Modern enterprises face an evolving threat landscape where traditional perimeter-based security is no longer sufficient. Identity has become the new security perimeter, and organisations that fail to adopt a rigorous identity-first strategy remain highly vulnerable to credential theft, lateral movement, and privilege escalation attacks. This project addresses that critical business problem by implementing the full Identity pillar of Microsoft’s Zero Trust framework within a production-grade Microsoft 365 tenant.

The Zero Trust principle of “never trust, always verify” guided every design decision throughout this project. Rather than assuming that internal network access implies trustworthiness, every identity access request — regardless of origin — is evaluated against risk signals, device compliance, location context, and user behaviour before access is granted. Microsoft Entra ID serves as the policy decision point, enforcing granular Conditional Access policies across all cloud resources.

The project leverages a comprehensive stack of Microsoft security technologies: Microsoft Entra ID for centralised identity governance, Conditional Access for policy-based access control, Identity Protection for real-time risk detection, Privileged Identity Management (PIM) for just-in-time administrator access, FIDO2 security keys for passwordless authentication, Microsoft Graph API for automated reporting and governance, and PowerShell for scripted policy deployment and evidence collection.

Across seven structured implementation phases, this project moves from baseline MFA assessment through full production enforcement of 15+ Conditional Access policies, achieving 100% hands-on lab coverage with 30+ evidence screenshots. The expected outcome is a fully hardened identity perimeter that satisfies Zero Trust readiness criteria, eliminates standing administrator privileges, enforces risk-based access decisions, and establishes passwordless authentication as the default user experience.