{"id":9344,"date":"2024-07-23T01:01:02","date_gmt":"2024-07-23T08:01:02","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=9344"},"modified":"2024-10-26T14:54:18","modified_gmt":"2024-10-26T21:54:18","slug":"implementing-a-zero-trust-security-model-at-microsoft","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/","title":{"rendered":"Implementing a Zero Trust security model at Microsoft"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"112\" class=\"size-medium wp-image-7498 alignright\" style=\"margin-top: 0px;\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/ms-digital-technical-stories-300x112.png\" alt=\"Microsoft Digital technical stories\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/ms-digital-technical-stories-300x112.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/ms-digital-technical-stories.png 500w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/>At Microsoft, our shift to a Zero Trust security model more than five years ago has helped us navigate many challenges.<\/p>\n<p>The increasing prevalence of cloud-based services, mobile computing, internet of things (IoT), and bring your own device (BYOD) in the workforce have changed the technology landscape for the modern enterprise. Security architectures that rely on network firewalls and virtual private networks (VPNs) to isolate and restrict access to corporate technology resources and services are no longer sufficient for a workforce that regularly requires access to applications and resources that exist beyond traditional corporate network boundaries. The shift to the internet as the network of choice and the continuously evolving threats led us to adopt a Zero Trust security model internally here at Microsoft. Though our journey began many years ago, we expect that it will continue to evolve for years to come.<\/p>\n<p><em>[<a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/transitioning-to-modern-access-architecture-with-zero-trust\">Learn how we\u2019re transitioning to modern access architecture with Zero Trust<\/a>. <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/zero-trust\" target=\"_blank\" rel=\"noopener\">Find out how to enable a remote workforce by embracing Zero Trust security<\/a>. <a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/blog\/running-on-vpn-how-microsoft-is-keeping-its-remote-workforce-connected\/\">Running on VPN: Learn how we\u2019re keeping our remote workforce connected<\/a>.]<\/em><br \/>\n<iframe title=\"Best practices for implementing Zero Trust at Microsoft\" src=\"https:\/\/www.youtube.com\/embed\/ZVLlEj2So4E\" aria-labelledby=\"Best practices for implementing Zero Trust at Microsoft\"><\/iframe><span style=\"font-size: 10pt;\">For a transcript, please view the video on YouTube: <a href=\"https:\/\/www.youtube.com\/watch?v=ZVLlEj2So4E\" target=\"_blank\" rel=\"noopener\">https:\/\/www.youtube.com\/watch?v=ZVLlEj2So4E<\/a>, select the &#8220;More actions&#8221; button (three dots icon) below the video, and then select &#8220;Show transcript.&#8221;<\/span><\/p>\n<div style=\"margin-top: -5px;\"><em>Carmichael Patton, a security architect at Microsoft, shares the work that his team, Digital Security and Resiliency, has been doing to support a Zero Trust security model.<\/em><\/div>\n<h2>The Zero Trust model<\/h2>\n<p>Based on the principle of verified trust\u2014in order to trust, you must first verify\u2014Zero Trust eliminates the inherent trust that is assumed inside the traditional corporate network. Zero Trust architecture reduces risk across all environments by establishing strong identity verification, validating device compliance prior to granting access, and ensuring least privilege access to only explicitly authorized resources.<\/p>\n<p>Zero Trust requires that every transaction between systems (user identity, device, network, and applications) be validated and proven trustworthy before the transaction can occur. In an ideal Zero Trust environment, the following behaviors are required:<\/p>\n<ul class=\"c-list\">\n<li><strong>Identities are validated and secure with multifactor authentication (MFA) everywhere.<\/strong>\u00a0Using multifactor authentication eliminates password expirations and eventually will eliminate passwords. The added use of biometrics ensures strong authentication for user-backed identities.<\/li>\n<li><strong>Devices are managed and validated as healthy.<\/strong>\u00a0Device health validation is required. All device types and operating systems must meet a required minimum health state as a condition of access to any Microsoft resource.<\/li>\n<li><strong>Telemetry is pervasive.<\/strong>\u00a0Pervasive data and telemetry are used to understand the current security state, identify gaps in coverage, validate the impact of new controls, and correlate data across all applications and services in the environment. Robust and standardized auditing, monitoring, and telemetry capabilities are core requirements across users, devices, applications, services, and access patterns.<\/li>\n<li><strong>Least privilege access is enforced.<\/strong>\u00a0Limit access to only the applications, services, and infrastructure required to perform the job function. Access solutions that provide broad access to networks without segmentation or are scoped to specific resources, such as broad access VPN, must be eliminated.<\/li>\n<\/ul>\n<p><strong>Zero Trust scenarios<\/strong><\/p>\n<p>We have identified four core scenarios at Microsoft to help achieve Zero Trust. These scenarios satisfy the requirements for strong identity, enrollment in device management and device-health validation, alternative access for unmanaged devices, and validation of application health. The core scenarios are described here:<\/p>\n<ul class=\"c-list\">\n<li><strong>Scenario 1:<\/strong>\u00a0Applications and services have the mechanisms to validate multifactor authentication and device health.<\/li>\n<li><strong>Scenario 2:<\/strong>\u00a0Employees can enroll devices into a modern management system which guarantees the health of the device to control access to company resources.<\/li>\n<li><strong>Scenario 3:<\/strong>\u00a0 Employees and business guests have a method to access corporate resources when not using a managed device.<\/li>\n<li><strong>Scenario 4:\u00a0<\/strong>Access to resources is limited to the minimum required\u2014least privilege access\u2014to perform a specified function.<\/li>\n<\/ul>\n<h2>Zero Trust scope and phases<\/h2>\n<p>We\u2019re taking a structured approach toward Zero Trust, in an effort that spans many technologies and organizations, and requires investments that will carry over multiple years. The figure below represents a high-level view of the Zero Trust goals that we aim to fully achieve over the next two to three years, grouped into our core Zero Trust pillars. We will continually evaluate these goals and adjust them if necessary. While these goals don\u2019t represent the full scope of the Zero Trust efforts and work streams, they capture the most significant areas of Zero Trust effort at Microsoft.<\/p>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_9347\" aria-describedby=\"caption-attachment-9347\" style=\"width: 1132px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-9347 size-full\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-001.png\" alt=\"Pre-Zero Trust characteristics compared to the four pillars of Zero Trust implementation: Verify identity, Verify device, Verify access, and Verify services.\" width=\"1132\" height=\"561\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-001.png 1132w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-001-300x149.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-001-1024x507.png 1024w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-001-768x381.png 768w\" sizes=\"(max-width: 1132px) 100vw, 1132px\" \/><figcaption id=\"caption-attachment-9347\" class=\"wp-caption-text\">The major goals for each Zero Trust pillar.<\/figcaption><\/figure>\n<h2>Scope<\/h2>\n<p>Our initial scope for implementing Zero Trust focused on common corporate services used across our enterprise\u2014our employees, partners, and vendors. Our Zero Trust implementation targeted the core set of applications that Microsoft employees use daily (e.g., Microsoft Office apps, line-of-business apps) on platforms like iOS, Android, MacOS, and Windows (Linux is an eventual goal). As we have progressed, our focus has expanded to include all applications used across Microsoft. Any corporate-owned or personal device that accesses company resources must be managed through our device management systems.<\/p>\n<h2>Verify identity<\/h2>\n<p>To begin enhancing security for the environment, we implemented MFA using smart cards to control administrative access to servers. We later expanded the multifactor authentication requirement to include all users accessing resources from outside the corporate network. The massive increase in mobile devices connecting to corporate resources pushed us to evolve our multifactor authentication system from physical smart cards to a phone-based challenge (phone-factor) and later into a more modern experience using the Microsoft Azure Authenticator application.<\/p>\n<p>The most recent progress in this area is the widespread deployment of Windows Hello for Business for biometric authentication. While Windows Hello hasn\u2019t completely eliminated passwords in our environment, it has significantly reduced password usage and enabled us to remove our password-expiration policy. Additionally, multifactor authentication validation is required for all accounts, including guest accounts, when accessing Microsoft resources.<\/p>\n<h2>Verify device<\/h2>\n<p>Our first step toward device verification was enrolling devices into a device-management system. We have since completed the rollout of device management for Windows, Mac, iOS, and Android. Many of our high-traffic applications and services, such as Microsoft 365 and VPN, enforce device health for user access. Additionally, we\u2019ve started using device management to enable proper device health validation, a foundational component that allows us to set and enforce health policies for devices accessing Microsoft resources. We\u2019re using Windows Autopilot for device provisioning, which ensures that all new Windows devices delivered to employees are already enrolled in our modern device management system.<\/p>\n<p>Devices accessing the corporate wireless network must also be enrolled in the device-management system. This includes both Microsoft\u2013owned devices and personal BYOD devices. If employees want to use their personal devices to access Microsoft resources, the devices must be enrolled and adhere to the same device-health policies that govern corporate-owned devices. For devices where enrollment in device management isn\u2019t an option, we\u2019ve created a secure access model called Microsoft Azure Virtual Desktop. Virtual Desktop creates a session with a virtual machine that meets the device-management requirements. This allows individuals using unmanaged devices to securely access select Microsoft resources. Additionally, we\u2019ve created a browser-based experience allowing access to some Microsoft 365 applications with limited functionality.<\/p>\n<p>There is still work remaining within the verify device pillar. We\u2019re in the process of enabling device management for Linux devices and expanding the number of applications enforcing device management to eventually include all applications and services. We\u2019re also expanding the number of resources available when connecting through the Virtual Desktop service. Finally, we\u2019re expanding device-health policies to be more robust and enabling validation across all applications and services.<\/p>\n<h2>Verify access<\/h2>\n<p>In the verify access pillar, our focus is on segmenting users and devices across purpose-built networks, migrating all Microsoft employees to use the internet as the default network, and automatically routing users and devices to appropriate network segments. We\u2019ve made significant progress in our network-segmentation efforts. We have successfully deployed several network segments, both for users and devices, including the creation of a new internet-default wireless network across all Microsoft buildings. All users have received policy updates to their systems, thus making this internet-based network their new default.<\/p>\n<p>As part of the new wireless network rollout, we also deployed a device-registration portal. This portal allows users to self-identify, register, or modify devices to ensure that the devices connect to the appropriate network segment. Through this portal, users can register guest devices, user devices, and IoT devices.<\/p>\n<p>We\u2019re also creating specialized segments, including purpose-built segments for the various IoT devices and scenarios used throughout the organization. We have nearly completed the migration of our highest-priority IoT devices in Microsoft offices into the appropriate segments.<\/p>\n<p>We still have a lot of work to do within the verify access pillar. We\u2019re following the investments in our wireless networks with similar wired network investments. For IoT, we need to complete the migration of the remaining high-priority devices in Microsoft offices and then start on high-priority devices in our datacenters. After these devices are migrated, we\u2019ll start migrating lower-priority devices. Finally, we\u2019re building auto-detection for devices and users, which will route them to the appropriate segment without requiring registration in the device-registration portal.<\/p>\n<h2>Verify services<\/h2>\n<p>In the verify services pillar, our efforts center on enabling conditional access across all applications and services. To achieve full conditional access validation, a key effort requires modernizing legacy applications or implementing solutions for applications and services that can\u2019t natively support conditional access systems. This has the added benefit of eliminating the dependency on VPN and the corporate network. We\u2019ve enabled auto-VPN for all users, which automatically routes users through the appropriate connection. Our goal is to eliminate the need for VPN and create a seamless experience for accessing corporate resources from the internet. With auto-VPN, the user\u2019s system will transparently determine how to connect to resources, bypassing VPN for resources available directly from the internet or using VPN when connecting to a resource that is only available on the corporate network.<\/p>\n<p>Amid the COVID-19 pandemic, a large percentage of our user population transitioned to work from home. This shift has provided increased use of remote network connectivity. In this environment, we\u2019ve successfully identified and engaged application owners to initiate plans to make these applications or services accessible over the internet without VPN.<\/p>\n<p>While we have taken the first steps toward modernizing legacy applications and services that still use VPN, we are in the process of establishing clear plans and timelines for enabling access from the internet. We also plan to invest in extending the portfolio of applications and services enforcing conditional access beyond Microsoft 365 and VPN.<\/p>\n<h2>Zero Trust architecture with Microsoft services<\/h2>\n<p>The graphic below provides a simplified reference architecture for our approach to implementing Zero Trust. The primary components of this process are Intune for device management and device security policy configuration, Microsoft Azure Active Directory (Azure AD) conditional access for device health validation, and Azure AD for user and device inventory.<\/p>\n<p>The system works with Intune, by pushing device configuration requirements to the managed devices. The device then generates a statement of health, which is stored in Microsoft Azure AD. When the device user requests access to a resource, the device health state is verified as part of the authentication exchange with Azure AD.<\/p>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_9348\" aria-describedby=\"caption-attachment-9348\" style=\"width: 1174px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-9348 size-full\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-002.png\" alt=\"Users and devices in an unprivileged network.\" width=\"1174\" height=\"661\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-002.png 1174w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-002-300x169.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-002-1024x577.png 1024w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-002-768x432.png 768w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743-img-002-1000x562.png 1000w\" sizes=\"(max-width: 1174px) 100vw, 1174px\" \/><figcaption id=\"caption-attachment-9348\" class=\"wp-caption-text\">Microsoft\u2019s internal Zero Trust architecture.<\/figcaption><\/figure>\n<h2>A transition that&#8217;s paying off<\/h2>\n<p>Our transition to a Zero Trust model has made significant progress. Over the last several years, we\u2019ve increased identity-authentication strength with expanded coverage of strong authentication and a transition to biometrics-based authentication by using Windows Hello for Business. We\u2019ve deployed device management and device-health validation capabilities across all major platforms and will soon add Linux. We\u2019ve also launched a Windows Virtual Desktop system that provides secure access to company resources from unmanaged devices.<\/p>\n<p>As we continue our progress, we\u2019re making ongoing investments in Zero Trust. We\u2019re expanding health-validation capabilities across devices and applications, increasing the Virtual Desktop features to cover more use cases, and implementing better controls on our wired network. We\u2019re also completing our IoT migrations and segmentation and modernizing or retiring legacy applications to enable us to deprecate VPN.<\/p>\n<p>Each enterprise that adopts Zero Trust will need to determine what approach best suits their unique environment. This includes balancing risk profiles with access methods, defining the scope for the implementation of Zero Trust in their environments, and determining what specific verifications they want to require for users to gain access to their company resources. In all of this, encouraging the organization-wide embrace of Zero Trust is critical to success, no matter where you decide to begin your transition.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"74\" class=\"alignnone size-medium wp-image-7448\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/key-takeaways-300x74.png\" alt=\"Key Takeaways\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/key-takeaways-300x74.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/key-takeaways.png 500w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<ul class=\"c-list\">\n<li>Collect telemetry and evaluate risks, and then set goals.\u200b<\/li>\n<li>Get to modern identity and MFA\u2014then onboard to AAD.\u200b<\/li>\n<li>For conditional access enforcement, focus on top used applications to ensure maximum\u00a0coverage.\u200b<\/li>\n<li>Start with simple policies for device health enforcement such as device lock or\u00a0password complexity.\u00a0\u200b<\/li>\n<li>Run pilots and ringed rollouts. Slow and steady wins the race.\u00a0\u200b<\/li>\n<li>Migrate your users to the Internet and monitor VPN traffic to understand internal\u00a0dependencies.\u200b<\/li>\n<li>Focus on user experience as it is critical to employee productivity and morale.\u00a0Without adoption, your program will not be a success.\u200b<\/li>\n<li>Communication is key\u2014bring your employees on the journey with you!\u00a0\u200b<\/li>\n<li>Assign performance indicators and goals for all workstreams and elements, including employee sentiment.\u00a0\u200b<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"81\" class=\"alignnone size-medium wp-image-7482\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/related_links-300x81.png\" alt=\"Related links\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/related_links-300x81.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/related_links.png 500w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<ul class=\"c-list\">\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/transitioning-to-modern-access-architecture-with-zero-trust\">Learn how we\u2019re transitioning to modern access architecture with Zero Trust<\/a>.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/zero-trust\" target=\"_blank\" rel=\"noopener\">Find out how to enable a remote workforce by embracing Zero Trust security<\/a>.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/security\/blog\/zero-trust\/\" target=\"_blank\" rel=\"noopener\">Read our Microsoft Security Zero Trust blogs<\/a>.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/blog\/2020\/03\/12\/top-9-ways-microsoft-it-enabling-remote-work-employees\/?elevate-wr\" target=\"_blank\" rel=\"noopener\">Check out our top 9 ways Microsoft IT is enabling remote work for its employees list.<\/a><\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/running-on-vpn-how-microsoft-is-keeping-its-remote-workforce-connected\/\">Running on VPN: Learn how we\u2019re keeping our remote workforce connected<\/a>.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/verifying-identity-in-a-zero-trust-model\/\">Learn more about verifying identity in a Zero Trust model<\/a> \u00a0and on <a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/verifying-devices-in-a-zero-trust-model\/\">verifying devices in a Zero Trust model<\/a>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-12081 size-full\" style=\"margin-top: 15px;\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/Customer-Survey-580x85-1.png\" alt=\"We'd like to hear from you!\" width=\"580\" height=\"85\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/Customer-Survey-580x85-1.png 580w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/Customer-Survey-580x85-1-300x44.png 300w\" sizes=\"(max-width: 580px) 100vw, 580px\" \/><\/p>\n<p><a href=\"https:\/\/forms.office.com\/r\/czbs6PptPe\" target=\"_blank\" rel=\"noopener\">Share your feedback with us\u2014take our survey and let us know what kind of content is most useful to you.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>At Microsoft, our shift to a Zero Trust security model more than five years ago has helped us navigate many challenges. The increasing prevalence of cloud-based services, mobile computing, internet of things (IoT), and bring your own device (BYOD) in the workforce have changed the technology landscape for the modern enterprise. Security architectures that rely [&hellip;]<\/p>\n","protected":false},"author":133,"featured_media":9345,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":true,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[361,95],"coauthors":[646],"class_list":["post-9344","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-azure-identity-and-security","tag-security","program-microsoft-digital-technical-stories","m-blog-post"],"jetpack_publicize_connections":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Implementing a Zero Trust security model at Microsoft - Inside Track Blog<\/title>\n<meta name=\"description\" content=\"Learn how Microsoft is implementing a Zero Trust security model internally at Microsoft.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Implementing a Zero Trust security model at Microsoft - Inside Track Blog\" \/>\n<meta property=\"og:description\" content=\"Learn how Microsoft is implementing a Zero Trust security model internally at Microsoft.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/\" \/>\n<meta property=\"og:site_name\" content=\"Inside Track Blog\" \/>\n<meta property=\"article:published_time\" content=\"2024-07-23T08:01:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-10-26T21:54:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1040\" \/>\n\t<meta property=\"og:image:height\" content=\"585\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Inside Track staff\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Inside Track staff\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/\",\"name\":\"Implementing a Zero Trust security model at Microsoft - Inside Track Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg\",\"datePublished\":\"2024-07-23T08:01:02+00:00\",\"dateModified\":\"2024-10-26T21:54:18+00:00\",\"author\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/d87d5d73eed76dd055086299c842c17e\"},\"description\":\"Learn how Microsoft is implementing a Zero Trust security model internally at Microsoft.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg\",\"width\":1040,\"height\":585,\"caption\":\"Our Zero Trust security model enables us to provide a healthy and protected environment internally at Microsoft.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Implementing a Zero Trust security model at Microsoft\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\",\"name\":\"Inside Track Blog\",\"description\":\"How Microsoft does IT\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/d87d5d73eed76dd055086299c842c17e\",\"name\":\"Inside Track staff\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/fb338dea806293f999356f7d8a399348\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3788032f4762be09ee17b2ec39f3d75b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3788032f4762be09ee17b2ec39f3d75b?s=96&d=mm&r=g\",\"caption\":\"Inside Track staff\"},\"description\":\"Questions? Send us a note: msitstaff@microsoft.com\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/insidetrack\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Implementing a Zero Trust security model at Microsoft - Inside Track Blog","description":"Learn how Microsoft is implementing a Zero Trust security model internally at Microsoft.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/","og_locale":"en_US","og_type":"article","og_title":"Implementing a Zero Trust security model at Microsoft - Inside Track Blog","og_description":"Learn how Microsoft is implementing a Zero Trust security model internally at Microsoft.","og_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/","og_site_name":"Inside Track Blog","article_published_time":"2024-07-23T08:01:02+00:00","article_modified_time":"2024-10-26T21:54:18+00:00","og_image":[{"width":1040,"height":585,"url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg","type":"image\/jpeg"}],"author":"Inside Track staff","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Inside Track staff","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/","name":"Implementing a Zero Trust security model at Microsoft - Inside Track Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg","datePublished":"2024-07-23T08:01:02+00:00","dateModified":"2024-10-26T21:54:18+00:00","author":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/d87d5d73eed76dd055086299c842c17e"},"description":"Learn how Microsoft is implementing a Zero Trust security model internally at Microsoft.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#primaryimage","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg","contentUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg","width":1040,"height":585,"caption":"Our Zero Trust security model enables us to provide a healthy and protected environment internally at Microsoft."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/implementing-a-zero-trust-security-model-at-microsoft\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/insidetrack\/blog\/"},{"@type":"ListItem","position":2,"name":"Implementing a Zero Trust security model at Microsoft"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/","name":"Inside Track Blog","description":"How Microsoft does IT","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/d87d5d73eed76dd055086299c842c17e","name":"Inside Track staff","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/fb338dea806293f999356f7d8a399348","url":"https:\/\/secure.gravatar.com\/avatar\/3788032f4762be09ee17b2ec39f3d75b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3788032f4762be09ee17b2ec39f3d75b?s=96&d=mm&r=g","caption":"Inside Track staff"},"description":"Questions? Send us a note: msitstaff@microsoft.com","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/insidetrack\/"}]}},"jetpack_featured_media_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/01\/8743_wordpress_hero.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9hcZA-2qI","_links":{"self":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/9344"}],"collection":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/users\/133"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/comments?post=9344"}],"version-history":[{"count":18,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/9344\/revisions"}],"predecessor-version":[{"id":13790,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/9344\/revisions\/13790"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media\/9345"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media?parent=9344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/categories?post=9344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/tags?post=9344"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/coauthors?post=9344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}