Zero Trust Architecture Principles

Zero Trust is a security model that assumes breach and verifies each request as though it originates from an open network. It was developed in response to the inadequacy of the traditional perimeter-based security model, often called "castle-and-moat." In the castle-and-moat model, anything inside the corporate network is implicitly trusted. However, with the rise of cloud computing, mobile workforces, and sophisticated attacks, the perimeter has dissolved. An attacker who breaches the perimeter can move laterally with little resistance. Zero Trust eliminates implicit trust and enforces continuous verification for every access request, regardless of the source (inside or outside the network).

Zero Trust is built on three core principles, as defined by NIST SP 800-207 and adopted by Microsoft:

These principles are implemented through a set of technical components that work together. Microsoft's Zero Trust model is organized into six pillars: Identities, Devices (Endpoints), Applications, Data, Infrastructure, and Network.

Each pillar has specific technical controls:

While SC-900 does not require deep command-line knowledge, understanding how policies are applied is important. Example: Conditional Access policy creation via PowerShell:

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
$params = @{
    displayName = "Block legacy authentication"
    state = "enabled"
    conditions = @{
        clientAppTypes = @("exchangeActiveSync", "other")
        applications = @{
            includeApplications = @("All")
        }
        users = @{
            includeUsers = @("All")
        }
    }
    grantControls = @{
        builtInControls = @("block")
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

To verify, use:

Get-MgIdentityConditionalAccessPolicy | Select-Object displayName, state, conditions

Zero Trust is not a single product but a strategy that integrates with Microsoft's security stack:

For example, when a user attempts to access a sensitive SharePoint site, the following happens: 1. Azure AD authenticates the user and checks Conditional Access policies. 2. Policy requires a compliant device and MFA. 3. Intune reports device compliance (checked within last 24 hours). 4. MCAS evaluates the session risk (e.g., unusual download volume). 5. If all pass, access is granted with a session cookie valid for 8 hours (default). 6. All events are logged to Azure AD sign-in logs and Sentinel.

A global company with 10,000 employees uses Microsoft 365 and Salesforce. They implement Zero Trust with Azure AD Conditional Access. Policy: All external access (non-corporate IP) requires MFA and a compliant device. Intune compliance policy requires Windows 10 21H2+, BitLocker, Defender AV active. Non-compliant devices are blocked from accessing email and SharePoint. Result: A contractor using an unmanaged MacBook cannot access corporate email from home; they must use a managed device or request temporary access via a JIT policy. Common misconfiguration: Setting sign-in frequency too low (e.g., 1 hour) causes user frustration; recommended default is 24 hours for low-risk apps. Performance consideration: Token issuance adds ~500ms latency; use persistent browser sessions for productivity apps.

A financial services firm hosts a three-tier application (web, app, database) in Azure VMs. They implement micro-segmentation using NSGs and ASGs. The web tier (ASG: Web) can communicate only with the app tier (ASG: App) on port 443. The app tier can communicate with the database tier (ASG: DB) on port 1433. No direct inbound access to app or DB tiers from the internet. Azure Firewall logs all traffic. Problem: A misconfigured NSG rule accidentally opened port 3389 (RDP) to the internet on the database VM. An attacker scanned and brute-forced credentials. Zero Trust would have required JIT access for RDP (Azure AD PIM) and MFA. The fix: Remove the offending rule and enable JIT VM access with approval workflow.

A law firm uses Microsoft Information Protection to classify documents. Zero Trust principle: Assume breach – data must be protected even if exfiltrated. Sensitivity labels (e.g., "Highly Confidential") are automatically applied based on content (e.g., contains passport numbers). Labels enforce encryption and restrict access to specific users. When a user tries to share a labeled document externally, DLP policy blocks the share and alerts the security team. Common issue: Users override labels manually, causing inconsistent protection. Solution: Use auto-labeling and mandatory labeling policies. Scale: Over 500,000 documents labeled daily with no performance impact.