2.1.3. The Zero Trust Model

💡 First Principle: Zero Trust replaces the old assumption "if you're inside the network, you're safe" with three operating principles — verify explicitly, use least-privilege access, and assume breach — meaning every request is checked every time, regardless of where it originates, as if an attacker might already be inside.

Notice that Zero Trust is not a single product — it's an operating model that Conditional Access, Identity Protection, and network segmentation all implement together. Verify explicitly means every sign-in re-checks identity, device compliance, and risk rather than trusting a prior login. Least privilege access means granting only the access needed, for only as long as needed — the same principle behind Privileged Identity Management in Phase 3. Assume breach means designing systems as though an attacker is already inside, which is why segmentation and continuous monitoring matter even behind the "front door."

⚠️ Exam Trap: Zero Trust does not mean zero access is ever granted. It means trust is never assumed from network location alone — access is still granted, but only after explicit verification, and continuously re-evaluated afterward.

Reflection Question: Under a Zero Trust model, does a user who successfully signs in from the corporate office network get treated differently from a user signing in from a coffee shop? Why or why not?