Question

A financial services company is launching its Zero Trust adoption program using the Microsoft Zero Trust adoption framework. Leadership wants the program organized around measurable business outcomes rather than isolated technical projects. The most urgent business driver is a recent surge in remote and hybrid work, where employees connect from unmanaged personal devices and third-party locations, creating concerns about credential theft and data leakage. Executives ask the security architect which adoption framework construct should anchor and sequence the initial phase of work. What should the architect recommend?

Accepted Answer

Begin with the 'Secure remote and hybrid work' business scenario, then decompose it into objectives spanning the identity, endpoint, and data pillars.

Answer

Start by deploying network micro-segmentation across all on-premises subnets before addressing identity or endpoint controls.

Answer

Prioritize completing the Microsoft Cloud Security Benchmark control baseline for every Azure subscription first.

Answer

Focus exclusively on the data pillar, applying sensitivity labels and DLP policies before enabling any device-based access controls.