Question

A financial services company is beginning its Zero Trust journey. The CISO wants the initial data-focused workstream to align with the Microsoft Zero Trust adoption framework's guidance for the Data pillar. The organization already has Microsoft Purview licensed but has never applied any labeling or protection. Which sequence of actions best reflects the recommended Zero Trust approach for protecting data?

Accepted Answer

Know your data through discovery and classification, protect it with sensitivity labels and encryption based on that classification, and govern it with policies that enforce least-privilege access.

Answer

Immediately encrypt all data at rest with customer-managed keys across every storage service, then decide later how to classify it.

Answer

Deploy conditional access policies that block all external sharing, since preventing egress is the primary Zero Trust data control.

Answer

Migrate all sensitive data to a single isolated subscription with no internet connectivity to eliminate the need for classification.