MSDEVBUILD / azure

Zero Trust

at homein the office🕵️Check EVERYrequestidentity · device · risk✔️ Verify explicitly🔑 Least privilege🚨 Assume breach“Never trust, always verify”, even inside the office network.
Zero Trust checks every request, from home or the office. Never trust, always verify.

😟 THE PROBLEM

Once inside the network, an attacker can reach almost everything.

😊 THE SOLUTION

Adopt Zero Trust: verify explicitly, least privilege, assume breach.

  • Trusting everything inside✓ Verify every request
  • Broad standing access✓ Just-in-time, just-enough
  • Attackers move freely✓ Segment and monitor
🛠️ Solved with: Zero Trust model
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026

Quick answer

Zero Trust is a security model that assumes the worst and trusts nothing by default, not even requests from inside the corporate network. Its three guiding principles are verify explicitly (always authenticate and authorise using all available signals), use least privilege access (just-in-time and just-enough access) and assume breach (minimise blast radius and segment access).

Exam objective: 2.4.6 Describe the concept of Zero Trust. (Skills measured as of July 20, 2026)

Start with a question

Once someone is inside the office network, should they be trusted with everything?

The old model said yes. Zero Trust says no: check every request, every time.

Explain it like I’m 10

The technical explanation

PrincipleMeaningAzure examples
Verify explicitlyUse identity, device, location and risk on every requestEntra ID, MFA, Conditional Access
Least privilegeJust-in-time, just-enough accessAzure RBAC, Privileged Identity Management
Assume breachSegment, encrypt, monitor, limit blast radiusNSGs, private endpoints, Defender for Cloud

Real-world business scenario

Healthcare

A healthcare provider

The problem
An attacker who phished one employee could move freely across the 'trusted' internal network.
What they used
Adopted Zero Trust: MFA and Conditional Access, least-privilege roles, network segmentation and continuous monitoring.
Why that choice
Every request is verified and access is limited, so one compromised account can do little.
The result
Lateral movement in later security tests was stopped at the first step.

When to use it and when not to

✓ Use it when…

  • As the foundation for every modern security strategy.

✕ Think twice when…

  • Relying on the network perimeter alone.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What does Zero Trust mean?

Model answer

Never trust, always verify. Every request is checked, even if it comes from inside the company network, instead of trusting everything behind the firewall.

Intermediate What are the three principles of Zero Trust?

Model answer

Verify explicitly, use least privilege access, and assume breach.

Experienced developer How do Azure services support Zero Trust?

Model answer

Entra ID with MFA and Conditional Access to verify explicitly; RBAC and Privileged Identity Management for least privilege; and segmentation, private endpoints, encryption and Defender for Cloud monitoring to assume breach and limit blast radius.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which is a guiding principle of Zero Trust?

Question 2

Question 2 of 3 · Select 2

Which TWO are Zero Trust principles?

Question 3

Question 3 of 3

What is the core idea of Zero Trust?

Quick revision

Key points

  • Zero Trust = never trust, always verify.
  • Verify explicitly, least privilege, assume breach.
  • Replaces the old "trusted internal network" model.

Important terminology

Zero Trust
A model where every access request is fully verified, regardless of where it comes from.
Verify explicitly
Always authenticate and authorise using identity, location, device, service and risk.
Least privilege
Limit access with just-in-time and just-enough-access.
Assume breach
Design as if attackers are already inside. Segment, encrypt and monitor.

Common mistakes

  • Thinking Zero Trust is a single product you can buy.

Exam tips

  • Learn the three principles word for word.

Five quick revision questions

  1. 1.What is the Zero Trust motto?Show

    Never trust, always verify.

  2. 2.Name the three principles.Show

    Verify explicitly, use least privilege access, assume breach.

  3. 3.Does Zero Trust trust the internal network?Show

    No.

  4. 4.Which principle limits access to just-in-time and just-enough?Show

    Least privilege access.

  5. 5.Name an Azure tool that helps verify explicitly.Show

    Conditional Access (with MFA).

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Defense in Depth