Glossary
Zero trust
Also called: Zero trust architecture, ZTA
In one sentence
Zero trust is a security approach that never assumes a user or device is safe just because it's inside the office network — every access request is verified based on identity, device health and context.
The old security model was a castle with a moat: a firewall at the edge, and anyone inside the network was trusted. That model breaks down when staff work from home, data lives in the cloud and a single phished account puts an attacker “inside.” Zero trust, described by NIST in Special Publication 800-207, replaces location-based trust with three ideas: verify explicitly, use least-privilege access, and assume a breach could already be underway.
In practice, for a Microsoft 365 business, zero trust looks like this: every sign-in uses MFA; Conditional Access checks whether the device is managed and healthy through Intune; people get access only to the data their job needs; devices run EDR; and activity is logged so anything unusual is noticed.
Why it matters: zero trust isn't a product you buy, and it isn't only for big companies. It's a way of making decisions. For a small practice, it means a stolen password, a lost laptop or one infected computer stays a contained problem rather than becoming access to everything.
Example: a billing specialist at a medical practice works from home two days a week. Instead of a VPN that puts her laptop “on” the office network, she reaches cloud practice software and SharePoint directly. Each sign-in checks her identity and that her laptop is the practice's managed, encrypted device. Her account can open billing records but not HR files, so a compromise of her account would be limited in what it could reach.
This approach runs through our security and Microsoft 365 services.
Related terms
- Least privilegeLeast privilege means giving every person, account and program only the access it needs to do its job — nothing more, and for no longer than necessary.
- Conditional AccessConditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- Microsoft IntuneMicrosoft Intune is Microsoft's cloud service for managing and securing company computers, phones and tablets — settings, apps, updates and encryption — from one place.
- Microsoft Entra IDMicrosoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service — the system that holds your users' accounts and controls how they sign in to Microsoft 365 and other apps.
- VPN (virtual private network)An encrypted tunnel across the internet that lets a remote device connect to your office network as if it were plugged in at the office.