Entra ID and Conditional Access: Zero Trust Architecture in Practice

"Never trust, always verify." The Zero Trust principle sounds simple, but implementation requires concrete technical measures. Microsoft Entra ID (formerly Azure AD) with Conditional Access is the most accessible path to real zero trust architecture for most organizations.

What Does Zero Trust Mean in Practice?

Traditional security trusts network boundaries — if you're inside the firewall, you're trusted. Zero Trust removes this assumption. Every access request is evaluated based on:

• Identity — — who is the user, and is the account compromised?
• Device — — is the device managed, updated, and compliant?
• Location — — is the request coming from a known or suspicious location?
• Application — — what is the user trying to access?
• Risk — — do real-time signals indicate something is wrong?

Conditional Access: The Policies That Enforce Zero Trust

Conditional Access policies are if-then rules that evaluate these signals and determine access. Here are the most important policies to implement:

1. Require MFA for All Users

Start here. No exceptions for executives, no exceptions for service accounts (use managed identities instead).

2. Block Legacy Authentication

POP3, IMAP, SMTP Basic Auth, and ActiveSync Basic Auth don't support MFA. Block them. All modern clients support modern authentication.

3. Require Compliant Devices

Intune-managed devices that meet security policies (updated OS, active antivirus, disk encryption) get access. Unknown devices get limited or no access.

4. Risk-Based Policies

Entra ID Protection evaluates risk in real-time. Configure policies that:

• Require password change on high user risk
• Require MFA on medium sign-in risk
• Block sign-in on high sign-in risk

5. Location-Based Restrictions

Define named locations (office IP, VPN) and require extra verification from unknown locations. Block access from countries where you never operate.

Privileged Identity Management (PIM)

Zero Trust for administrators means nobody has permanent admin rights. PIM provides:

• Just-in-time access — — activate the role only when needed
• Time limits — — the role deactivates automatically after a defined period
• Approval workflows — — require approval from another admin for sensitive roles
• Audit logging — — full traceability of who activated which roles

Implementation Roadmap

Phase 1: Foundation (Week 1-2)

• Enable Security Defaults if nothing is configured
• Register all users for MFA
• Block legacy authentication

Phase 2: Conditional Access (Week 3-4)

• Disable Security Defaults
• Implement baseline policies (MFA for all, block legacy auth)
• Configure named locations

Phase 3: Device Compliance (Week 5-8)

• Roll out Intune device enrollment
• Define compliance policies
• Require compliant devices for sensitive apps

Phase 4: Advanced (Week 9-12)

• Enable Entra ID Protection and risk-based policies
• Implement PIM for all admin roles
• Configure Access Reviews for guest users and role assignments

Common Mistakes

• No break-glass account — — have at least two emergency access accounts excluded from Conditional Access
• Too aggressive policies too early — — start in report-only mode and analyze impact
• Forgetting service accounts — — they need managed identities, not username/password
• Lack of communication — — tell users what's changing and why

ForSec implements Zero Trust architectures with Entra ID and Conditional Access. We take you from your current state to a full zero trust model with minimal disruption to users. Get in touch for an assessment.