Most organizations can demonstrate that they have Zero Trust controls in place. Far fewer can demonstrate how consistently those controls protect their most important identities, applications, devices, and access paths. That distinction matters.
A mature Zero Trust posture is not defined by the number of policies enabled in Microsoft Entra. It is defined by how consistently access is evaluated, how exceptions are governed, how privileged access is controlled, and whether the organization can prove that those controls are actually working.
This is where many Zero Trust programs begin to slow down. The foundational identity controls are in place, but further progress becomes more difficult as the program extends across applications, devices, infrastructure, and security operations.
The question is therefore not simply whether Zero Trust controls have been deployed. It is whether they provide consistent protection across the environment, and whether the organization can measure and demonstrate that protection.
What a Credible Zero Trust Posture Looks Like
The first mistake is to equate Zero Trust maturity with feature adoption. An organization can have Microsoft Entra ID, multifactor authentication, Conditional Access, Privileged Identity Management, and device compliance policies in place and still have significant gaps in its Zero Trust posture.
The more useful question is not: Which Zero Trust controls have we deployed? It is: How consistently do those controls influence access decisions across the environment?
A credible posture has several characteristics:
Access decisions are conditional, not static.
Access depends on relevant signals such as identity, device posture, application, risk, and data sensitivity. Conditional Access policies aren’t just present; they cover the users, applications, and scenarios that matter.
Privileged access is treated differently from ordinary access.
Standing administrative permissions are minimized, just-in-time access is used where appropriate, and privileged roles are regularly reviewed. Break-glass accounts are controlled and monitored rather than becoming forgotten exceptions.
Devices are part of the access decision.
The organization knows which devices can reach corporate resources and whether those devices meet the conditions its policies are supposed to enforce.
Applications do not bypass the model.
Legacy authentication, unmanaged applications, federation gaps, and applications outside the Conditional Access boundary can otherwise create alternative access paths around otherwise mature identity controls.
Exceptions are visible and governed.
A temporary exclusion introduced during a migration should not quietly become part of the permanent architecture. Mature organizations know where exceptions exist, why they exist, who owns them, and when they should expire.
The organization can produce evidence.
This is increasingly important. It is not enough to say that MFA is enabled or that Conditional Access is deployed. A defensible posture requires evidence of coverage, enforcement, and ongoing governance.
Two structural conditions make that list harder to reach than it looks, and both sit outside the identity team’s control.
Ownership runs out after identity
Identity and access management typically has a clear owner. Zero Trust is different. Once the program extends beyond identity, responsibility is spread across multiple areas of the organization, including endpoint, application, data, and security teams, with no single owner necessarily accountable for the overall security posture. This creates a common maturity gap: the individual pieces are owned and managed, but nobody necessarily owns the space between them.
Legacy applications set the ceiling
Applications that do not support modern authentication or current access controls prevent the same policies from being applied consistently. In those cases the gap is not a missing Entra feature. Closing it requires application modernization, compensating controls, or a different access architecture, which is a longer conversation than switching on a policy.
From Configuration to Coverage: What to Measure in Your Entra Environment
A useful assessment starts with evidence from the environment rather than assumptions about what has been deployed. Every control can be examined at five levels:
- Configured: Does the control exist?
- Enforced: Is it actively applied rather than in report-only mode or bypassed by exclusions?
- Covered: Does it apply across the full population and application estate it is meant to protect?
- Effective: Is it reducing the risk it was intended to reduce?
- Evidenced: Can the organization demonstrate that it is working?
Feature counts only ever answer the first question. For a Microsoft Entra environment, seven areas provide much of the signal.
1. Conditional Access
Look at the complete policy inventory, coverage by user population and application, exclusions, and whether legacy authentication is genuinely blocked. A statement such as « Conditional Access is implemented » says very little. A statement such as « 84% of users and 61% of applications are behind a policy requiring compliant devices and phishing-resistant MFA » provides a baseline that can be tracked and improved.
2. Privileged access
Assess role assignments, standing versus just-in-time permissions, Privileged Identity Management coverage across Entra and Azure roles, and the hygiene of emergency access accounts. The goal is not simply to have PIM enabled. It is to understand how much privileged access remains permanently available and why.
3. Device posture
Measure enrollment and compliance coverage against the policies you believe are being enforced. Most importantly, identify unmanaged devices that can still reach corporate applications or data.
4. Application access
Inventory applications and identify legacy authentication, federation dependencies, workload identities, service principals, and other access paths that may fall outside the intended Conditional Access controls. Application coverage is often where a seemingly mature identity program reveals its largest gaps.
5. Network access paths
Identify which applications and users still depend on traditional VPN access and where more identity-aware access could be introduced. For organizations using Microsoft’s security stack, Global Secure Access can become part of this transition, but the first step is understanding the access paths that exist today.
6. Governance
Review access reviews, orphaned accounts, guest access, and entitlement creep in groups with significant permissions. Governance is what prevents an initially strong access model from degrading over time.
7. Detection and response
Assess whether identity risk signals reach the teams responsible for acting on them and how quickly access can be restricted or revoked when risk is detected. A Zero Trust posture that can make a good access decision but cannot respond when identity risk changes is incomplete.
Assess Zero Trust with Microsoft’s Tools
Microsoft provides several tools and frameworks to assess Zero Trust maturity:
Microsoft’s Zero Trust Maturity Assessment quiz is a self-assessment questionnaire. It provides a quick way to align stakeholders around maturity language, but its results reflect what the person completing the questionnaire believes to be true. It is therefore better treated as a conversation starter than as evidence.
Microsoft’s Zero Trust Adoption Framework describes a lifecycle through Define Strategy, Plan, Ready, Adopt, Govern, and Manage rather than a maturity score. Microsoft’s current Security Adoption Framework (SAF) further connects security modernization to business scenarios, security disciplines, and technology pillars.
And the four-stage Traditional, Initial, Advanced, Optimal scale belongs to CISA’s Zero Trust Maturity Model, not to Microsoft.
All of them are worth running, but three limits are worth knowing before the results land on a management slide:
1. The tools score configuration, not business risk, so they cannot tell you which of your business processes are exposed or which gap to close first.
2. They stop at the Microsoft boundary, and for most enterprises the identity governance, privileged access, or customer identity platforms outside the tenant are where the unmeasured risk sits.
3. And they return findings rather than a plan with owners, dependencies, and dates. The tooling is free. Interpreting it, sequencing it, and getting the organization aligned behind the result is the work that follows.
From Baseline to a Roadmap That Gets Funded
Moving from a collection of controls to a mature posture does not require transforming everything at once. It requires a disciplined sequence: assess, prioritize, architect, pilot, roll out, optimize.
- Establish an evidence-based baseline. Determine what is actually configured and enforced in the Microsoft Entra environment rather than relying on stakeholder surveys. The baseline should identify gaps, exclusions, privileged access, device coverage, application dependencies, and the other access paths that exist in the real environment.
- Measure coverage, not feature adoption. « Conditional Access is enabled » is not a milestone. « 95% of privileged accounts use just-in-time access » or « 90% of critical applications require phishing-resistant MFA » is. Coverage metrics give security teams something to track and give leadership something they can understand.
- Close the highest-risk identity gaps first. Do not work through Zero Trust pillars because they appear in that order in a framework. That may mean eliminating standing privileged access before expanding a lower-risk control elsewhere, or addressing a legacy application that provides a path around otherwise strong identity controls. The sequence should follow risk reduction and dependency, not documentation order.
- Make exceptions and non-human identities visible. Human identities are only part of the access picture. Zero Trust must now extend beyond human identities to service accounts, workload identities, applications, and AI agents. Organizations need visibility not only into who can access a resource, but also which non-human identities can act, what they can access, and on whose behalf.
- Turn the baseline into an evidence-backed roadmap. Each major workstream needs a clear owner, a measurable coverage target, its dependencies, a realistic date, and a defined risk reduction outcome. That is what turns an assessment into a program, and it makes the conversation with leadership considerably easier. Instead of another list of security recommendations, the organization can show where it stands, which gaps matter most, what will change, and when.
The exact timeline depends on the environment. Microsoft publishes no universal duration for reaching a particular maturity level, so any roadmap timeline is an assessment of your specific starting point and dependencies rather than a Microsoft benchmark.
iC Consult: Your Expert Partner for Microsoft Entra
The objective is not a particular score. It is reaching the point where the organization can credibly answer three questions: where are we now, what matters most to fix, and how will we prove that we improved.
Microsoft has the technology. iC Consult knows how to make it work in complex enterprise identity environments.
Our Entra Assessment for Zero Trust is built to give you those answers. In a 15-day engagement, we run an automated analysis of your Entra tenant across identity, devices, data, and network, score your maturity across all seven Zero Trust pillars, and map the results against Microsoft’s Zero Trust model. You get a fact-based picture of where you stand today, plus a prioritized 12- to 24-month roadmap you can act on and take to the board.
Learn more about the assessment, as well as our other engagements in the areas of AI Agent Governance & Security, Entra ID Governance, and Entra External ID.
Identity is our specialty and sole focus. As a Microsoft Solutions Partner for Security and Modern Work, with an Advanced Specialization in Identity and Access Management, we work closely with Microsoft’s product teams to deliver solutions that work in your environment. With more than 130 specialists across the Microsoft ecosystem, we bring the deep Entra expertise a successful Zero Trust program depends on.
Ready to measure your Zero Trust posture?
Talk to iC Consult about the Entra Assessment for Zero Trust and find out which gaps matter most in your environment.
