How can you secure a company's digital assets when attackers might already be inside the network, or when employees work from coffee shops and home offices? This is the core problem that Zero Trust principles solve, and it is absolutely critical for the Microsoft Cybersecurity Architect (SC-100) exam. As a future architect, you need to design strategies that protect data and systems not by building a single wall around them, but by constantly questioning every single access request, regardless of where it comes from.
Jump to a section
A simple way to picture Zero Trust Principles and Strategy Development
Why does a building full of people need to distrust everyone until they prove they belong, every single time they walk through a door?
Imagine a nightclub with multiple rooms: the main dance floor, a VIP lounge, a backstage area, and the DJ booth. In the old security model, a bouncer checked IDs at the front door. Once you flashed your ID, you were in. You could wander anywhere — VIP, backstage, the DJ booth — because the club assumed that if you passed the front door check, you were trustworthy. But that led to problems: people sneaked into VIP, interfered with the DJ, and stole equipment. The club realised that trusting everyone after a single check was dangerous.
So they adopted a Zero Trust approach. Now, every time you enter a new room, you have to prove who you are. The bouncer at the front door checks your ticket. Then, when you try to enter the VIP lounge, another bouncer scans your wristband and checks a photo ID. To get backstage, you need a specific pass that only the band's manager has. Even if you are a known regular, you cannot walk into the DJ booth without re-authenticating with a fingerprint. The club also monitors your behaviour — if you try to follow someone through a door without scanning, an alarm goes off. This is Zero Trust: never trust, always verify, no matter where you are or who you claim to be.
Zero Trust is a security model that throws out the old idea of a trusted internal network. In the traditional model (often called the castle-and-moat approach), the network inside the organisation's firewall was considered safe. Once a user or device was inside the corporate network, they were implicitly trusted and could access many resources. This model failed because attackers who breached the perimeter (for example, through a phishing email) could move freely inside.
Zero Trust operates on one foundational principle: never trust, always verify. It assumes that the network is always hostile, both from outside and inside. Every request for access to a resource — whether it comes from a laptop in the office, a phone in a coffee shop, or a server in the cloud — must be fully authenticated, authorised, and continuously validated before access is granted.
To understand how Zero Trust works, you need to know its three core pillars:
Verify explicitly: Always authenticate and authorise based on all available data points. This includes the user's identity (who they are), the device's health (is it up to date with patches?), the location (is it coming from a known office or an unusual country?), and the requested resource. If a user typically logs in from London at 9 AM and suddenly a request comes from Brazil at 3 AM, that request is treated with suspicion.
Use least privileged access: Give users only the exact permissions they need to do their job, and nothing more. This limits the damage if credentials are stolen. For example, a junior accountant should not have access to the CEO's payroll data. This is enforced using tools like Just-In-Time (JIT) and Just-Enough-Access (JEA) policies.
Assume breach: Design your security strategy as if an attacker is already inside your network. This means segmenting the network into small zones, encrypting all traffic (even inside the corporate network), and constantly monitoring for unusual activity. If an attacker compromises one virtual machine, the blast radius should be limited to just that machine.
Zero Trust replaces the perimeter-based model with micro-perimeters around every resource. Instead of one big firewall at the edge of your network, you put security controls (like authentication and access policies) around each application, data set, and service. This is often visualised as the 'Zero Trust architecture' diagram from Microsoft, which includes identity (Microsoft Entra ID), endpoints (devices), data, applications, network, and infrastructure.
For example, consider a user accessing a payroll application from their work laptop. In the traditional model, if the laptop was connected to the office network, access was allowed. In Zero Trust:
The user signs into Microsoft Entra ID with a password and a multi-factor authentication (MFA) code from their phone.
The laptop is checked for compliance: is its antivirus active? Is the operating system up to date? Is disk encryption enabled? If not, access is blocked or limited.
The user's request to open the payroll app is evaluated against a conditional access policy. This policy might say: 'Allow access only if the user is in the HR group AND the device is compliant AND the location is the corporate office.'
Inside the payroll app, the user can only view the specific page for their own department, and cannot download the entire payroll database because of data classification policies (like Microsoft Purview Information Protection).
This entire process happens in milliseconds, and the user might not even notice. But it represents a fundamental shift from trusting a network location to trusting a set of verified claims.
Define the protection scope
Identify the organisation's most critical data, applications, and systems that need protection. This is the foundation of the strategy. Without knowing what to protect, you cannot design effective policies. An architect would list crown jewel assets (like customer databases, financial records, and intellectual property) and their locations (on-premises, cloud, SaaS).
Map the identity and access landscape
Document all identity providers (e.g., on-premises Active Directory, Microsoft Entra ID, third-party SSO) and all user groups. This step ensures no user or account is hidden. Then, enforce strong authentication (MFA) for all accounts, including service accounts and emergency break-glass accounts. The goal is to verify every identity explicitly.
Enforce device compliance
Define a baseline for device health: operating system patches, antivirus active, encryption enabled, and device managed (e.g., via Microsoft Intune). Conditional Access policies should block non-compliant devices from accessing corporate resources. This ensures that even if a user is legitimate, their device is not a vector for attack.
Segment the network and apply micro-perimeters
Divide the network into logical zones (e.g., production, development, management) using Azure Virtual Networks and Network Security Groups. Deploy micro-perimeters around each critical application so that traffic between zones is authenticated and authorised. For example, a web server should not be able to directly communicate with the database server without going through an authorised API gateway.
Classify and protect data
Use a data classification framework like Microsoft Purview to label data based on sensitivity (e.g., public, internal, confidential, highly restricted). Apply policies that automatically encrypt sensitive data, restrict sharing, and prevent data loss. This step ensures that even if an attacker gains access to a resource, they cannot exfiltrate valuable data.
Implement continuous monitoring and automation
Deploy a SIEM (security information and event management) solution like Microsoft Sentinel to collect logs from all layers (identity, endpoints, network, apps). Create detection rules for anomalous behaviour (e.g., unusual logon times, mass file downloads). Automate responses, such as revoking a session when a suspicious activity is detected, using Azure Logic Apps or Microsoft 365 automated investigation and response.
An IT professional implementing a Zero Trust strategy does not just read a document. They run a project that touches every part of the organisation.
Let us walk through a concrete scenario: a medium-sized company called 'GreenLeaf Ltd' with 500 employees. They use Microsoft 365, a custom CRM application hosted on Azure Virtual Machines, and they have a small on-premises file server for legacy data. The IT security manager, Priya, is tasked with defining a Zero Trust strategy.
Step one: Priya starts with identity. She ensures that all users are in Microsoft Entra ID (the cloud-based identity and access service) and enforces multi-factor authentication for every single account, including service accounts and break-glass emergency accounts. She creates conditional access policies that block logins from untrusted countries and require a compliant device.
Step two: device management. Priya uses Microsoft Intune (a cloud service for managing devices) to enforce policies on all company laptops and mobiles. Devices must have the latest security patches, have BitLocker encryption enabled, and have Microsoft Defender for Endpoint running. Any device that does not meet these standards is blocked from accessing corporate resources.
Step three: network segmentation. Priya works with the network team to use Azure Virtual Network (VNet) segmentation. The CRM application sits in a separate subnet from the file server. The only way to access the file server is through an approved jump box (a locked-down management server) that requires separate authentication. All traffic between subnets is encrypted and logged.
Step four: data protection. Priya classifies all sensitive data using Microsoft Purview. She applies labels like 'Confidential - Finance' and 'Highly Restricted - HR'. These labels travel with the data. If someone tries to copy sensitive data to a personal cloud storage, it is automatically blocked.
Step five: monitoring and response. Priya sets up Microsoft Sentinel (a security information and event management tool) to collect logs from Microsoft Entra ID, Azure VMs, and Microsoft 365. She creates alerts for behaviour like a user downloading 1000 files in 10 minutes, or an admin creating a new user account at 2 AM.
The real-world actions an architect takes include:
Mapping out all identity providers and consolidating them into Microsoft Entra ID.
Defining conditional access policies based on user roles, device health, and location.
Segmenting the network into logical zones with Azure Firewall and Network Security Groups (NSGs).
Implementing Just-In-Time access for admin roles so that elevated permissions are only granted for a specific time window.
Creating policies for data classification and protection.
Designing a monitoring and logging framework to detect and respond to breaches.
Priya does not do all this alone. She works with business leaders to understand the critical data, with developers to ensure applications support modern authentication (like OAuth 2.0), and with legal to ensure compliance with regulations. The output is a Zero Trust strategy document that outlines the current state, target state, and a phased roadmap.
The SC-100 exam, particularly objective 1.2, tests your ability to define a Zero Trust strategy for enterprise security. It is not a hands-on configuration exam; it tests your architectural thinking.
Here is exactly what you need to know:
First, you must memorise the three core Zero Trust principles: verify explicitly, use least privileged access, and assume breach. The exam loves to present scenarios where a solution violates one of these principles. For example, a question might describe a plan to give all employees access to all SharePoint sites because it is convenient. The correct answer will point out that this violates 'least privileged access'.
Second, you need to know the Microsoft Zero Trust pillars: identity, endpoints, data, applications, network, and infrastructure. The exam may ask which pillar a specific technology belongs to. For instance, Microsoft Intune is an endpoint pillar, while Microsoft Entra ID is the identity pillar. Microsoft Purview is data, and Azure Firewall is network.
Third, you must understand conditional access policies. This is a major exam topic. You need to know that conditional access policies evaluate signals (user, device, location, application, risk) to decide whether to grant access, require MFA, or block the request. Traps include thinking that a VPN creates a trusted network. In Zero Trust, a VPN is just another untrusted network.
Fourth, the exam tests your understanding of 'assume breach' strategies. This includes network segmentation, micro-segmentation, and using tools like Azure Bastion (a service that provides secure RDP/SSH access to VMs without exposing public IPs) instead of a direct RDP port.
Common exam question types include:
Case study questions: You are given a fictional company description and asked to design a Zero Trust strategy. You must select the correct set of recommendations from a list. The trap is often recommending a single perimeter firewall.
'Which technology supports which pillar?' questions: You get a list of Microsoft security services and must map them to the correct Zero Trust pillar. For example, Microsoft Defender for Cloud Apps maps to the 'applications' pillar.
'Identify the violation' questions: A narrative describes a proposed solution that implicitly trusts all traffic inside the corporate network. You must identify that this violates the 'assume breach' principle.
'What is the next step?' questions: After describing a breach scenario, you must select the correct remediation that aligns with Zero Trust, such as revoking session tokens rather than just changing the password.
Key definitions to memorise:
Microsoft Entra ID: The identity and access management service. All modern Zero Trust starts here.
Conditional Access: A tool that enforces policies based on signals.
Just-In-Time (JIT): A policy that gives elevated access only when needed, and for a limited time.
Micro-segmentation: Dividing the network into small, isolated zones so a compromise in one zone does not spread.
Microsoft Sentinel: The cloud-native SIEM (security information and event management) tool used for monitoring.
Traps to watch for:
The exam might describe a solution that uses a traditional VPN to connect remote users. In Zero Trust, a VPN is not sufficient because it gives full network access. The correct answer will recommend a Zero Trust Network Access (ZTNA) solution like Microsoft Entra Internet Access or a VPN app that enforces micro-segmentation.
The exam might suggest that all users should be in a single 'trusted group' for simplicity. This violates 'least privileged access'.
The exam might propose that on-premises resources are inherently safe. The correct answer will remind you to apply the same controls to on-premises traffic as to cloud traffic.
Zero Trust rests on three core principles: verify explicitly, use least privileged access, and assume breach.
The six pillars of a Microsoft Zero Trust strategy are identity, endpoints, data, applications, network, and infrastructure.
Conditional Access policies in Microsoft Entra ID are the primary tool for enforcing Zero Trust identity verification based on user, device, location, and risk signals.
Assume breach means you design your network with micro-segmentation and encrypt all traffic, even inside your own datacentre, to limit the blast radius of a compromise.
Least privileged access is enforced through Just-In-Time (JIT) and Just-Enough-Access (JEA) policies, not by giving users blanket permissions.
Zero Trust is a strategy, not a single product; it requires co-ordinated implementation across identity, devices, data, apps, network, and monitoring.
Traditional VPNs violate Zero Trust principles because they grant broad network access; Zero Trust Network Access (ZTNA) is the preferred alternative.
Data classification and protection (using tools like Microsoft Purview) are essential to ensure that even if data is accessed, it cannot be misused.
These come up on the exam all the time. Here's how to tell them apart.
Traditional Perimeter Security
Trusts all traffic inside the corporate network firewall.
Uses a single strong perimeter (firewall, VPN) as the main defence.
Once inside, users have broad access to many resources.
Zero Trust
Trusts no traffic, regardless of network location.
Uses micro-perimeters around each resource (identity, device, data).
Every resource requires explicit authorisation, even from inside.
VPN (Virtual Private Network)
Grants the user access to the full corporate network.
Often trusts the user once the VPN connection is established.
Difficult to enforce granular policies per application.
Zero Trust Network Access (ZTNA)
Grants access only to a specific application or service, not the whole network.
Verifies identity and device health for every application request, even while connected.
Enforces granular policies (e.g., block download, allow view only).
Single-Factor Authentication (Password Only)
Relies solely on something the user knows.
Easily compromised through phishing or credential theft.
Does not verify the user's physical presence or device.
Multi-Factor Authentication (MFA)
Requires two or more factors: something you know (password), something you have (phone), and/or something you are (fingerprint).
Significantly reduces the risk of credential theft exploitation.
Provides stronger assurance of user identity.
Just-In-Time (JIT) Access
Elevates privileges only for a specific task and time window.
Automatically revokes privileges after the time expires.
Audits and logs each elevation request separately.
Standing Privileged Access (Permanent Admin Rights)
Admin rights are always active, even when not needed.
Leaves a large attack surface permanently open.
Difficult to audit when and why privileges were used.
Mistake
Zero Trust means I should not trust any employees, so I disable all file sharing.
Correct
Zero Trust is about verifying every access request using policies and signals, not about blocking all collaboration. It enables secure sharing rather than preventing it.
The phrase 'never trust' is misinterpreted as 'be paranoid and block everything'. In reality, it means 'do not automatically trust based on location or network, but verify using identity and device health'.
Mistake
Zero Trust is just a technology product that I can buy and install.
Correct
Zero Trust is a security strategy or philosophy. It is implemented using multiple technologies (identity, endpoints, network, data, etc.) but it is not a single product. You cannot buy 'Zero Trust in a box'.
Vendors market 'Zero Trust solutions', leading beginners to think it is a firewall or a VPN replacement. The SC-100 exam stresses the architectural and strategic nature of Zero Trust.
Mistake
Once I implement multi-factor authentication (MFA), I have achieved Zero Trust.
Correct
MFA is one important component within the 'identity' pillar, but Zero Trust also requires device compliance, network segmentation, least privileged access, data classification, and continuous monitoring.
MFA is the most visible and easy-to-explain part, so beginners fixate on it. The exam tests whether you understand the breadth of the model.
Mistake
Zero Trust only applies to cloud environments, not on-premises networks.
Correct
Zero Trust applies to all environments, including on-premises, cloud, and hybrid. The principles are environment-agnostic. You apply the same 'never trust, always verify' logic to a server in your own datacentre as to one in Azure.
The name 'Zero Trust' is heavily marketed with cloud services, leading people to think it is a cloud-only concept. The exam specifically tests that you can design for hybrid environments.
Mistake
The old castle-and-moat model is completely useless now, and everything must be replaced immediately.
Correct
Many organisations run a hybrid model, and some elements of perimeter security (like firewalls at network edges) remain useful. The difference is that in Zero Trust, you no longer implicitly trust traffic that comes through that firewall. You add additional verification layers.
Beginners think Zero Trust means ripping out all firewalls. In reality, it is about adding layers of verification, not removing all traditional controls.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
It means that every access request must be authenticated and authorised using all available data points, including user identity, device health, location, and risk level. You never assume trust based on a network location.
No, Zero Trust is an industry security model. Microsoft has its own implementation (often called the Zero Trust Maturity Model), but the principles are vendor-neutral. The SC-100 exam focuses on Microsoft's implementation, so you need to know their specific pillars and tools.
Not necessarily. Your existing firewall can still be part of a Zero Trust strategy, but you must stop treating the internal network as trusted. You add additional verification layers like conditional access, micro-segmentation, and data classification.
Access is blocked or limited. For example, a non-compliant device might be denied access to corporate email entirely, or it might be allowed only to view but not download attachments. Conditional Access policies are the mechanism that enforces this.
You typically wrap them with a service like Microsoft Entra Application Proxy or use a VPN with strict micro-segmentation. Ideally, you migrate them to support modern authentication (OAuth 2.0 and SAML) to fully integrate with Zero Trust.
Zero Trust reduces the impact of ransomware by limiting the blast radius. If an attacker compromises one device or account, they cannot easily move laterally to encrypt the entire network. Combined with good backup and monitoring, it is a strong defence, but no single strategy guarantees prevention.
You've finished Zero Trust Principles and Strategy Development. Continue through the SC-100 study guide to build a complete picture of the exam.
Done with this chapter?