A practical Zero Trust starting point for mid size companies

Zero Trust is often sold as a massive transformation. In practice, the principle is simple: never trust a request just because of where it comes from. Verify the user, the device and the context every time.

A first 90 days plan

• Days 1 to 30: inventory identities, apps and admin accounts.
• Days 31 to 60: enforce MFA and device checks for sensitive apps.
• Days 61 to 90: remove standing admin access and enable logging everywhere.

A simple conditional access rule already captures the core idea:

policy: finance-apps
  users: all
  require:
    mfa: phishing_resistant
    device: compliant
  block_when:
    sign_in_risk: high

Start there, measure, and expand to the next group of apps.