Microsoft Security, Compliance, and Identity Fundamentals Training Course

Zero Trust is the security model that most shapes the Microsoft products you will study in the rest of this course, and it appears on SC-900 more often than any other methodology. It is worth understanding as an argument rather than a slogan, because the exam tests whether you can recognize its principles in a described scenario.

The model it replaces

The traditional approach is sometimes called the castle-and-moat model. An organization draws a network boundary, hardens it with firewalls and a VPN, and treats everything inside as trusted. Authentication happens at the door. Once inside, a user or device moves relatively freely, because being on the corporate network is itself taken as evidence of legitimacy.

Three changes broke that assumption. Employees stopped working exclusively from corporate offices. Applications stopped living exclusively in corporate datacenters — a SaaS application has no relationship with your network at all. And attackers demonstrated repeatedly that the interior is the easiest place to operate: one phished credential or one compromised laptop puts an adversary inside the trusted zone, where lateral movement is unobstructed.

Zero Trust responds by removing the idea of a trusted interior. Location on a network confers no privilege. Every request is treated as though it originated on an open network, regardless of where it actually came from.

Three guiding principles

Microsoft states Zero Trust as three principles. Learn them verbatim; exam items quote them closely.

Verify explicitly. Always authenticate and authorize based on all available data points — user identity, location, device health, service or workload, data classification, and observed anomalies. The key word is all: a decision made on a password alone ignores most of the available evidence. This principle is the direct rationale for Conditional Access, which you will meet in Module 2.

Use least privilege access. Limit access with just-in-time and just-enough-access, risk-based adaptive policies, and data protection. A standing global administrator account violates this principle; an eligible role assignment that must be activated for a bounded period satisfies it. Privileged Identity Management, entitlement management, and access reviews are all implementations of this principle.

Assume breach. Design as though an attacker is already inside. Segment access to minimize blast radius, verify end-to-end encryption, and use analytics to gain visibility, drive threat detection, and improve defenses. Network segmentation, Microsoft Sentinel, and Defender XDR exist because of this principle.

The six pillars

Zero Trust is implemented across six foundational areas, each with its own controls and signals:

• Identities. People, services, and devices that request access. Identities must be verified with strong authentication and granted only the access they need.
• Devices (endpoints). Every device that connects creates attack surface. Device health and compliance become inputs to the access decision.
• Applications. Both sanctioned and unsanctioned applications need discovery, permission governance, and monitored configuration. Shadow IT is an application-pillar problem.
• Data. Data should be classified, labeled, and encrypted based on its attributes, so protection travels with the file rather than depending on where it is stored.
• Infrastructure. Servers, virtual machines, containers, and micro-services, whether on-premises or cloud-hosted, need hardening, version control, and just-in-time administrative access.
• Networks. Deep segmentation, in-network micro-segmentation, real-time threat detection, and end-to-end encryption. The network still matters under Zero Trust; it simply stops being a trust boundary.

How a Zero Trust access decision works

In practice, the model turns a binary gate into a continuous evaluation. A request arrives carrying signals: which identity, from which device, in which location, to which application, at what apparent risk level. A policy engine evaluates those signals against organizational rules and returns a decision that is not simply allow or deny — it can be allow with additional verification, allow with limited session capability, allow read-only, or block.

That is exactly the shape of Microsoft Entra Conditional Access, and it is why Zero Trust and Conditional Access are so often paired in exam questions. The related products supply the signals: Microsoft Entra ID Protection contributes user and sign-in risk, Intune contributes device compliance, Defender for Cloud Apps contributes session control, and Microsoft Purview contributes data sensitivity.

Recognizing it on the exam

Scenario items usually describe a practice and ask which principle it demonstrates. Some reliable mappings: requiring multifactor authentication for a sign-in from an unfamiliar location is verify explicitly; granting a database administrator role for a two-hour window instead of permanently is use least privilege; segmenting a network so a compromised web server cannot reach the finance subnet is assume breach.

Adoption is also incremental, and the exam reflects that. No organization switches to Zero Trust in a single project; it strengthens one pillar at a time, usually starting with identity because that is where the highest-value improvements are cheapest. Enforcing multifactor authentication, removing standing privilege, and requiring compliant devices deliver most of the practical benefit before a single network change is made.

Watch for the common distractor that describes Zero Trust as "trust nothing" or as the elimination of trust. The model does not remove trust; it replaces implicit, location-derived trust with explicit, evidence-based, continuously re-evaluated trust. An organization adopting Zero Trust still grants access — it simply insists on being shown why, every time.