The network perimeter stopped being a meaningful security boundary the moment your staff started working from home on personal broadband, opening company files on phones, and collaborating with external contractors in Teams. Zero Trust is the security model that replaces it — and for Australian businesses running Microsoft 365 and Azure, most of the components are already licensed.
This guide explains what Zero Trust actually means in practice, the five pillars as they apply to a Microsoft environment, how Entra ID Conditional Access delivers the policy engine, how Zero Trust aligns with the ACSC Essential Eight, and a step-by-step implementation sequence.
What is Zero Trust security architecture?
Zero Trust is a security model built on a single assumption: the network provides no trust. Every access request is treated as though it originated from an untrusted network, regardless of where it came from, and is evaluated on its own merits before access is granted.
Three principles define it.
Verify explicitly. Authenticate and authorise every request using all available signals — user identity, device health, location, application sensitivity, and behavioural risk. Not just "is this the right password".
Use least privilege access. Grant the minimum permission required, for the minimum time required. Just-in-time administrative elevation, scoped roles, and regular access reviews rather than permanent Global Administrator rights for six people.
Assume breach. Design as though an attacker is already inside. Segment access, encrypt data in transit and at rest, limit lateral movement, log everything, and monitor continuously.
The traditional model — a firewall at the edge, trusted internal network, VPN for remote users — fails against the attacks Australian businesses actually experience. A phished credential grants an attacker the same trusted access your staff have. Zero Trust asks a second question at every step: is this device compliant, is this location expected, is this behaviour normal, does this user need this data?
Zero Trust is an architecture, not a product. Nobody sells it in a box, and any vendor claiming otherwise is selling one component.
The five pillars of Zero Trust in a Microsoft 365 environment
1. Identity. Entra ID is the control plane. Every user, application and service authenticates through it. Controls include multi-factor authentication, Conditional Access, passwordless and phishing-resistant credentials, Privileged Identity Management for just-in-time role activation, identity protection for risk-based sign-in policies, and access reviews. If you only implement one pillar, implement this one — identity is where the overwhelming majority of incidents begin.
2. Devices. Microsoft Intune enrols and manages endpoints, and compliance policies define what "healthy" means: encrypted, patched within a defined window, running Defender with real-time protection, PIN or biometric protected, and not jailbroken. Non-compliant devices are denied access to corporate data through Conditional Access. This is the pillar that makes identity controls durable — a compliant device is a far stronger signal than a password.
3. Applications. Every application is brought under identity governance — SaaS applications integrated with Entra ID single sign-on, shadow IT discovered through Defender for Cloud Apps, application permissions reviewed, and legacy authentication protocols blocked outright.
4. Data. Microsoft Purview classifies and protects information. Sensitivity labels apply encryption and access restrictions that travel with the file, data loss prevention policies stop sensitive content leaving through email or Teams, and retention policies satisfy record-keeping obligations. Data protection is what remains effective after the other pillars fail.
5. Infrastructure and network. In Azure, this means network security groups, private endpoints, Azure Firewall, just-in-time VM access, Defender for Cloud recommendations, and removing public management ports. On-premises, it means segmentation and retiring flat networks.
Underneath all five sits visibility and analytics — sign-in logs, audit logs, Defender alerts and, where warranted, a SIEM. A Zero Trust architecture you cannot observe is an assumption, not a control.
How Entra ID Conditional Access implements Zero Trust
Conditional Access is the policy engine that turns Zero Trust principles into enforced decisions. Every sign-in is evaluated against signals and produces a decision: allow, allow with controls, or block.
Signals include the user or group, the application being accessed, the device platform and compliance state, the client application, the IP location, and the calculated sign-in and user risk levels.
Controls include requiring multi-factor authentication, requiring a compliant or hybrid-joined device, requiring an approved client application, requiring terms of use acceptance, forcing a password change, limiting session capabilities, or blocking access entirely.
A practical baseline policy set for an Australian business looks like this:
- Require MFA for all users, all cloud applications, excluding break-glass accounts.
- Block legacy authentication protocols for all users.
- Require phishing-resistant MFA for administrative roles.
- Require a compliant or hybrid-joined device for access to Exchange Online and SharePoint Online.
- Block or challenge sign-ins from countries where the business does not operate.
- Apply app-enforced session restrictions for unmanaged devices — browser-only access with no download.
- Require MFA and shorter sign-in frequency for high-risk sign-ins.
- Require terms of use acceptance for guest and external users.
Always deploy new policies in report-only mode first, always maintain two excluded break-glass Global Administrator accounts, and review the What If tool and sign-in logs before enforcement. We build and maintain this policy set for clients as part of managed Entra ID.
Zero Trust and the Essential Eight — how they align
The Essential Eight and Zero Trust are complementary rather than competing. The Essential Eight is a prescriptive list of mitigation strategies with measurable maturity levels; Zero Trust is an architectural philosophy. Most Essential Eight controls are Zero Trust controls expressed as compliance requirements.
| Essential Eight control | Zero Trust pillar | Microsoft implementation |
|---|---|---|
| Application control | Applications, devices | Intune, App Control for Business |
| Patch applications | Devices | Intune, Autopatch, Defender vulnerability management |
| Configure macro settings | Devices, applications | Intune configuration profiles |
| User application hardening | Devices | Intune, Defender attack surface reduction |
| Restrict admin privileges | Identity | Entra PIM, role-based access control, access reviews |
| Patch operating systems | Devices | Intune update rings, Windows Autopatch |
| Multi-factor authentication | Identity | Entra ID Conditional Access, FIDO2, passkeys |
| Regular backups | Data, infrastructure | Azure Backup, Purview retention, third-party M365 backup |
Achieving Essential Eight Maturity Level 2 in a Microsoft 365 Business Premium environment delivers a substantial portion of a Zero Trust architecture as a by-product. The reverse is also true — businesses that adopt Zero Trust properly usually find Essential Eight assessment straightforward. We map both in our governance and compliance readiness engagements.
Implementing Zero Trust for Australian businesses step by step
Zero Trust is delivered in stages. Attempting all five pillars simultaneously guarantees user disruption and stalled projects. The sequence below reflects the order that produces the most risk reduction per unit of effort.
Step 1 — Baseline the current environment
Run an identity and security posture assessment: Microsoft Secure Score, MFA registration coverage, administrator role inventory, device enrolment and compliance rates, legacy authentication usage, and external sharing exposure.
Step 2 — Secure identity first
Enforce multi-factor authentication for every user through Conditional Access, block legacy authentication, create and monitor break-glass accounts, and reduce standing Global Administrator assignments to two or three with just-in-time elevation for the rest.
Step 3 — Enrol and harden devices
Enrol all corporate Windows, macOS, iOS and Android devices in Microsoft Intune, apply configuration baselines with disk encryption and Defender enabled, and define compliance policies covering patch level, encryption and threat protection.
Step 4 — Require device compliance for access
Add Conditional Access policies that require a compliant or hybrid-joined device for Exchange Online, SharePoint Online and Teams, with browser-only session restrictions for unmanaged devices.
Step 5 — Apply least privilege
Enable Privileged Identity Management for just-in-time role activation with approval and justification, run quarterly access reviews for privileged roles and guest accounts, and remove permanent elevated permissions.
Step 6 — Classify and protect data
Deploy Microsoft Purview sensitivity labels for the small number of classifications your business actually uses, apply data loss prevention policies to sensitive information types, and configure retention aligned to your record-keeping obligations.
Step 7 — Segment and secure infrastructure
Remove public management endpoints from Azure virtual machines, implement just-in-time VM access, apply network security groups and private endpoints, and act on Defender for Cloud recommendations.
Step 8 — Monitor, review and mature
Centralise sign-in, audit and Defender logs with adequate retention, alert on high-risk sign-ins and privileged role activation, and review policy effectiveness quarterly as staff, applications and threats change.
Where Australian businesses get Zero Trust wrong
Buying tools instead of designing policy. Licences do not implement themselves. An E5 tenant with default settings is less secure than a well-configured Business Premium tenant.
Exempting executives and administrators. The accounts with the most access receive the weakest controls because they complain the loudest. This inverts the entire model.
Treating it as a project with an end date. Conditional Access policy drifts as applications and staff change. Zero Trust requires ongoing maintenance and quarterly review.
Ignoring the data pillar. Identity and device controls are visible and satisfying to implement. Data classification is tedious and gets deferred — but it is the control that still works after a device is lost or an account is compromised.
Mycelium 365 designs and operates Zero Trust architectures for Australian businesses on Microsoft 365 and Azure, from initial posture assessment through to ongoing policy management under our managed security services. Start with identity, prove the model on one pillar, and expand from there.
Zero Trust implementation in Azure — can Mycelium 365 help?
The query "can you help implement zero trust security in azure?" is one of the most frequently appearing question queries reaching this page — it's a direct commercial intent question. This section answers it directly:
Yes — Mycelium 365 implements Zero Trust security architecture for Australian businesses using Microsoft 365 and Azure. Implementation covers the five pillars described above, typically in a phased engagement over 60–90 days:
Phase 1 — Identity: Entra ID Conditional Access policy deployment (MFA enforcement, device compliance requirements, location-based access controls, risk-based sign-in policies). This is the single highest-impact Zero Trust control and is completed first.
Phase 2 — Devices: Microsoft Intune compliance policies ensuring all devices meet a minimum security baseline before accessing Microsoft 365 and Azure resources. Includes Windows, macOS, iOS, and Android.
Phase 3 — Applications: Microsoft Defender for Cloud Apps session controls, application-level Conditional Access policies, and Purview sensitivity labels restricting how data flows between applications.
Phase 4 — Data: Microsoft Purview information protection — sensitivity labels, DLP policies, and data classification ensuring sensitive data is identified and protected regardless of where it travels.
Phase 5 — Network: Azure Firewall, network segmentation, and Microsoft Defender for Cloud network security posture — ensuring lateral movement within Azure is restricted even if an identity is compromised.
The result is a verifiable Zero Trust posture mapped to Essential Eight Maturity Level 2 and suitable for DISP, APRA, and cyber insurance compliance documentation. Contact Mycelium 365 for a Zero Trust gap assessment or see the managed security services page for ongoing security monitoring.