Zero Trust
Security model that assumes breach and verifies every access request as though it originates from an untrusted network.
What is Zero Trust?
Zero Trust replaces the traditional perimeter-based security model ("trust inside, verify outside") with explicit verification of every access request. The three principles are: verify explicitly (authenticate and authorize based on all available signals), use least privileged access, and assume breach (minimize blast radius and segment access). Identity is the primary control plane in Zero Trust architecture.
In Microsoft 365
Microsoft Zero Trust architecture uses Azure AD/Entra ID as the identity control plane. Conditional Access policies verify every sign-in, PIM provides just-in-time privileged access, and device compliance ensures endpoint health. Microsoft Defender provides threat signals that feed into access decisions.
Examples
- 1Requiring device compliance for all access, not just remote
- 2Continuous access evaluation for real-time policy enforcement
- 3Risk-based Conditional Access policies
Related TrueConfig Controls
These controls help implement and verify zero trust in your Microsoft 365 environment.