Topic 3 of 6
The Zero Trust model
Zero Trust is a strategy, not a product. It starts from a simple idea: no network, user, device, or application is trusted by default, even if it has already signed in or sits on a "trusted" network. Every request is verified.
Contents
What is Zero Trust?
A security strategy based on "trust no one, verify everything". Instead of assuming everything inside the corporate network is safe, it requires every access request to be authenticated and authorized, wherever it comes from.
The traditional model worked when employees worked from a fixed office and data lived on local servers. Today people work from anywhere, on personal and corporate devices, from home or public networks, and data moves between datacenters, cloud platforms, and third-party apps. In that environment, the network perimeter is no longer a reliable boundary.
Attackers bypass the perimeter with phishing, credential theft, and application vulnerabilities. Once inside, if everything internal is considered trusted, they move freely. Zero Trust answers that reality: no network, device, user, or application is trusted by default, not even those that have already authenticated.
Castle-and-moat vs. Zero Trust
| Castle-and-moat | Zero Trust | |
|---|---|---|
| Trust | Everything inside the network is trusted | Nothing is trusted by default |
| Main control | The network perimeter | Identity and each request's signals |
| Access | Broad and permanent once inside | Explicit, conditional, temporary, and scoped |
| If the attacker gets in | They move freely | Segmentation and monitoring limit the damage |
| Where it applies | The corporate network | On-premises, cloud, SaaS, and AI workloads alike |
The 3 principles
They guide how users authenticate, how devices are trusted, how applications are authorized, and how data is protected.
✅ Verify explicitly
Always authenticate and authorize with all available signals, not a single factor like a password or network location.
- The user's identity
- Sign-in location
- The device and its compliance status
- The service or application being accessed
- Data classification
- Anomalies, like unusual times or places
→ In Microsoft: Conditional Access + MFA
🔑 Use least privileged access
Give users and systems only the minimum access, and only for as long as they need it.
- Just-in-time (JIT): access when needed, revoked afterward
- Just-enough-access (JEA): only the task's permissions, not broad permissions "just in case"
- Adaptive policies that limit access when risky activity is detected
→ In Microsoft: Privileged Identity Management, custom roles
💥 Assume breach
Design as if the attacker will get past your defenses sooner or later.
- Segment access so a compromised account or device can't reach everything
- Encrypt end to end so intercepted data is unreadable
- Monitoring and analytics to detect quickly, know what was accessed, and limit damage
→ In Microsoft: Network segmentation, Defender XDR, Microsoft Sentinel
The 7 pillars
Six pillars are at once signal sources, control points, and resources to protect. The seventh brings all those signals together to respond.
🪪 Identities
Users, services, or devices. They're verified with strong authentication before access is granted and then get only the access the task needs. This is the primary control plane: almost every successful attack ends up compromising or abusing an identity.
💻 Devices
They create a large attack surface as data flows between devices, on-premises workloads, and the cloud. Their health and compliance are monitored, and a device that doesn't comply or shows signs of compromise is blocked or given restricted access.
📱 Applications
They're how data is consumed. You need visibility into all of them, including unsanctioned ones (shadow IT), and control over the permissions apps request from platforms and the ones users grant them.
💾 Data
Classified, labeled, and encrypted based on its attributes and sensitivity. Every other pillar exists to protect it, and data must carry its own protection so it stays secure outside the environments the organization controls.
🏗️ Infrastructure
On-premises or in the cloud, it's a large attack surface. It's continuously assessed for version, configuration compliance, and unusual behavior. Just-in-time access to admin interfaces shrinks the exposure window, and telemetry lets you detect and respond automatically.
🌐 Networks
Segmented so compromising one part doesn't give free access to the rest, with micro-segmentation inside each zone, not just at the edge. Add real-time protection, end-to-end encryption, continuous monitoring, and analytics.
🛰️ Visibility, automation, and orchestration
The seventh pillar brings together the signals from the other six. Without it, the team gets a huge volume of separate alerts, threats are missed, and analyst fatigue sets in. This is where SIEM, which ingests and correlates signals to detect threats, and SOAR, which uses those detections to trigger automated response playbooks, come in.
Watch out for old material
Older guides talk about 6 pillars. The current official SC-900 module adds the seventh: visibility, automation, and orchestration.
Pillars and Microsoft solutions
The rest of the exam walks through products that fit these pillars. Keeping them associated helps place each service:
| Pillar | Solutions that cover it |
|---|---|
| Identities | Microsoft Entra ID, Conditional Access, PIM, ID Protection |
| Devices | Microsoft Intune, Defender for Endpoint |
| Applications | Defender for Cloud Apps (including shadow IT discovery) |
| Data | Microsoft Purview: classification, labels, DLP |
| Infrastructure | Defender for Cloud, PIM for just-in-time access |
| Networks | Azure Firewall, NSGs, Global Secure Access |
| Visibility and automation | Microsoft Sentinel (SIEM and SOAR), Defender XDR |
Zero Trust in practice
Example from the official material: a user signs in from an unfamiliar location, on an unmanaged personal device, and tries to open a sensitive financial application. Signals from every pillar are evaluated at once:
Identities: Validates the credentials and flags the unusual location as a risk signal.
Devices: Detects that the device isn't enrolled or compliant.
Applications: Applies the policy that requires a compliant device for sensitive apps.
Networks: Monitors the connection and logs the attempt.
Data: The financial information is already encrypted and access-controlled.
Infrastructure: Records the attempt in telemetry.
Visibility and automation: Instead of each pillar logging a separate low-severity event, it correlates everything into a high-risk detection: requires extra authentication, blocks access, and alerts the team, with no manual intervention.
That's Zero Trust in action: continuous verification across every pillar, automated response that limits damage, and central visibility to understand what happened and why.
Exam scenarios
| Situation | Principle or pillar | Why |
|---|---|---|
| MFA is required only when sign-in comes from an unusual country | Verify explicitly | Signals like location are evaluated in addition to the password. |
| An admin gets permissions for just 2 hours for a task | Least privilege (just-in-time) | Access only when needed and only for as long as needed. |
| A technician gets only the permission to restart VMs, not delete them | Least privilege (just-enough-access) | Only the specific permissions the task requires. |
| The network is segmented so a compromised machine can't reach the databases | Assume breach | It limits the reach of an attacker who's already in. |
| Identity, device, and network alerts are correlated into one incident | Visibility, automation, and orchestration pillar | It integrates signals from the other pillars (SIEM/SOAR). |
| Cloud apps employees use without approval are discovered | Applications pillar | It includes visibility into shadow IT. |
Common exam traps
❓ Is Zero Trust a product you buy?
No. It's a security strategy. Several Microsoft products help apply it, such as Conditional Access, PIM, or Sentinel, but none of them "is" Zero Trust.
❓ Granting admin access only during a maintenance window applies which principle?
Use least privileged access (just-in-time). Verify explicitly refers to evaluating signals on every request.
❓ Segmenting the network and encrypting end to end applies which principle?
Assume breach: it limits what an attacker can reach if they're already in.
❓ Is a user who already signed in from the corporate network trusted?
Not in Zero Trust. No identity or network is trusted by default, even after authenticating.
❓ How many pillars does Zero Trust have in the current material?
Seven. The seventh, visibility, automation, and orchestration, integrates the signals of the other six.
❓ Which pillar do SIEM and SOAR fit into?
Visibility, automation, and orchestration. SIEM detects by correlating signals; SOAR responds with playbooks.
❓ Is "defense in depth" one of the Zero Trust principles?
No. The principles are verify explicitly, least privilege, and assume breach. Defense in depth is a separate, complementary strategy.
Did you get this topic?
Test what you just learned
A policy requires MFA when a user signs in from an unusual country on an unmanaged device, even if the password is correct. Which Zero Trust principle applies?
Ready to test "Zero Trust: principles and pillars"?
Original questions, each with a full explanation.
Start a mock exam