Following on from my intro post, I’ve now worked through the Zero Trust unit of the Explore Microsoft 365 security foundations module, and this is the one I’d call the backbone of the whole course. If you only properly absorb one unit before sitting AB-900, make it this one — everything else in the security module builds on it.
Here are my notes, rewritten in my own words so they actually stick, plus a practice quiz I put together at the end to test myself. Feel free to use it.
What Zero Trust actually means
The old way of thinking about network security was like an office building with a locked front door: once you’re inside, you can wander around freely. Zero Trust throws that out. The assumption becomes that no user, device, or app is trusted by default — even if it’s sitting inside the corporate network. Every single access request has to prove itself.
Why the shift? Because the “inside” barely exists anymore. People work from home, from cafes, from their phones. Company data lives in the cloud rather than behind an office firewall. And attackers have moved on too — instead of breaking through firewalls, they now go after identities, because stealing a password is easier than breaching a network.
One thing the course makes clear early: Zero Trust is not a product you can buy and switch on. It’s a strategy that Microsoft 365 implements through a combination of tools — Entra ID, Defender, Intune, Purview — working together.
The three core principles
1. Verify explicitly. Every access request gets authenticated and authorised using all the signals available: who the user is, what device they’re on, where they’re signing in from, how they normally behave, and how risky the attempt looks. In Microsoft 365 this happens through Conditional Access policies, risk-based sign-in evaluation, and MFA.
The part I found genuinely clever is how adaptive it is. Entra Identity Protection uses machine learning to spot things like “impossible travel” (a sign-in from Darwin and then Moscow ten minutes later) and adjusts the response — allow, challenge with MFA, or block. So a user on a known laptop in a trusted location gets a smooth sign-in, while the same account from an unknown device overseas gets stopped at the door. Security without constantly annoying your users.
Also worth knowing: MFA in Microsoft 365 isn’t just app notifications. Passwordless options like Windows Hello and FIDO2 security keys count too, and they remove the weakest link — the password itself.
2. Least privilege access. Everyone gets the minimum access they need to do their job, nothing more. If an account does get compromised, the damage is contained. Two tools drive this:
- Role-Based Access Control (RBAC): predefined roles with specific permissions. A helpdesk tech gets a Password Administrator role — they can reset passwords but can’t read anyone’s mailbox.
- Privileged Identity Management (PIM): just-in-time elevation. An admin requests temporary elevated access for a specific task, it can require approval, everything is logged, and the privileges expire automatically when the job’s done. No one carries god-mode permissions around permanently.
3. Assume breach. This is the mindset shift that stuck with me most: operate as if attackers are already inside. So instead of only building walls, you focus on containment, monitoring, and rapid response. The tools here are:
- Defender for Endpoint — watches device behaviour for things like ransomware activity or lateral movement, and can automatically isolate a suspicious machine from the network.
- Microsoft Sentinel — the big-picture correlator. It pulls in logs from across Microsoft 365 (and non-Microsoft sources), connects the dots between, say, a phishing email, a compromised account, and a malicious file, and can trigger automated response playbooks.
- Defender for Identity — watches identity traffic for attack techniques like Pass-the-Hash and Golden Ticket attacks, which matters a lot in hybrid environments.
The six pillars
Zero Trust in Microsoft 365 spans six domains, and the exam-relevant skill here is knowing which tool belongs to which pillar:
- Identity — Entra ID: centralised authentication, passwordless sign-in, risk-based Conditional Access.
- Endpoints — Intune enforces device compliance (encryption, antivirus, OS version); non-compliant devices get blocked. App protection policies handle BYOD scenarios. Endpoint Analytics gives visibility into device health.
- Applications — Defender for Cloud Apps tackles shadow IT, can block risky apps and apply session controls like preventing downloads. Entra App Proxy gives secure remote access to on-premises apps.
- Data — Purview Information Protection classifies, labels, and encrypts sensitive content; DLP policies stop things like Social Security numbers being emailed out.
- Infrastructure — Defender for Cloud assesses security posture (including AWS and Google Cloud), and Azure Policy enforces governance rules on cloud resources.
- Network — Azure Firewall, VPN Gateway, and Defender for Identity control and monitor traffic, catching things like data exfiltration and lateral movement.
My memory trick: Important Exams Always Demand Intense Notes — Identity, Endpoints, Applications, Data, Infrastructure, Network.
Practice quiz: test yourself
I wrote these to mimic the style of fundamentals-level exam questions. Answers and explanations are at the bottom — no peeking.
Q1. What is the fundamental assumption of the Zero Trust security model?
- A) Users inside the corporate network can be trusted
- B) No user, device, or application should be trusted by default, regardless of location
- C) Only external traffic needs to be verified
- D) Trust is established once at first sign-in and persists afterwards
Q2. Which of the following are the three core principles of Zero Trust?
- A) Encrypt everything, monitor everything, log everything
- B) Prevent, detect, respond
- C) Verify explicitly, least privilege access, assume breach
- D) Identity, endpoints, data
Q3. A company wants to require MFA only when users access SharePoint Online from outside the corporate network. Which Microsoft 365 feature should they use?
- A) Data Loss Prevention
- B) Conditional Access policies in Microsoft Entra ID
- C) Azure Policy
- D) Endpoint Analytics
Q4. A global administrator needs elevated permissions for a one-off configuration task. Which tool provides temporary, just-in-time access that expires automatically?
- A) Role-Based Access Control (RBAC)
- B) Microsoft Sentinel
- C) Privileged Identity Management (PIM)
- D) Microsoft Intune
Q5. A helpdesk technician is given a role that allows password resets but nothing else. Which principle and feature does this demonstrate?
- A) Assume breach, via Defender for Endpoint
- B) Verify explicitly, via MFA
- C) Least privilege access, via RBAC
- D) Least privilege access, via Conditional Access
Q6. Which tool detects sign-in anomalies such as “impossible travel” and adjusts the authentication response based on risk?
- A) Microsoft Entra Identity Protection
- B) Microsoft Purview
- C) Azure Firewall
- D) Endpoint Analytics
Q7. Which service aggregates and correlates security logs and alerts from Microsoft 365 and non-Microsoft sources, and can trigger automated response playbooks?
- A) Defender for Endpoint
- B) Microsoft Sentinel
- C) Defender for Cloud Apps
- D) Microsoft Entra App Proxy
Q8. A user tries to open Microsoft Teams on a jailbroken phone and is blocked. Which tool enforced this?
- A) Microsoft Purview
- B) Microsoft Intune device compliance policies
- C) Microsoft Sentinel
- D) Azure Policy
Q9. An employee uploads sensitive company files to a personal cloud storage account. Which tool is designed to detect and block this kind of shadow IT activity?
- A) Defender for Cloud Apps
- B) Defender for Identity
- C) VPN Gateway
- D) Privileged Identity Management
Q10. A document containing credit card numbers is automatically labelled “Confidential” and encrypted. Which pillar and tool does this represent?
- A) Infrastructure — Defender for Cloud
- B) Data — Microsoft Purview Information Protection
- C) Applications — Entra App Proxy
- D) Network — Azure Firewall
Q11. Which tool monitors identity traffic for attack techniques such as Pass-the-Hash and Golden Ticket attacks?
- A) Microsoft Defender for Identity
- B) Microsoft Intune
- C) Azure Policy
- D) Endpoint Analytics
Q12. Which of the six Zero Trust pillars does Azure Policy primarily support?
- A) Identity
- B) Data
- C) Infrastructure
- D) Endpoints
Answers
- B — Zero Trust means nothing is trusted by default, inside or outside the network. Every request must be verified.
- C — Verify explicitly, least privilege access, and assume breach. The six pillars (option D lists some) are domains where the principles apply, not the principles themselves — a classic exam trap.
- B — Conditional Access evaluates signals like location, device, and app sensitivity to make dynamic access decisions, including requiring MFA in specific situations.
- C — PIM provides just-in-time elevation with optional approval workflows, audit logging, and automatic expiry. RBAC (option A) defines what a role can do, but PIM controls when elevated roles are active.
- C — Granting only the permissions needed for the job is least privilege, and predefined roles like Password Administrator are how RBAC implements it.
- A — Entra Identity Protection uses machine learning and threat intelligence to score sign-in risk and respond accordingly (allow, require MFA, or block).
- B — Sentinel is the SIEM-style correlator across sources; Defender for Endpoint (option A) focuses on device-level detection.
- B — Intune compliance policies can block non-compliant devices (jailbroken, unencrypted, outdated OS) from accessing corporate resources.
- A — Defender for Cloud Apps provides visibility into unsanctioned apps (shadow IT) and can block risky sessions in real time.
- B — Automatic classification, labelling, and encryption of sensitive content is Purview Information Protection, under the Data pillar.
- A — Defender for Identity watches identity-related traffic for compromise techniques, especially important in hybrid environments.
- C — Azure Policy enforces governance rules on cloud resources (allowed VM sizes, required encryption, tagging), which sits under the Infrastructure pillar.
How did you go? For me, the questions I initially got tangled on were the tool-to-pillar mappings — there’s a lot of overlap in the Defender family names, so it’s worth drilling those until they’re automatic.
That’s it for this one — wait until the next post!
