Skip to content

Lab 1. Zero Trust Assessment and risk review

Optional

Time 15 minutes
Accounts none, public demo report
Window any
Roles none

Scenario

Before Contoso spends money on Copilot licences, leadership wants one answer: is the identity, device and data foundation ready? The Microsoft Zero Trust Assessment scans a tenant and scores it across seven pillars. In this lab you read Microsoft's public demo report the way a security architect would, and turn its findings into the plan you execute in Labs 2 to 6.

Objectives

  • Navigate the Zero Trust Assessment report
  • Record maturity scores for the seven pillars
  • Pick three findings and map each to the lab that fixes it
  • Draft a first, then, next remediation order

Task 1. Open the demo report and record the scores

  1. In any browser window go to https://microsoft.github.io/zerotrustassessment/demo/.
  2. In the left menu select Overview.
Zero Trust Assessment demo report Overview page with seven pillar scores
The Overview page. Each pillar shows a score or maturity band.

  1. Write the scores into the table (on paper or in a notes app):

    Pillar Score you see One-line verdict
    Identity
    Devices
    Data
    Network
    Infrastructure
    Security operations
    AI

Expected result

Seven pillars, each with a number. Names and checks vary between report versions; that is fine.

Task 2. Identity and device findings

  1. Select Identity in the left menu.
  2. Find the check about privileged users' authentication methods. Are all administrators using phishing-resistant methods? Note Yes or No.
  3. Find the checks about user authentication. What share of users are covered by multifactor authentication through Conditional Access?
  4. Write one sentence: If an attacker had a user's password today, could they get in?
  5. Select Devices.
  6. Note the number of compliant and non-compliant devices, and the corporate versus personal split.
  7. Write one sentence on the risk of personal devices opening company documents.
Zero Trust Assessment Identity pillar page with authentication method checks
Identity pillar: look for the privileged-user and MFA coverage checks.

Task 3. Network and AI findings

  1. Select Network.
  2. Under the secure web gateway checks, note the status of TLS inspection, web content filtering, threat intelligence and data loss prevention.
  3. Write one sentence on what the security team cannot see when staff browse SaaS apps from a laptop with none of those controls.
  4. Select AI.
  5. Note the AI readiness score and the three incomplete items you find most serious.
  6. Which of those three would stop a Copilot rollout tomorrow?

Task 4. Map findings to today's labs

Finding from the report Fix you build today
Admins or users without phishing-resistant MFA Lab 2
No risk-based sign-in policy Lab 3
Unmanaged devices reach company data Lab 4
No secure web gateway, legacy VPN Lab 5
Oversharing or unlabelled sensitive data ahead of Copilot Lab 6

Pick your three findings and write them as a first, then, next order:

  • First (this week):
  • Then (this quarter):
  • Next (ongoing):

Expected result

Three findings, each mapped to a lab and placed in an order you could defend to a CISO.

Instructor note

A real-tenant run is demo only. The instructor may show Install-Module ZeroTrustAssessment and Invoke-ZTAssessment producing a live report for the lab tenant. Do not mix demo-report findings with real-tenant findings in your notes.

Reflection

  • Which pillar would you expect to score lowest in your own organisation, and why?
  • Why does the assessment treat AI as a pillar of its own rather than a feature of Data?

Next: Lab 2: Phishing-resistant authentication.