Zero Trust in Azure: A Practical Starting Point
Zero Trust isn't a product you buy — it's an architecture you build. Here's how I approach it in Microsoft Azure environments, from identity foundations to network segmentation.
Zero Trust has become one of the most overused terms in cloud security. Every vendor claims their product “enables Zero Trust.” But underneath the marketing, the principle is simple: never trust, always verify.
This post is a practical walkthrough of how I implement Zero Trust principles in Azure environments — not theory, but the actual patterns and services I reach for.
Why “Network Perimeter = Trust” is Dead
Traditional security assumed that anything inside the corporate network was safe. Cloud computing, remote work, and hybrid identities have completely dismantled that assumption. An attacker who compromises a single VPN credential can often move laterally across your entire estate.
Zero Trust flips this: you verify every request, regardless of where it originates.
The Three Pillars I Start With
1. Identity is the New Perimeter
In Azure, this means:
- Entra ID (formerly AAD) as the single identity plane — no shadow directories
- Conditional Access policies enforcing MFA on every privileged action
- Privileged Identity Management (PIM) for just-in-time elevation — nobody should have permanent Global Admin
- Managed Identities for service-to-service authentication, eliminating shared secrets
The moment you can answer “who is this request from, and are they allowed right now?” for every API call, you’ve made significant progress.
2. Least-Privilege Access by Default
This is where most organisations struggle. The temptation to assign broad permissions to get things working quickly creates enormous attack surface.
My approach:
- Azure RBAC scoped to the lowest meaningful level (resource group, not subscription)
- Custom roles where built-in roles are too broad
- Regular access reviews via Entra ID Governance — permissions granted should have expiry dates
3. Assume Breach — Segment Everything
Even if you do everything above, you should design your systems as if an attacker is already inside. This means:
- Network segmentation via Azure Virtual Networks with NSGs and Azure Firewall
- Private Endpoints for all PaaS services (Storage, Key Vault, SQL) — no public endpoints
- Microsoft Defender for Cloud for continuous posture assessment
- Sentinel for unified SIEM/SOAR — behavioural analytics catch what rules miss
The Honest Part
Zero Trust is a journey, not a destination. Most real-world environments I work in have legacy applications, hybrid identities, and budget constraints. The pragmatic approach is:
- Identify your crown jewels — what data or systems, if compromised, would be catastrophic?
- Apply Zero Trust controls there first
- Expand outward as you build confidence and momentum
Starting with a perfect greenfield architecture is a luxury. Working with what you have, systematically reducing trust assumptions, is the real skill.
Have questions or a different approach? Connect with me on LinkedIn or open a discussion on GitHub.
Written by Tom Clark
Senior Cloud Security & Platform Engineer