Picture of Jamie Wheeldon
Jamie Wheeldon

In today’s cloud-first, hybrid-work world, traditional perimeter security isn’t enough. Enter Zero Trust – a modern cybersecurity approach that treats every access attempt as if it comes from an untrusted network.

Table of Contents

Introduction

Instead of assuming users or devices are “safe” once inside your network, Zero Trust continuously verifies them and limits access to minimise damage. Microsoft has distilled Zero Trust into three core principles: 

Verify Explicitly

Never trust by default – always authenticate and authorise every access based on all available context (user, device, location,etc)

Least Privilege

Give only the access needed, and no more. Use just-in-time elevation and fine -grained policies so users and devices operate with minimal rights

Assume Breach

Prepare as if attackers are inside. Segment networks and use encryption to contain threats, and continually monitor to detect and respond to incidents fast.

In this blog post, we’ll briefly explain each principle and show how you can implement them using Microsoft’s security stack – Microsoft Entra ID, Microsoft Defender XDR, Microsoft Security Copilot, and Microsoft Sentinel. By adopting this strategy, organisations strengthen their security posture and reduce risk – in fact, a Forrester study found that Microsoft’s Zero Trust solutions cut the likelihood of a data breach by 50% while delivering a 92% return on investment.

Principle 1: Verify Explicitly – Always Authenticate and Authorise

The first Zero Trust principle, “verify explicitly,” means never granting access without verifying who is requesting it and under what conditions. Every time a user or device tries to access a resource, you explicitly check their identity, location, device health, data sensitivity, and other factors. In practice, this eliminates implicit trust (e.g. just because someone is on the corporate network) and instead validates every access attempt. As Microsoft puts it, regardless of where a request originates, “never trust, always verify”.

Use Entra ID to enforce strong authentication like Multi-Factor Authentication (MFA) for every user. MFA ensures that even if a password is stolen, the attacker can’t get in without a second layer of identity verification (like an authenticator app or fingerprint).

Entra ID also enables Conditional Access policies, which automatically evaluate the context of sign-in attempts. For example, you can require MFA (or block access) if a user logs in from a new location or an unmanaged device. You can even tie access to device compliance – only allow devices that meet your security standards (managed by Intune) to access certain apps.

These policies make sure that each session is explicitly verified against your risk criteria before granting access.

Entra ID Identity Protection uses machine learning to detect risky sign-ins (impossible travel, malware-linked IPs, etc.) and label user accounts with risk levels. Conditional Access can then respond to high-risk logins by forcing a password reset or blocking the session. In short, if something seems suspicious about a login, the system doesn’t trust it – it challenges the user or stops them.

This continuously verifies that the person accessing your data is indeed who they claim to be and not an attacker.

Even once a user is logged in, Defender XDR (which spans tools like Defender for Endpoint, Defender for Office 365, and Defender for Identity) keeps an eye out for anything abnormal.

For example, if a user’s account suddenly tries to access a database it never has before, or a device starts running unusual processes, Defender will trigger alerts. This acts as a form of continuous verification – ensuring that just because the initial login was allowed, it doesn’t mean all subsequent actions are automatically trusted.

In fact, Defender for Identity (part of XDR) watches for suspicious behaviour on your on-premises Active Directory, like credential theft techniques or lateral movement, and will flag or stop those actions.

Sentinel is Microsoft’s cloud-native SIEM/SOAR, which means it collects logs and telemetry from Entra ID, Defender XDR, and many other sources. Sentinel uses analytics and AI to detect anomalies that might indicate a threat slipping through.

If Sentinel detects something like an account logging into sensitive data at an odd hour plus that device showing malware alerts, it can automatically kick off a response (for example, disable the account or isolate the device). This kind of cross-correlation ensures that no alert or anomalous event goes unchecked.

Every unusual access gets investigated – another form of “verify explicitly,” achieved by comprehensive monitoring.

For instance, if an administrator wants to verify “Have there been any unusual sign-in patterns this week?”, they can ask Security Copilot in natural language. Copilot, which leverages OpenAI GPT-4 with Microsoft’s 65 trillion daily security signals , can quickly highlight any anomalies or risky activities.

It’s like having an AI security analyst on hand to always double-check and verify what’s happening in your environment. This speeds up the discovery of potentially unverified access that needs attention.

Principle 2: Least Privilege – Minimise Access to Limit Damage

The second principle of Zero Trust, “use least privilege access,” means users (and applications) should have the minimum level of access necessary, for the shortest duration necessary. The idea is to dramatically reduce potential damage if an account is compromised. If a user only has access to a subset of resources, an attacker who takes over that account hits a dead end when trying to reach anything beyond that subset. Limiting privileges is one of the most effective ways to contain breaches.

How to implement least privilege with Microsoft tools:

Leverage Role-Based Access Control (RBAC)  in Microsoft Entra ID to ensure users only have roles that fit their job needs – nothing more. 

Start by reviewing user roles and access rights in Entra ID (and the broader Microsoft 365/Azure environment). For example, an HR manager might have access to the HR system but not the financial system; an IT support engineer might have rights to reset passwords but not to modify finance databases. Microsoft provides many built-in roles, and you can create custom ones as needed to fine-tune permissions.

Microsoft Entra ID Privileged Identity Management (PIM) is a feature that allows you to make administrative roles eligible rather than always active. A global administrator can have zero privileges most of the time, elevating to admin on-demand for a limited time after additional verification (and approval if required).

This means even if that admin’s account is compromised, the attacker can’t do anything unless they manage to perform the impossible – activate the role with MFA and possibly a manager’s approval. PIM also provides audit logs and alerts, so every use of a privileged role is tracked. This approach embraces least privilege by ensuring high-impact permissions are only granted when absolutely needed, and removed as soon as the task is done.

Defender XDR contributes to least privilege by helping organisations manage endpoint privileges.

A common weakness is giving users local administrator rights on their laptops or desktops. With tools like Microsoft Defender for Endpoint, you can identify which devices have users with excessive privileges.

Microsoft has introduced an Endpoint Privilege Management capability (currently in preview for Defender for Endpoint) that allows standard users to perform approved admin tasks or run specific applications with elevated rights, without giving them full admin rights all the time.

By using such tools, you can remove daily admin rights from users (reducing risk of malware or misuse) while still allowing work to get done through controlled elevation. This ensures each endpoint operates under least privilege rules.

Microsoft Defender for Cloud Apps (part of the Defender XDR suite) lets you enforce granular policies within cloud applications. For example, you can allow a user to view data in an app but not download it, if they’re coming from an untrusted device. This is an important capability, because it exemplifies least privilege at the data layer – users only take the actions they need to in apps, nothing more.

Microsoft Sentinel helps monitor and enforce least privilege by providing visibility into privilege usage. Sentinel can alert on scenarios like “an account added to a high-privilege group” or “multiple failed attempts to use an admin account”. These alerts can catch improper privilege escalations or potentially malicious use of privileges. Additionally, Sentinel’s User and Entity Behavior Analytics (UEBA) can baseline normal behavior and flag unusual activity – a common indication that account might have been hijacked.

Security Copilot can assist in reviewing and maintaining least privilege. Security administrators can ask Copilot questions like “Which user accounts have administrative privileges that haven’t been used in 60 days?” Copilot will sift through Azure AD and other data to find accounts that perhaps should be downgraded.

In essence, implementing least privilege with Microsoft’s stack means tight control over who can access what.

  • Use Entra ID to define and enforce access rights (with tools like PIM for admin roles),
  • Use Defender to extend those controls to devices and apps, and
  • Use Sentinel (and Copilot) to continuously watch over privileges.

This way, if an account is compromised, the attacker hits a wall – unable to access sensitive systems or pivot widely. Limiting access upfront greatly reduces the “blast radius” of any breach.

Principle 3: Assume Breach – Continuous Monitoring and Rapid Response

The final principle, “assume breach,” is about preparing for the worst. Rather than thinking “we have strong walls, so a breach won’t happen,” Zero Trust takes the stance “an attacker might already be in – how do we limit their impact and find them quickly?”. This mindset leads to strategies like network segmentation, encryption of data, and aggressive monitoring to spot attackers. If you assume breach, you architect your environment so that an infiltrator can’t easily roam free, and you invest in detection and response capabilities to catch them as soon as possible.

How to implement assume breach with Microsoft tools:

Defender XDR uses advanced threat intelligence and behavioural analytics to detect threats on endpoints, identities, email, cloud apps, and more in real time.

  • If malware or an exploit is executed on a device, Defender for Endpoint will likely catch it or at least raise an alert.
  • If an attacker tries to dump credentials from Active Directory, Defender for Identity will notice that suspicious action.
  • If a user falls for a phishing email, Defender for Office 365 can flag the malicious link or attachment.

These tools generate alerts that indicate a possible breach. Importantly, Microsoft has been building automatic response actions into Defender- for example, if ransomware behavior is detected on a PC, Defender for Endpoint can automatically isolate that machine from the network to stop the spread.

Assuming breach means these automated containment actions are crucial – you limit damage immediately when a threat is found.

Sentinel’s analytics can correlate multiple low-level alerts into a higher-confidence incident. For example, a single failed login might not be notable, but dozens of failed logins across different accounts, followed by a suspicious PowerShell execution on a server, when seen together, scream “breach attempt in progress.” Sentinel will combine those signals and raise an Incident for you to investigate. 

With built-in hunting queries and AI, Sentinel also helps you proactively search for threats that might not have triggered an alert. You might hunt for unusual network connections or odd patterns in authentication logs. 

This proactive mindset is exactly what assume breach is about: actively look for trouble, don’t just wait for an alarm.

Moreover, Sentinel’s automation (SOAR) capabilities let you respond quickly. 

You can create playbooks that, for instance, disable a compromised user account, notify admins, and block an IP address – all automatically when Sentinel marks an incident as high severity. 

This speed is essential; if an attacker is on your network, every minute counts. Automated responses can kick them out or contain them within seconds. Your team can then follow up to clean up the mess with the help of Copilot

Assisting in the assume breach scenario, Security Copilot acts as a force multiplier for your security analysts. 

Imagine you get an incident in Sentinel that looks like a breach – dozens of machines infected or a suspicious data exfiltration. An analyst can ask Copilot,

  • What has this attacker done so far and what should I do next?

Copilot will analyse all the data from Sentinel and Defender related to the incident and produce a narrative:  

  • It appears that the attacker compromised user JohnDoe via phishing, then moved laterally to Server1 using stolen credentials, and deployed malware X. Recommended actions: isolate Server1 (already done), reset JohnDoe’s account, check 5 other machines that communicated with Server1.

This kind of insight in minutes can save hours of combing through logs. It embodies the assume breach attitude: respond as if you’re under attack (because you likely are), and use every tool to understand and contain the situation rapidly. Copilot can also help perform post-breach analysis or even simulate attacks, helping you improve defenses for next time.

By assuming breach, you essentially run your IT environment in a state of constant vigilance. Microsoft’s tools interconnect to support this: Defender XDR spots the suspicious activity, Sentinel sounds the alarm and orchestrates containment, and Copilot helps make sense of it all. The result is a dramatically reduced dwell time for attackers – instead of lurking for days or months, they might be detected and evicted within hours or minutes. This minimizes damage and gives you the upper hand.

Real-world example:

Global brewer HEINEKEN embraced Zero Trust by using Microsoft Entra ID with Conditional Access and Identity Protection to always verify user identities before granting access. Their policies restrict or challenge access based on the sensitivity of data and the user’s location (for example, sign-ins from outside the office get extra scrutiny). At the same time, HEINEKEN deployed Microsoft Defender for Identity to continually monitor for threats against their identities. They also moved to a cloud-first SIEM with Microsoft Sentinel to gain full visibility. This comprehensive “verify explicitly” approach gave HEINEKEN’s security team confidence that every access request – no matter where it came from – is vetted and that any irregular activities would be caught in real time. According to HEINEKEN’s security managers, using the latest Microsoft security tech to enable Zero Trust provided “a safe way for our business to innovate” in a highly connected environment.

Benefits and Conclusion

Adopting a Zero Trust security model with the Microsoft stack yields significant benefits. 

  • You achieve stronger security posture – by removing implicit trust and verifying everything, the attack surface shrinks, and threats are caught sooner.
  • Implementing Zero Trust has been shown to reduce the likelihood of breaches by half and greatly improve the efficiency of security operations.
  • Organisations also gain greater visibility into their IT environment. Every access request is logged, every anomaly is flagged – you have a full audit trail which not only improves security but also helps with compliance requirements.
  • Additionally, Zero Trust architecture is well-suited for modern workplaces: it enables secure remote work and cloud adoption without the need for a traditional VPN-based perimeter. Employees can work from anywhere and still trigger the same verification checks as if they were in the office, maintaining security without sacrificing productivity.

Reduced Breach Risk

50%↓

Organisations using Microsoft’s Zero Trust approach saw a 50% lower change of a data breach.

Return on Investment

92% ROI

Three-year ROI of Microsoft Zero Trust solutions was 92%, with payback in < 6 months.

It’s important to note that Zero Trust is not a single product you turn on, but a strategic approach. Implementing it is a journey – you can start with quick wins like MFA and basic conditional access, then progressively tighten policies, segment networks, and deploy advanced tools like Sentinel and Security Copilot. Change management and user education are also key, so everyone understands why these extra prompts or restrictions are ultimately protecting the organisation’s data and their own accounts.

 

Getting Started - We Can Help

Building a robust Zero Trust environment may seem daunting, but you don’t have to do it alone. PROJECT 183 is a Microsoft Solutions Partner with deep expertise in Entra ID, Microsoft Defender, Sentinel, and the entire Microsoft Security suite. We’ve helped companies devise and implement Zero Trust strategies tailored to their needs. Whether you’re looking to strengthen identity security, deploy an XDR/SIEM solution, or just assess where to begin, our team can provide guidance every step of the way.

Book a Meeting
Contact Us