One Zero Trust design. An entire hybrid estate.

The situation

A hybrid estate brings together different identities, devices and ways of working. For an energy services organisation, the security architecture needed to span 7,000 endpoints and 900 servers. The challenge was to bring those moving parts into one Zero Trust design: a set of decisions that would remain coherent across the estate, rather than a collection of individual product deployments.

The decision

I approached identity, access and detection as parts of the same architecture. The starting point was the decision an organisation needs to make whenever someone accesses a resource: what should be trusted, what needs to be verified, and what evidence should inform that decision? That framing made it possible to connect the security controls to the work they needed to support.

Making it work

The design brought together Microsoft Entra ID, multi-factor authentication, Defender for Cloud Apps, Microsoft Sentinel and Defender for Identity. Each had a part to play in the wider system. The architectural work was in making their roles clear and their use consistent, so identity protection, access decisions and security monitoring supported a common approach across the hybrid environment.

The result

The result was one Zero Trust security design covering 7,000 endpoints and 900 servers. That is a measure of the scope of the architecture, rather than a claim that deploying these controls removes all risk. The useful outcome was a coherent basis for making security decisions across a large estate, with identity and detection considered together.

What I took forward

Zero Trust is most useful when it describes how an organisation makes decisions. A product list alone cannot do that. The lesson I carry into other engagements is to make the secure path workable for the people who operate it: give controls a clear purpose, explain how they fit together, and keep the architecture understandable as the estate changes.