Zero trust architecture means no user, device or network location is trusted by default, and every request to reach an application gets evaluated at the moment it is made. In practice, an MSP building one for a Chicago business is doing five things: putting phishing-resistant multi-factor authentication on every account, blocking the legacy protocols that bypass it, requiring a managed and compliant device before an application will open, cutting standing administrative privilege down to a handful of accounts, and replacing the flat VPN tunnel with per-application access.
That is the whole idea. The rest of this is what it costs you in effort, what it breaks on the way in, and where projects stall.
What does zero trust actually mean, past the marketing?
The definition worth using is NIST SP 800-207, published in 2020. It describes a policy decision point that evaluates every access request against identity, device state and context, and a policy enforcement point that lets the session through or does not. No implicit trust from being inside the building. No implicit trust from being on the VPN.
CISA’s Zero Trust Maturity Model version 2.0 breaks the same idea into five pillars: identity, devices, networks, applications and workloads, and data. It grades each one across four stages, from traditional through initial and advanced to optimal. That model matters for one practical reason. It gives you a way to say where you actually are instead of claiming you either have zero trust or do not. Nobody has all five pillars at optimal. Many mid-market companies are at traditional on devices and initial on identity.
Zero trust is not a product. Any vendor selling you “a zero trust platform” is selling you one pillar. RJ2 first published its overview of the zero trust security model in 2021, and that guide is still available here: https://rj2t.com/wp-content/uploads/2021/11/zero-trust-security-model.pdf
What does the rollout actually include?
Here is the order that works, roughly. Each step depends on the one before it.
1. Inventory the identities first. Every human account, every service account, every shared mailbox with a password, every vendor account, every account belonging to someone who left. This step is boring and it is where projects find the worst surprises. A 90-person company routinely has 140 enabled accounts.
2. MFA on everything, including administrators. Push-approval MFA is the floor, not the goal. Push bombing works, which is why Microsoft made number matching the default in the Authenticator app in 2023. Phishing-resistant methods, meaning FIDO2 security keys, Windows Hello for Business, or certificate-based authentication, are what actually stop an adversary-in-the-middle phishing kit. Those kits steal the session cookie after you approve the prompt, so the MFA happened and the attacker still got in.
3. Block legacy authentication. POP, IMAP, SMTP AUTH and old Exchange Web Services connections do not understand conditional access and never will. Microsoft retired basic authentication in Exchange Online in October 2022, but SMTP AUTH lives on for copiers, scanners and line-of-business apps that email invoices. Find those first. Every one of them is a bypass.
4. Conditional access policies. In Microsoft Entra ID this needs Entra ID P1, which is included in Microsoft 365 Business Premium and E3. Risk-based policies, meaning sign-in risk and user risk, need P2. If you are on Business Premium you also have to turn off security defaults before conditional access policies will apply, and turning off security defaults with nothing behind it yet is how people get hurt.
5. Device compliance. Requiring a compliant device is the step where zero trust stops being an identity project. In Intune that means enrollment, a compliance policy with real conditions like disk encryption, a running EDR agent and a minimum OS build, and then a conditional access grant control that requires it. This is also the step that breaks personal laptops and contractor machines, which is a business decision, not a technical one.
6. Cut standing privilege. Microsoft’s own guidance is fewer than five permanent Global Administrators. Just-in-time elevation through Privileged Identity Management needs Entra ID P2. If P2 is not in the budget, the fallback is separate named admin accounts with no mailbox and no license, which is worse but is far better than daily-driver accounts holding Global Admin.
7. Replace the VPN. Per-application access, sometimes sold as ZTNA, gives a user a path to one application instead of a route onto the network. Cisco Secure Access, Cloudflare Access, Zscaler Private Access, Twingate and Tailscale all do a version of this. For a company under 250 people this is often the step with the highest ratio of risk removed to effort spent, because the flat VPN is usually the single widest door in the building.
8. Log it, and keep the logs. A policy you cannot audit is a policy you cannot prove to an insurer.
What breaks, and what does it cost in time?
Something always breaks. The honest list:
- The scanner in the copy room that emails PDFs and only speaks SMTP AUTH.
- The line-of-business app whose vendor supports one authentication method and it is the wrong one. Manufacturing and healthcare are full of these.
- BYOD. The day you require a compliant device, every personal phone and home laptop stops working until it is enrolled or explicitly excepted.
- Contractors and outside accountants, who need a defined access path that nobody built yet.
- Break-glass accounts. You need two emergency accounts excluded from every conditional access policy, with long random credentials, hardware keys, and alerting on any sign-in. Skipping this is how an organization locks itself out of its own tenant on a Friday night. It happens more than anyone admits.
Timeline for a company of 50 to 250 seats, running Microsoft 365, with one IT person or none: identity and MFA work in the first 30 to 60 days, device compliance over the following 60 to 120 days once enrollment is real, VPN replacement after that. Call it 6 to 12 months to get to a defensible position across identity, devices and network access. Anyone quoting six weeks is quoting an MFA rollout and calling it zero trust.
What does this look like for a small or mid-market business in the Chicago area?
The pattern in the Chicago suburbs is specific enough to plan around. A manufacturer in the northwest suburbs has 60 office users on Microsoft 365 and a shop floor with machines running embedded Windows that will never take an agent and cannot be patched without voiding a support contract. Those machines do not get zero trust. They get a segmented VLAN, no internet egress, and an access control list that says which two workstations may talk to them. That is the realistic answer and it is worth putting in writing for the auditor, because “we could not, so we contained it” is an acceptable finding and “we did not look” is not.
A professional services firm downtown in Chicago has a different problem. Everyone is hybrid, half the staff works from home two days a week, the data is client files in SharePoint, and the pressure comes from a client security questionnaire or a cyber insurance renewal that now asks whether MFA covers email, remote access and administrative accounts as three separate questions. For that firm, conditional access plus phishing-resistant MFA for the partners and the finance team is most of the answer, and device compliance can follow.
The failure mode we see across both is the same. Somebody enabled MFA in 2021, checked the box on the insurance form, and nothing has been touched since. Legacy authentication is still open, four people still hold Global Admin, and the VPN still drops remote users onto a flat network.
RJ2 Technologies has been in business since October 1998, is headquartered in Deer Park, and serves businesses across Chicagoland, Northern Illinois, southeastern Wisconsin and northwestern Indiana. Cisco Duo appears in our stack for multi-factor. More on how this fits the rest of the security program is on our cyber security services page, and the industry-specific version, including what manufacturing and professional services get asked for, is in Cybersecurity for Regulated Industries.
What does zero trust not fix?
It does not fix a user who is legitimately authenticated on a compliant device and clicks the wrong thing. It does not fix a vendor breach. It does not fix bad backups, and it will not restore your data. It reduces blast radius and it makes lateral movement expensive, which is worth a great deal, and it is not a substitute for endpoint detection, email filtering or a tested recovery plan.
FAQ
What is zero trust architecture in simple terms?
It is a design where nothing is trusted because of where it sits. Every request to reach an application is checked against who the user is, what device they are on, and whether the context looks normal, every time. The formal definition is NIST SP 800-207.
Is zero trust the same as multi-factor authentication?
No. MFA is one control inside the identity pillar. Zero trust also covers device health, least privilege, per-application network access and logging. MFA alone is where most companies stop, and it is roughly a fifth of the work.
How long does a zero trust rollout take for a small business?
For 50 to 250 users on Microsoft 365, expect 6 to 12 months to cover identity, devices and network access properly. Identity and MFA can be done in the first 30 to 60 days. Device compliance takes longer because enrollment touches every machine.
Do we need Microsoft E5 licensing for zero trust?
No. Conditional access needs Entra ID P1, which comes with Microsoft 365 Business Premium and E3. P2 adds risk-based policies and just-in-time admin elevation through Privileged Identity Management, which are valuable but not required to start. Confirm current licensing terms before you buy, because Microsoft has moved these more than once.
Will zero trust lock our people out?
It can, and that is why you build two break-glass accounts excluded from every policy, roll policies out to a pilot group first, and run every new policy in report-only mode before enforcing it. Locking the administrators out of the tenant is a real and preventable outcome.
Does our cyber insurance require zero trust?
Carriers do not usually ask for “zero trust” by name. They ask whether MFA covers email, remote access and privileged accounts, whether EDR is deployed, and whether backups are tested. Those are zero trust components under different names, and the application asks them separately for a reason.