What Is Zero Trust Security?

The old model assumed anything inside the office firewall was safe. That assumption broke the moment your staff started working from home, opening Microsoft 365 from laptops, phones and home Wi-Fi. Zero trust fixes the gap by trusting nothing by default and verifying everything, every time. It is the model the National Cyber Security Centre recommends for modern, cloud-based working, and it underpins the managed cybersecurity services AMVIA runs for UK businesses.

What are the core principles of zero trust?

Zero trust rests on three principles, each enforced through specific controls rather than slogans. Microsoft frames them as verify explicitly, use least-privilege access, and assume breach. Together they shrink the damage an attacker can do even after they get a foothold inside your environment.

• Verify explicitly — authenticate and authorise every request using all available signals: user identity, device health, location and the sensitivity of the application being accessed.
• Least-privilege access — grant only the permissions a person or system needs for the task in front of them. Privileged access is time-limited and re-verified, never standing.
• Assume breach — design as though an attacker is already inside. Segment resources to limit lateral movement, reduce blast radius, and support fast detection and response.

These principles map directly onto Microsoft's published zero trust guidance, which is the framework AMVIA implements for clients running Microsoft 365.

How does zero trust work in practice?

In practice, zero trust is a set of always-on checks layered across identity, device and network. Each access request is evaluated in real time, and access is granted, blocked or stepped up depending on the risk it carries at that moment. Nothing is trusted permanently.

The mechanics break down into four enforced controls:

• Device health verification — a device must meet defined standards (disk encryption on, OS patched, antivirus active) before it can reach corporate resources. AMVIA enforces this with Microsoft Intune device compliance.
• Network micro-segmentation — instead of one flat network, resources are segmented so a compromised account or device cannot freely reach everything else.
• Continuous monitoring — access and behaviour are watched throughout a session, not just at login. Anomalies can trigger step-up authentication or session termination.
• Conditional, risk-based access — sign-ins are scored against policy before anything is granted, using Conditional Access in Microsoft Entra ID.

Perimeter security vs zero trust: what is the difference?

The difference is where trust comes from. Perimeter security trusts you because of where you are — inside the network. Zero trust trusts you because of what you can prove right now — verified identity, a healthy device and a low-risk request. For remote and cloud working, location-based trust no longer holds up.

Microsoft Entra ID (formerly Azure AD) with Conditional Access is the primary vehicle for implementing zero trust in a Microsoft 365 environment.

Why does zero trust matter for UK SMEs?

It matters because the perimeter most SMEs still rely on no longer reflects how they work. With 43% of UK businesses experiencing a breach or attack in the past year (Cyber Security Breaches Survey 2025), and many staff signing in from home networks and personal devices, implicit network trust is now a liability rather than a safeguard.

The data also shows the gap is basic. Only 40% of UK businesses have two-factor authentication enabled (DSIT 2025), per the government's Cyber Security Breaches Survey 2025. That single control is one of the cheapest, highest-impact steps toward a zero trust posture — and most firms still have not switched it on.

For a typical 10–500 staff business, zero trust is less about exotic technology and more about turning on and configuring controls you may already own. If you run Microsoft 365 Business Premium, the building blocks are already in your licence; the work is configuring them correctly and keeping them that way.

Can a small business implement zero trust without a large IT team?

Yes. Microsoft 365 Business Premium bundles the core building blocks — Conditional Access, Intune device compliance and MFA — into a single licence at £16.90 per user per month (ex VAT, annual). An MSP configures and maintains the policies, so you do not need an in-house security team to run it.

AMVIA delivers this as a managed zero trust security service, identity-led and configured around your Microsoft 365 tenant, from £4.60/user. The starting point for most clients is enabling MFA everywhere and writing sensible Conditional Access policies — the two changes that move the needle fastest.

How long does it take to adopt zero trust?

Zero trust is a programme, not a one-off project. Most SMEs can deploy the foundational controls — MFA, Conditional Access and device compliance — within a few weeks. Maturing toward full micro-segmentation and continuous monitoring takes longer and is best phased.

The fastest wins come from starting with the highest-risk areas: administrator accounts, finance staff and access to sensitive data. Lock those down first, then widen coverage. Pairing this with managed detection and response gives you the monitoring layer that makes "assume breach" real rather than theoretical.