Zero Trust: Never Trust, Always Verify
Zero Trust is the security philosophy behind everything in Microsoft 365. Three principles that change how you think about security — and that the exam tests heavily.
What is Zero Trust?
Imagine a building where everyone has to show ID at every door — not just the front entrance.
In the old security model, once you got past the front door (the corporate firewall), you were trusted everywhere. Walk freely, open any office, access any file.
Zero Trust says: no. Every door checks your ID. Every time. Even if you just walked through the door next to it. Even if you work here. Even if you’ve been here for 20 years.
Why? Because threats come from inside too. A compromised account, a stolen laptop, a malicious insider — if they’re already “inside,” the old model can’t stop them.
The three core principles
These three principles are tested on almost every security question:
| Principle | What It Means | Example |
|---|---|---|
| Verify explicitly | Always authenticate and authorise based on all available data points | Check the user’s identity, device health, location, AND the sensitivity of what they’re accessing |
| Use least privilege access | Give only the minimum permissions needed, for only as long as needed | Maya gets Exchange Admin (not Global Admin). PIM gives time-limited elevation. |
| Assume breach | Design systems as if an attacker is already inside | Segment networks, encrypt data at rest and in transit, monitor for anomalies |
Exam tip: recognising Zero Trust principles in questions
The exam often describes a scenario and asks “which Zero Trust principle does this follow?”
Pattern recognition:
- If the answer involves checking multiple factors before granting access → Verify explicitly
- If the answer involves limiting permissions or time-bound access → Least privilege
- If the answer involves monitoring, segmentation, or encryption → Assume breach
Sometimes questions combine principles: “Check the user’s device compliance (verify explicitly) and only grant read access (least privilege) to sensitive files.”
Zero Trust in Microsoft 365 — the six pillars
Microsoft applies Zero Trust across six areas:
| Feature | M365 Service | Example |
|---|---|---|
| 🆔 Identity | Microsoft Entra ID | MFA, Conditional Access, PIM |
| 💻 Devices | Intune, Defender for Endpoint | Device compliance, health checks |
| 📱 Applications | Entra App Registration, Defender for Cloud Apps | App permissions, shadow IT detection |
| 📄 Data | Microsoft Purview | Sensitivity labels, DLP, encryption |
| 🏗️ Infrastructure | Azure, Defender for Cloud | Secure configurations, monitoring |
| 🌐 Networks | Global Secure Access | Network segmentation, secure connections |
Scenario: Clearfield Council implements Zero Trust
Director Chen rolls out Zero Trust across Clearfield Council:
- Identity: MFA required for all users + Conditional Access blocks sign-ins from unknown locations
- Devices: Only Intune-managed devices can access M365 (personal phones blocked)
- Applications: All third-party apps require admin approval before users can consent
- Data: Sensitivity labels auto-applied to documents containing personal data
- Infrastructure: All admin accounts require PIM activation (time-limited, approved)
- Networks: Remote access only through Global Secure Access (no open VPN)
Each layer adds protection. If one layer fails (e.g., a password is compromised), the other layers still protect the organisation.
Microsoft Secure Score
Secure Score is a measurement of your organisation’s security posture:
- Scores range from 0 to a maximum based on your subscriptions
- Higher = more secure
- Based on recommended actions (enable MFA, block legacy auth, etc.)
- Found in the Microsoft Defender portal (security.microsoft.com)
Key exam concept: Secure Score tells you HOW well you’ve implemented Zero Trust. It’s a dashboard, not a policy — it recommends actions but doesn’t enforce them.
🎬 Video walkthrough
🎬 Video coming soon
Zero Trust Explained — AB-900 Module 6
Zero Trust Explained — AB-900 Module 6
~9 minFlashcards
Knowledge Check
Northwave's CISO Jordan wants to ensure that even if an employee's password is compromised, an attacker can't access sensitive files. Which Zero Trust principle should Jordan focus on?
Maya assigned a temporary Global Admin role to herself for 4 hours to perform a critical configuration change, which then automatically revoked. Which TWO Zero Trust principles does this demonstrate? (Select 2)
Next up: Authentication — from passwords to passkeys, the methods Microsoft 365 uses to prove you are who you say you are.