For years, network security worked like a castle with a moat. Everything outside the firewall was treated as dangerous, and everything inside was trusted. That model made sense when staff sat in one office on one network. It falls apart the moment people work from home, use their phones, and store data in cloud services like Microsoft 365. Zero trust security is the modern answer to that shift.
Zero trust security is a model that never automatically trusts a user or device, even one inside your own network. Every request to access data or applications is verified using identity, device health and context, and only the minimum access needed is granted. The guiding phrase is "never trust, always verify".
What does zero trust actually mean?
Zero trust is not a single product you buy. It is an approach to designing security so that trust is never granted by default and never permanent. Instead of asking "is this request coming from inside the network?", zero trust asks "can we prove this specific user, on this specific device, should have access to this specific thing right now?"
Every access attempt is evaluated fresh. A stolen password on its own should not get an attacker into your systems, because the model also checks the device, the location, the sensitivity of the data and other signals before deciding.
The three principles of zero trust
Microsoft, whose guidance underpins many Australian implementations, describes zero trust as resting on three principles. Understanding these makes the rest of the model straightforward.
- 1. Verify explicitly
- Always authenticate and authorise based on all available data points — user identity, location, device health, the service being requested and how unusual the request looks. This is where multi-factor authentication and device compliance checks live.
- 2. Use least-privilege access
- Give people only the access they need to do their job, and only for as long as they need it. Just-in-time and just-enough access limit how far an attacker can move if an account is compromised.
- 3. Assume breach
- Design as though an attacker is already inside. Segment access, encrypt data, and continuously monitor and log activity so that a single compromised account or device is contained rather than catastrophic.
Why the old "trusted network" model no longer works
Three changes broke the moat-and-castle approach for good:
- Remote and hybrid work. Staff connect from home networks, cafes and mobile devices that your business does not control.
- Cloud applications. Your data now lives in Microsoft 365, not just on a server in the office, so the "perimeter" is everywhere.
- Credential theft. Most successful attacks start with a stolen or phished password. Once inside a flat, trusting network, an attacker can move freely.
Zero trust addresses all three by moving the security decision away from the network and onto identity, device and context.
How to start with zero trust
You do not roll out zero trust in one weekend, and you rarely need to replace everything you already own. It is a journey, delivered in sensible stages. For most small and medium businesses, the order looks like this:
- Secure identities first. Turn on multi-factor authentication for every account, and centralise sign-in through a single identity provider such as Microsoft Entra ID.
- Add Conditional Access. Define rules — for example, block sign-ins from risky locations, or require a compliant, managed device to reach sensitive data.
- Bring devices under management. Use a tool like Microsoft Intune to enforce encryption, patching and screen locks, so device health becomes a signal you can trust.
- Apply least privilege. Review who has administrator rights and remove the ones that are not needed. Use just-in-time elevation for admin tasks.
- Monitor and respond. Turn on logging and alerting so unusual activity is caught early, and have a plan for what happens when it is.
Mapping zero trust to Microsoft Entra and Defender
If your business runs Microsoft 365, you already have many of the building blocks for zero trust. The two most relevant are the Entra identity platform and the Defender security suite.
| Zero trust principle | Microsoft capability | What it does |
|---|---|---|
| Verify explicitly | Microsoft Entra ID (MFA + Conditional Access) | Enforces MFA and evaluates user, device and risk signals before granting access. |
| Least privilege | Entra role-based access & Privileged Identity Management | Grants just-enough, just-in-time admin rights instead of standing privileges. |
| Assume breach | Microsoft Defender (endpoint, identity, cloud apps) | Detects, investigates and contains threats across devices, identities and email. |
| Device trust | Microsoft Intune | Enforces device compliance so only healthy, managed devices reach your data. |
Because these tools are integrated, a Conditional Access rule in Entra can require that a device be marked compliant by Intune and free of active threats before it is allowed to open a file in Microsoft 365. That is zero trust working in practice, and it is achievable on the licences many businesses already hold. Microsoft publishes a full zero trust guidance library on Microsoft Learn.
Zero trust and the Essential Eight
Australian businesses are often asked about the ACSC Essential Eight. Zero trust and the Essential Eight are complementary, not competing. Several Essential Eight strategies — enforcing MFA, restricting administrative privileges and application control — are direct expressions of zero trust principles. Adopting a zero trust mindset makes those controls easier to deliver and, more importantly, easier to sustain. The ACSC Essential Eight guidance is a good companion reference.
The honest takeaway
Zero trust is less a technology and more a discipline: verify every request, grant the least access necessary, and assume something will eventually go wrong. For a busy business, the hard part is not understanding the idea — it is configuring the controls correctly and keeping them consistent as staff, devices and threats change. That ongoing work is exactly what a managed cyber security partner handles for you.
Related services
Explore our cyber security services and Microsoft 365 management, or book a free IT assessment to see where your identity and device security stand today. You can also contact our Sydney team for tailored advice.
Frequently asked questions
Zero trust is a security model that never assumes a user or device is safe just because it is inside your network. Every access request is verified using identity, device health and context before access is granted, and only the minimum access needed is allowed.
The three core principles are: verify explicitly (authenticate and authorise using all available signals), use least-privilege access (limit rights with just-in-time and just-enough access), and assume breach (segment, encrypt and monitor as if an attacker is already inside).
No. MFA is an important building block of zero trust because it strengthens the verify-explicitly principle, but zero trust also covers device compliance, least-privilege access, network segmentation, data protection and continuous monitoring.
Yes. Small and medium businesses can adopt zero trust incrementally using tools they may already own, such as Microsoft Entra ID Conditional Access and Microsoft Defender. You do not need to replace everything at once — start with identity and MFA, then uplift devices and access over time.
They complement each other. The Essential Eight is a set of practical mitigation strategies, several of which — MFA, restricting administrative privileges and application control — directly support zero trust principles. Adopting zero trust helps you deliver and sustain those controls.