Zero Trust in Microsoft 365: What It Actually Looks Like in Production

A real Microsoft 365 Zero Trust project usually starts with an audit. MFA is enabled for most users, but not every administrator. Conditional Access exists, but it has overlapping policies created by different teams. Exclusions cover executives, scanners, finance users, service accounts, guest users, named locations, or entire countries because something broke during rollout.

Attackers use those gaps. A common path is simple: phish a user, steal or replay a session token, find access from an unmanaged device, consent to or abuse an OAuth app, create mailbox forwarding or inbox rules, search SharePoint and Teams for finance or client data, then exfiltrate quietly. If Basic authentication or other legacy protocols remain available, password spray and credential stuffing become easier.

A production Zero Trust configuration assumes the password may be known, the user may click, the device may be unhealthy, and the attacker will move from identity to data. Each step should require a stronger signal: verified identity, managed device, least privilege, controlled session, monitored activity, and protected data.

Identity is where most tenants become defensible or stay performative. Start with a clean Conditional Access model, not dozens of policies with unclear ownership.

A practical baseline:

• Block legacy authentication. Use Conditional Access where applicable, Exchange Online authentication policies, and service-level settings such as SMTP AUTH controls. Do not keep IMAP, POP, Basic authentication, or legacy Office clients alive without a documented exception owner, migration plan, and expiration date.
• Require phishing-resistant MFA for privileged roles. Use FIDO2 security keys, Windows Hello for Business, or certificate-based authentication where supported and properly configured. Do not rely on SMS or push-only MFA for administrators.
• Require MFA for all users. If Microsoft Entra ID P2 is licensed, use sign-in risk and user risk policies so medium or high risk triggers stronger authentication, password reset, or block decisions instead of only producing alerts.
• Require compliant or Microsoft Entra hybrid joined devices for administrative access, including the Microsoft Entra admin center, Microsoft 365 admin center, Exchange admin center, SharePoint admin center, Microsoft Defender portal, Microsoft Purview portal, and Azure management.
• Disable user consent to applications by default. Use admin consent workflow and review requested permissions, publisher verification, app owner, and business justification before approval.

Emergency access accounts need explicit handling. Maintain two cloud-only break-glass accounts, exclude them from Conditional Access, assign only the roles required for recovery, and store long random passwords in an offline or privileged vault. Do not use them for daily administration. Alert on every sign-in and test them on a schedule. One account can remain password-only for true MFA or Conditional Access outage recovery; the other can use phishing-resistant authentication if it does not depend on the same controls you might need to bypass.

The Conditional Access grant control “require device to be marked as compliant” only helps if compliance policies are strict enough to matter.

For Windows endpoints, require Intune enrollment or Microsoft Entra hybrid join, BitLocker, Secure Boot where supported, Microsoft Defender Antivirus, current supported operating system versions, and update rings for quality and security updates. Use Microsoft Defender for Endpoint device risk in access decisions where licensing and deployment support it.

For macOS, decide whether Macs are managed or only tolerated. At minimum, enforce FileVault, supported OS versions, password requirements, endpoint protection, inventory, and compliance reporting.

For iOS and Android, full device enrollment is not always the right model. For personally owned devices, Microsoft Intune app protection policies can protect Outlook, Teams, OneDrive, Edge, and Microsoft 365 apps without enrolling the device. Require PIN or biometrics, encrypt app data, restrict copy and paste to unmanaged apps, block saving to personal locations, and wipe corporate app data when the user leaves.

Roll out device enforcement in stages. Start with administrator access. Then enforce it for high-impact apps such as Exchange Online, SharePoint Online, OneDrive for Business, and Teams. For unmanaged devices, use lower-trust access: web-only access, download restrictions, limited session lifetime, and no sync where supported. Contractors, shared devices, kiosks, and executive exceptions should be documented, scoped, and time-bound.

Assume a user will eventually approve something, open something, or lose a session token. Data controls limit the damage.

In Exchange Online, disable automatic external forwarding by default and allow it only by exception. Monitor inbox rules that forward, delete, hide, or move messages to unusual folders. Use Exchange Online Protection for baseline anti-spam, anti-malware, and anti-phishing. If Microsoft Defender for Office 365 is licensed, enable Safe Links, Safe Attachments, and impersonation protection for executives, finance, HR, IT, and other high-risk groups.

In SharePoint Online and OneDrive for Business, anonymous sharing links should not be the default. Scope external sharing by site sensitivity. Finance, legal, board, M&A, HR, source code, and client-data sites should have tighter sharing settings, limited external domains where appropriate, sensitivity labels where the organization can maintain them, and owner review.

Microsoft Purview Data Loss Prevention should start narrow. Use high-confidence policies for financial data, identity documents, health data, source code, and regulated client content. Broad DLP policies that generate thousands of false positives get bypassed or disabled. Production DLP blocks or warns on specific risky actions, alerts the right owner, and is tuned regularly.

Most tenants have too many standing administrators. Use Microsoft Entra Privileged Identity Management, which requires Microsoft Entra ID P2 or suites that include it, for eligible access instead of permanent role assignment. Keep Global Administrator rare. Separate Exchange Administrator, SharePoint Administrator, Teams Administrator, Security Administrator, Compliance Administrator, and User Administrator by job function.

A workable model is direct: standard accounts for daily work, separate administrator accounts for privileged work, just-in-time activation with justification, MFA, approval for high-impact roles, and short activation windows. Do not allow privileged activation from unmanaged devices. Require phishing-resistant MFA for the roles that can change identity, mail flow, security, compliance, or tenant-wide settings.

Apply the same discipline to applications. Review enterprise applications and app registrations for permissions, owners, sign-in activity, credential age, publisher verification, and consent history. Any app with permissions such as Mail.ReadWrite, Files.ReadWrite.All, Sites.ReadWrite.All, Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory, or offline_access needs a clear owner and business purpose. Remove stale apps and expired integrations.

Guest access needs ownership. Use access reviews where licensed, expiration where possible, and restrictions on guest enumeration and sharing. The risk is not one guest account. The risk is years of accumulated guests with no sponsor, no review, and access to Teams or sites that still contain sensitive work.

A production Microsoft 365 Zero Trust tenant is easier to explain and harder to abuse. Conditional Access policies are fewer and named by purpose. Exceptions have owners and expiration dates. Legacy authentication is blocked. Administrator access requires phishing-resistant MFA and managed devices. Unmanaged devices receive restricted sessions, not full trust. External sharing is intentional. High-impact data locations are protected before the organization tries to classify everything.

Licensing matters, but it should follow control maturity. Microsoft 365 Business Premium gives many small and midsize organizations a strong base: Microsoft Entra ID P1, Intune, Defender for Business, Defender for Office 365 Plan 1, and core Purview capabilities. Microsoft 365 E3 includes strong management and identity foundations but may need add-ons for Entra ID P2, advanced email protection, advanced endpoint protection, identity risk, Privileged Identity Management, access reviews, or broader compliance features. Microsoft 365 E5 and security/compliance add-ons can be valuable, but buying advanced tooling before enforcing baseline controls usually creates shelfware.

Measure the rollout. Track MFA coverage, legacy authentication attempts, Conditional Access exclusions, unmanaged device access, privileged role activations, stale privileged accounts, risky sign-ins, external forwarding attempts, anonymous sharing links, high-impact sharing events, and DLP policy outcomes. If those numbers are not improving, the Zero Trust program is not changing the tenant.