What Zero Trust is
Microsoft’s Zero Trust pillars: identities, endpoints, applications, data, infrastructure, networks, and visibility and automation across them.
Who asks for it: Organisations following Microsoft’s Zero Trust deployment guidance.
What Microsoft 365 can show
6 pillars evidenced by 171 checks. A check maps to a pillar only where its result is genuine evidence for it, so a pillar is listed only when a tenant setting can show it.
Outside Microsoft 365
Infrastructure and network pillars largely sit in Azure and on-premises networks.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every pillar and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- Microsoft Cloud Security Benchmark: Microsoft’s own baseline for securing its cloud services.
- Microsoft Secure Score: Microsoft’s own score for a tenant, read beside the checks.
- PCI DSS 4.0.1: The card industry’s data security standard.
- ISO/IEC 27001:2022: The international standard for an information security management system.