In my last post I covered the theory — the three principles and six pillars of Zero Trust. This unit takes it from theory to practice: how does an organisation actually roll out Zero Trust in Microsoft 365? Turns out it’s not a switch you flip, it’s a six-phase journey, and each phase has its own set of tools. Here’s how I’ve broken it down for myself.
It’s a process, not a product
The first thing worth repeating from this unit: Zero Trust implementation is continuous. You assess, apply controls, monitor, and refine — then go around again. It needs coordination across teams, not just an IT admin ticking boxes. Microsoft 365 is well suited to this because identity, security, and compliance are all natively integrated rather than being bolted-on separate products.
Phase 1: Assess current security posture
You can’t fix what you can’t see. Before touching any controls, you need visibility into your assets, users, and workflows — what’s critical, who accesses it, and under what conditions.
Two tools do the heavy lifting here:
- Microsoft Secure Score — gives you a number (say, 45 out of 100) that reflects your overall security posture, and flags specific gaps like missing MFA or excessive admin privileges, with prioritised recommendations.
- Microsoft Purview Compliance Manager — maps your current setup against regulatory standards like HIPAA or ISO 27001, which matters a lot for organisations in regulated industries.
Phase 2: Enable identity protection
With a baseline in place, identity comes first among the six pillars — it’s the gateway to almost everything else in Microsoft 365. This phase isn’t just “turn on MFA.” It’s about continuously evaluating whether every access attempt can be trusted, using Entra ID’s combination of:
- Conditional Access policies — context-aware rules based on user, device, location, and risk (e.g. require MFA for SharePoint access from outside the network, block unmanaged devices entirely).
- Risk-based authentication — machine learning flags anomalies like impossible travel or known-compromised credentials, and responds by blocking, challenging, or forcing a password reset.
- Identity governance — access reviews and entitlement management, so temporary access (like a contractor on a project) automatically expires instead of quietly lingering forever.
Phase 3: Enforce endpoint compliance
Next, the devices themselves. Microsoft Intune is the tool of choice here, covering three angles:
- Endpoint compliance policies — checks for things like BitLocker encryption and up-to-date patches; devices that fail are blocked until they meet requirements.
- App protection policies — useful for BYOD, letting you enforce PIN protection and block copy-paste on something like Outlook for iOS, even on a personal, unmanaged phone.
- Endpoint Analytics — surfaces device health trends (crashes, outdated drivers) so problems get fixed before they become security risks.
Phase 4: Classify and protect data
Since data is what attackers are actually after, this phase is where Microsoft Purview earns its keep:
- Sensitivity labels — automatically classify and encrypt content (a document with credit card numbers gets labelled “Confidential” and locked down to authorised users only).
- Data Loss Prevention (DLP) — stops sensitive data leaving in the wrong way, like blocking an email containing Social Security numbers, or stopping an upload to personal cloud storage.
- Policy tuning — DLP isn’t set-and-forget; if a policy throws too many false positives, admins refine it based on real-world feedback.
Phase 5: Monitor and respond to threats
This is the “assume breach” principle in action — continuous detection and response, not just prevention:
- Microsoft Defender for Endpoint — watches device behaviour and can automatically isolate a machine that’s talking to a known malicious server.
- Microsoft Sentinel — the SIEM layer, correlating signals across Microsoft 365 and beyond to spot multi-stage attacks, with automated response playbooks.
- Microsoft Defender for Identity — this one I had slightly wrong before: it specifically monitors on-premises Active Directory domain controller traffic, detecting things like credential theft and lateral movement, and works alongside Entra ID Protection within Defender XDR to give a unified view across hybrid environments. Worth remembering that distinction for the exam — Defender for Identity is the on-prem AD piece, not a cloud-only tool.
Phase 6: Educate users
The last phase is the one that’s easy to overlook when you’re deep in technical configuration, but the module is blunt about it: people are often the weakest link. Tools here include:
- Attack simulation training (Defender for Office 365) — realistic phishing simulations that redirect users who click a bad link straight into a short training module.
- Security awareness campaigns — ongoing reinforcement through Viva Learning, Teams posts, or newsletters covering things like password hygiene and incident reporting.
- Role-specific training — tailored by risk profile, so Finance gets invoice-fraud training, developers get secure coding practices, and executives get strategic risk briefings.
My takeaway
What struck me most is the order: identity before endpoints, endpoints before data, and monitoring and user education both come after the technical controls are in place — because Zero Trust assumes those controls will eventually be tested, and you need to be ready to detect and respond when they are.
Practice quiz: implementing Zero Trust
Q1. What is the correct order of the six Zero Trust implementation phases?
- A) Educate users → Assess posture → Identity → Endpoints → Data → Monitor
- B) Assess posture → Identity protection → Endpoint compliance → Data classification → Monitor and respond → Educate users
- C) Identity → Data → Endpoints → Assess posture → Educate users → Monitor
- D) Monitor → Assess posture → Identity → Data → Endpoints → Educate users
Q2. Which tool gives organisations a quantitative score reflecting their overall Microsoft 365 security posture, along with prioritised recommendations?
- A) Microsoft Purview Compliance Manager
- B) Microsoft Secure Score
- C) Microsoft Sentinel
- D) Endpoint Analytics
Q3. A healthcare organisation needs to check its Microsoft 365 configuration against HIPAA requirements. Which tool should it use?
- A) Microsoft Secure Score
- B) Microsoft Purview Compliance Manager
- C) Microsoft Defender for Cloud Apps
- D) Microsoft Intune
Q4. Why does identity protection come immediately after the assessment phase, rather than later?
- A) Because identity is the least important pillar
- B) Because identity governs access to nearly every other resource in Microsoft 365
- C) Because Conditional Access requires endpoint compliance to be configured first
- D) Because Microsoft Entra ID cannot be configured until data is classified
Q5. A contractor is granted temporary access to a SharePoint site for a three-month project, with access set to expire automatically. Which Entra ID capability does this describe?
- A) Risk-based authentication
- B) Identity governance (entitlement management)
- C) App protection policies
- D) Endpoint Analytics
Q6. Which Intune capability would prevent copy-paste actions in Outlook on an employee’s personal, unmanaged iPhone?
- A) Endpoint compliance policies
- B) App protection policies
- C) Conditional Access
- D) Sensitivity labels
Q7. A document containing credit card numbers is automatically labelled “Confidential” and encrypted so only authorised users can open it. Which phase and tool does this belong to?
- A) Phase 3, Microsoft Intune
- B) Phase 4, Microsoft Purview Information Protection (sensitivity labels)
- C) Phase 5, Microsoft Sentinel
- D) Phase 2, Conditional Access
Q8. Which statement about Microsoft Defender for Identity is correct?
- A) It only monitors cloud-based Entra ID sign-ins
- B) It focuses on on-premises Active Directory domain controller traffic and works alongside Entra ID Protection in Defender XDR
- C) It replaces the need for Microsoft Sentinel
- D) It is used exclusively for endpoint compliance enforcement
Q9. Which tool correlates security signals across Microsoft 365 and non-Microsoft sources, and can trigger automated response playbooks?
- A) Microsoft Sentinel
- B) Microsoft Secure Score
- C) Endpoint Analytics
- D) Microsoft Purview Compliance Manager
Q10. An organisation runs simulated phishing emails and automatically enrols anyone who clicks a malicious link into a short training module. Which feature is this?
- A) Security awareness campaigns via Viva Learning
- B) Role-specific training
- C) Attack simulation training in Defender for Office 365
- D) Identity governance
Q11. Why does Phase 6 (educate users) come last in the implementation sequence, according to the module?
- A) Because user training is the least effective control
- B) Because technical controls must be tested before users can be trained on them
- C) Because people are often the weakest link, and ongoing education reinforces the technical controls already in place
- D) Because Viva Learning requires Sentinel to be configured first
Q12. A DLP policy is generating too many false positives and disrupting normal business workflows. What should an administrator do, according to Phase 4 guidance?
- A) Disable DLP entirely
- B) Refine and tune the policy based on incident feedback
- C) Replace DLP with sensitivity labels only
- D) Escalate to Microsoft Sentinel
Answers
- B — Assess posture → Identity → Endpoints → Data → Monitor and respond → Educate users. This sequence builds from visibility, through the pillars, to ongoing detection and human readiness.
- B — Secure Score quantifies posture and prioritises fixes; Compliance Manager (option A) is about regulatory mapping, not a general security score.
- B — Compliance Manager maps configurations to standards like HIPAA and ISO 27001 and suggests improvement actions.
- B — Identity is described as the first and most critical control plane because it gates access to nearly every other resource.
- B — This is entitlement management under identity governance — access with automatic expiration and review, reducing privilege creep.
- B — App protection policies operate at the application level, enabling controls like blocking copy-paste and requiring a PIN, even on unmanaged personal devices.
- B — Sensitivity labels are part of Purview Information Protection, under Phase 4 (classify and protect data).
- B — This is the detail worth memorising: Defender for Identity’s telemetry is centred on on-premises AD domain controllers, even though it integrates with cloud identity protection via Defender XDR.
- A — Sentinel is the SIEM that aggregates and correlates across sources and can run automated playbooks.
- C — Attack simulation training specifically uses realistic phishing simulations with automatic redirection to training when a user clicks.
- C — The module frames user education as reinforcing technical controls, since human error can undermine even strong technical defences.
- B — The module explicitly calls for tuning policies based on feedback rather than abandoning or replacing them.
That’s it for this one — wait until the next post!
