromised devices, tighten CA where bypassed.
  4. Recover: Re-enable access under stricter conditions (MFA, passwordless, compliant device only).

Entra ID quick containment example:

Connect-MgGraph -Scopes 'Directory.AccessAsUser.All'
$user = Get-MgUser -UserId '[email protected]'

# Revoke all refresh tokens and sessions
Revoke-MgUserSignInSession -UserId $user.Id

# Force password reset (if you manage passwords in AAD)
Update-MgUser -UserId $user.Id -PasswordPolicies 'DisablePasswordExpiration' `
  -PasswordProfile @{ forceChangePasswordNextSignIn = $true; password = '<TempStrongPassword>' }

7. A Practical 90-Day Zero Trust Roadmap

If you try to do everything at once, you’ll stall. Here’s a realistic 90-day sequence that most mid-size orgs can handle.

Days 0–30: Stabilise Identity and Access

  • Disable legacy auth (or at least put in report-only and clean exceptions).
  • Roll out tenant-wide MFA with a clear communications plan.
  • Set up two break-glass accounts and PIM for admin roles.
  • Create baseline CA policies (block legacy, MFA, high-risk block) in report-only.

Days 31–60: Bring Devices Into the Story

  • Enrol all corporate Windows devices into Intune; start with new devices via Autopilot.
  • Apply baseline security policies: BitLocker, Defender, security baseline.
  • Define and enforce device compliance policies.
  • Tie Office 365 access to compliant or app-protected devices.

Days 61–90: Tighten Network and High-Value Assets

  • Segment core networks (user, server, management, OT/IoT) with default-deny rules.
  • Move remote access away from full-tunnel VPN towards published apps or ZTNA.
  • Apply stricter CA and PIM controls around Tier-0 assets and privileged users.
  • Onboard key logs into SIEM/XDR and define 5–10 high-value detections.

One Clear Next Step

Don’t start by drawing a giant Zero Trust target architecture in Visio. Start by fixing identity.

Within the next week, get MFA on for everyone, deploy at least one Conditional Access policy in report-only, and set up proper break-glass and PIM for admins. Once identity is under control, every other Zero Trust move—Intune, segmentation, app publishing—becomes dramatically easier and safer to roll out.