Page 1 of 3

ZERO TRUST READINESS ASSESSMENT

For 100–1,000 User Tenants

Instructions for respondent: Answer honestly based on your current Microsoft 365 environment not planned improvements.

1. How is MFA enforced for privileged roles (admins)?

*

1. How is MFA enforced for privileged roles (admins)?

A

No MFA enforced consistently

B

MFA enforced for Global Admin only

C

MFA enforced for most admin roles

D

MFA enforced for all roles and entry points

2. Is legacy authentication blocked in your tenant?

*

2. Is legacy authentication blocked in your tenant?

A

Not blocked

B

Partially blocked or in progress

C

Blocked via Conditional Access, not verified

D

Fully blocked and verified via sign‑in logsd

3. How are break‑glass (emergency access) accounts handled?

*

3. How are break‑glass (emergency access) accounts handled?

A

None exist

B

Created but not documented or tested

C

Created and documented, rarely tested

D

Created, documented, excluded from CA, and tested regularly

4. How are privileged roles assigned?

*

4. How are privileged roles assigned?

A

Standing access for most admins

B

Partial use of PIM or role reviews

C

PIM for most roles with manual reviews

D

PIM enforced for all eligible roles with regular reviews

5. How are Conditional Access (CA) policies designed?

*

5. How are Conditional Access (CA) policies designed?

A

Ad hoc or copied from templates without modification

B

Policies per app or scenario with limited consistency

C

Policies designed by security intent

D

Minimal, well‑structured policies with clear documentation

6. How are new CA policies introduced?

*

6. How are new CA policies introduced?

A

Enforced immediately

B

Tested manually before enforcement

C

Started in Report‑Only, reviewed manually

D

Report‑Only with structured review and impact analysis

7. Are administrator and user access policies separated?

*

7. Are administrator and user access policies separated?

A

No separation

B

Partial separation

C

Mostly separated with exceptions

D

Fully separated with tailored enforcement

8. How often are CA policies reviewed?

*

8. How often are CA policies reviewed?

A

Never or rarely

B

Ad‑hoc or after incidents

C

Periodic but undocumented

D

Monthly reviews with owners documented

9. How are devices used to control access to M365?

*

9. How are devices used to control access to M365?

A

Devices not factored into access decisions

B

Device registration used inconsistently

C

Compliance or join state used in some policies

D

Device trust consistently enforced and monitored

10. How mature is your Intune deployment?

*

10. How mature is your Intune deployment?

A

Not deployed or lightly used

B

Basic enrollment only

C

Compliance and configuration policies deployed

D

Compliance, remediation, and exception handling mature

11. How do you handle unmanaged or BYOD devices?

*

11. How do you handle unmanaged or BYOD devices?

A

Full access allowed

B

Informal or undocumented restrictions

C

Browser‑only access via CA

D

Explicit policy with monitoring and user guidance

12. Are access policies validated across platforms?

*

12. Are access policies validated across platforms?

A

Windows only

B

Windows + limited macOS/mobile

C

All platforms tested but inconsistently

D

Windows, macOS, iOS, and Android verified

13. Are sensitivity labels implemented?

*

13. Are sensitivity labels implemented?

A

Not implemented

B

Too many labels, low adoption

C

Limited labels with partial enforcement

D

Few labels with enforced protection and adoption

14. How is external sharing controlled?

*

14. How is external sharing controlled?

A

Open by default

B

Policy exists but rarely reviewed

C

Restricted with exceptions

D

Risk‑based and regularly reviewed

15. How is DLP used today?

*

15. How is DLP used today?

A

Not implemented

B

Alert‑only without enforcement

C

Targeted enforcement with tuning

D

Aligned with identity and sensitivity strategy

16. Are audit logs retained long enough for incident response?

*

16. Are audit logs retained long enough for incident response?

A

Default retention only

B

Extended retention, rarely reviewed

C

Retention aligned with policy

D

Retention validated against incident scenarios

17. How quickly could you investigate a compromised user?

*

17. How quickly could you investigate a compromised user?

A

Not confident

B

>48 hours

C

24–48 hours

D

<24 hours with documented process

18. Are Zero Trust controls documented and owned?

*

18. Are Zero Trust controls documented and owned?

A

No documentation

B

Partial documentation

C

Documented but not actively maintained

D

Owned, reviewed, and updated regularly

19. How aligned is security enforcement with business reality?

*

19. How aligned is security enforcement with business reality?

A

Users regularly bypass controls

B

Frequent exceptions required

C

Occasional friction manageable

D

Security rarely blocks productivity

20. Overall confidence in your Zero Trust posture?

*

20. Overall confidence in your Zero Trust posture?

A

Low - reactive and fragmented

B

Improving but inconsistent

C

Structured but not fully enforced

D

Intentional, enforced, and monitored