Zero Trust and Conditional Access for SA Government agencies and councils

Zero Trust is now a familiar phrase in South Australian agency and council ICT strategies. The idea is simple: never trust a user, device or network solely because it sits inside the organisation, and verify every request. In practice for most SA organisations that already run Microsoft 365, Zero Trust starts with Microsoft Entra ID and Conditional Access, not with a rip-and-replace of the network. This guide explains what Zero Trust means in an Entra-centric estate, the controls that matter for Essential Eight and SA ISMF expectations, the failure modes that trip up rollouts, and a practical 90-day plan. It is general guidance, not legal or security certification advice.

What Zero Trust actually means here

Zero Trust is a set of design decisions, not a product. For an SA agency or council whose staff work in Microsoft 365, Azure and a handful of line-of-business apps, the decisions that matter most are:

• Verify explicitly. Every sign-in is evaluated: who the user is, whether multi-factor authentication succeeded, whether the device is managed and healthy, where the request came from, and the risk signal on the session.
• Use least privilege. Standing admin rights disappear. Privileged Identity Management (PIM) grants elevation for a short window, and access reviews revoke what people no longer need.
• Assume breach. Session lifetimes are short, tokens can be revoked, sensitive actions re-prompt for stronger authentication, and monitoring looks for unusual access rather than trusting the perimeter.

Network segmentation, micro-segmentation and private connectivity still matter for servers and data platforms. For day-to-day staff access to email, Teams, SharePoint and SaaS apps, Conditional Access is usually the highest-leverage place to start, because it sits in front of almost every modern application that federates with Entra ID.

How Conditional Access puts Zero Trust into practice

Conditional Access is the policy engine in Microsoft Entra ID. On each sign-in it can require MFA, require a compliant or hybrid-joined device, block legacy authentication, restrict access by location or named network, demand a passwordless or phishing-resistant factor, or force a higher assurance when sign-in risk is elevated. A practical baseline for an SA public-sector tenant looks like this:

1. Block legacy authentication for every user except a documented, time-limited exception list. Legacy protocols bypass MFA and remain a common attack path.
2. Require MFA for all users, including executives and elected members who access corporate systems, with phishing-resistant methods (passkeys, FIDO2 or certificate-based authentication) preferred for privileged roles.
3. Require a compliant or managed device for access to Microsoft 365 and admin portals from staff accounts. Unmanaged phones can still use app protection policies (Intune MAM) so corporate data stays in managed apps without full device enrolment.
4. Restrict admin portals to compliant devices, named locations or privileged access workstations, and put every privileged role behind PIM with MFA on activation.
5. Use risk-based policies where licensing allows, so a risky sign-in must remediate (password change or MFA) before access continues.
6. Keep break-glass accounts outside Conditional Access, stored offline, monitored, and tested. An IdP misconfiguration must not lock every administrator out.

The identity and single sign-on reference architecture and the secure Microsoft 365 workplace architecture in our Learn section show how these controls sit beside federation, SCIM provisioning and device management.

Why this matters for Essential Eight and SA ISMF

Buyers and auditors rarely ask for “Zero Trust” as a slogan. They ask for evidence that aligns with frameworks you already work to:

• ACSC Essential Eight. Multi-factor authentication, restricting administrative privileges and patching/application control on endpoints map directly onto Conditional Access, PIM and Intune compliance. See our Essential Eight guide for SA SMEs for how suppliers evidence this.
• SA ISMF. Agencies expect suppliers and internal ICT to demonstrate access control, privileged access management and continuous monitoring. Conditional Access policies, access reviews and sign-in logs are concrete artefacts. Our ISMF guide for ICT suppliers covers how this shows up in RFTs.
• Privacy and classification. Stronger identity reduces the chance that personal or classified information is opened from an unmanaged device or a compromised password. Pair it with sensitivity labels and DLP when you prepare for tools such as Copilot (see Copilot readiness).

Design decisions and trade-offs

• Compliant device vs app protection only. Full Intune enrolment gives the strongest control and is right for staff laptops. For BYOD phones, app protection without enrolment is often the workable compromise; blocking unmanaged mobile access entirely can push people onto shadow IT.
• Named locations. Marking council or agency egress IPs as trusted can reduce MFA prompts on site, but a compromised account on that network still gets an easier path. Prefer “trusted location reduces friction, never removes MFA for privileged roles”.
• Guest and partner access. Cross-tenant access settings and Conditional Access for guests matter for contractors working on tenders, projects and shared Teams. Default guest settings are usually too open for public-sector work.
• Licensing. Baseline Conditional Access needs Microsoft Entra ID P1 (included in Microsoft 365 Business Premium and many E3 plans). Risk-based Conditional Access, PIM and access reviews typically need P2 or the equivalent Microsoft 365 E5 Security add-on. Confirm current packaging before you budget.
• Passwordless. Moving privileged users to passkeys or FIDO2 keys removes phishing of one-time codes. Plan enrolment, backup factors and lost-device recovery before you make it mandatory.

Failure modes to plan for

• Locking yourself out. A policy that requires compliant devices for all admins, deployed before any device is enrolled, is a classic outage. Use report-only mode, staged groups and tested break-glass accounts.
• Service accounts and legacy apps. RPA bots, scanners and older line-of-business apps that cannot do modern auth need a documented exception with owners and an expiry, not a permanent hole.
• Elected members and shared devices. Councillors may use personal devices and shared chambers PCs. Design separate policies and clear guidance rather than forcing a staff laptop model that will be bypassed.
• Conditional Access gaps via legacy protocols. If IMAP, POP or older Office clients remain enabled, MFA policies are only as strong as the weakest protocol. Block legacy auth early.
• No monitoring. Policies without sign-in log review, alerts on break-glass use and periodic access reviews drift within months.

A practical first 90 days

1. Weeks 1 to 3: discover and protect the keys. Inventory admin roles, create and test break-glass accounts, enable unified audit logging, turn on MFA for all admins with phishing-resistant methods where possible, and put Global Administrator and other high-privilege roles into PIM.
2. Weeks 4 to 6: baseline policies in report-only. Draft policies for MFA for all users, block legacy authentication, and require compliant devices for Microsoft 365. Run them in report-only mode, fix the accounts and apps that would have been blocked, then enforce in waves (IT first, then pilots, then everyone).
3. Weeks 7 to 10: devices and guests. Enrol staff laptops in Intune (or confirm hybrid join), apply app protection to BYOD phones, tighten guest invitation and cross-tenant settings, and require MFA for guest access to corporate resources.
4. Weeks 11 to 12: harden and evidence. Add risk-based policies if licensed, schedule quarterly access reviews for privileged and sensitive groups, document exceptions with owners and expiry dates, and capture screenshots and exports that map to Essential Eight and ISMF evidence your auditors or tender responses will need.

Do not flip every control on the same day. Report-only mode and staged groups are how mature tenants avoid a help-desk crisis.

Identity controls protect the mailbox itself; they do not stop criminals sending messages that pretend to come from your domain. Pair this work with SPF, DKIM and DMARC, covered in our guide to email security for SA councils and small businesses.

Questions to ask before you engage anyone

1. Will you start in report-only mode with staged groups, or enforce immediately?
2. How will break-glass accounts be created, stored, monitored and tested?
3. Which licences do we already have for Conditional Access, PIM and risk-based policy, and what must we add?
4. How will elected members, contractors and BYOD phones be treated without creating a permanent exception?
5. How will legacy and service accounts be inventoried and given owners with expiry dates?
6. What evidence pack will we keep for Essential Eight and SA ISMF assurance?
7. Who will own ongoing access reviews and sign-in monitoring after the project ends?

This article reflects common practice as at late 2026. Microsoft Entra features, licensing and Australian Government cyber guidance change, so confirm current details with vendor documentation, the ACSC and your advisers before committing.

Talk to an Adelaide team

If you want Conditional Access and Zero Trust controls that staff can live with and auditors can evidence, talk to us about an identity and access review or call 0402 401 584. We can start with a short, fixed-price review of your Entra policies, admin roles and device posture that produces a prioritised plan you can use with any supplier. You can also read about our managed IT and cyber security and cloud and DevOps services.