Security architecture · Zero Trust
A security architecture that is planned and holds up in the audit.
You get a target architecture with a documented reason for every decision, which your team can implement and auditors can follow. It applies Zero Trust to Entra ID, Intune, Defender, Purview, Sentinel and Azure within the EU Data Boundary.
Example excerpt from a target architecture: MFA for all and time-limited admin roles, access only from compliant devices, confidential data protected with labels and DLP, each with a justification. A legacy application stays on the VPN for now, and the residual risk is recorded. Every decision has a rationale and a work package.
- Six pillars
- Zero Trust from identity to network
- No lock-in
- Tenant, data and documentation stay with you
- Documented for audit
- Evidence for auditors and insurers
Sound familiar?
When is a target architecture worth it?
The assessment revealed gaps
You want a defined target state to work towards.
An environment grown over years
Nobody knows which rule covers which risk.
NIS2 or DORA demands justification
The auditor expects a documented, traceable architecture.
Zero Trust with Microsoft
How does Zero Trust work with Microsoft?
No access is trusted just because it comes from the company network. Every request is checked by identity, device and context, mostly with services you already licence. Switch the view to compare.
Access request, example An employee working from home opens the financial report.
-
1 Identity
Password only Entra ID, Conditional Access MFA and sign-in risk checked
-
2 Device
Not checked Intune, Defender for Endpoint Managed and compliant
-
3 Network
Inside the VPN, everything is trusted Global Secure Access Access to this application only
-
4 Application
Not checked Defender for Cloud Apps Session is monitored
-
5 Data
Not labelled Purview Confidential label applies
-
6 Infrastructure
No central analysis Defender for Cloud, Sentinel Hardened, signals in Sentinel
-
7 Result
Access to the company network Access to this report only
And with a stolen password? The same path: password and VPN are enough, after which most of the network is reachable. The request stops at identity, because MFA is missing, or at the device, because it is not managed. The attempt is logged.
What does the target architecture include?
Target architecture document
Target state with the rationale for each decision.
Implementation plan
Prioritised work packages for your team.
Risk assessment
Which risks are covered and which deliberately remain.
Technical specifications
Concrete settings for Entra ID, Intune, Defender, Purview, Sentinel and Azure Policy.
Implementation support
As a sparring partner or hands-on in the configuration.
Architecture review
Comparing the configuration against the target specification.
How does the project run?
-
2 to 4 weeks
Analyse the starting point
Inventory, obligations and existing reports as the basis.
-
4 to 8 weeks
Design the target architecture
Zero Trust concept per pillar, agreed with your team.
-
2 to 4 weeks
Document and hand over
Architecture document and implementation plan, handed over together. Implementation follows in stages, over 12 to 24 months depending on scope.
Where does your environment stand today?
The gap assessment shows the current state the target architecture builds on.
What changes with a target architecture?
Without a target architecture
- Measures added one by one, reactively
- Unclear which rule covers which risk
- Evidence gathered before every audit
- VPN and perimeter as main protection
With a target architecture
- Every measure tied to the target state
- Every risk mapped to a pillar
- Decisions documented, traceable for auditors
- Every access checked by identity and device
Frequently asked questions
Where does Zero Trust start in a Microsoft environment?
With identity: Conditional Access in Entra ID evaluates user, device and context on every request. Devices in Intune follow, then applications, data, network and infrastructure.
What evidence does an auditor expect regarding privileged access?
Who holds standing or on-request rights, who approved each request and when the role was used. Privileged Identity Management in Entra ID records this in operation.
What does DORA require of an exit strategy for ICT providers?
An orderly change of provider without risk to operations. That requires a documented architecture, constant access to your data and configurations, and operation in your own tenant.
What does data residency in Azure mean in practice?
The EU Data Boundary keeps customer data and most processing in the EU. Azure Policy restricts resources to permitted regions, such as those in Germany. Third-country access still needs a legal assessment.