---
name: Zero Trust Maturity Baseline
description: Scores a Microsoft 365 tenant against the AT.8xxx Zero Trust control family across five pillars, with control-level evidence pointers and uplift steps.
lastReviewed: 2026-06-02
---

# Zero Trust Maturity Baseline

> **TL;DR:** This skill scores a Microsoft 365 tenant against the AT.8xxx Zero Trust maturity control family across identity, devices, network, applications, and data, producing a five-pillar maturity table with control-level evidence pointers.

## How does the Zero Trust Maturity Baseline skill score tenant posture?

This skill establishes the current Zero Trust maturity of a Microsoft 365 tenant across the five canonical pillars — identity, devices, network, applications, and data. It assesses Microsoft Entra MFA coverage, Conditional Access, privileged identity management and agent identity governance, Intune device compliance, Private and Internet Access, application consent hygiene, and sensitivity labelling, DLP, and encryption. Each AT.8xxx control is scored with an evidence pointer so the baseline can be re-run quarterly. It supports Essential Eight ML2 evidence for Control 8.

## When should you run this skill?

- "Score Zero Trust maturity"
- "Audit Zero Trust posture against AT.8xxx"
- "Baseline our tenant before a Zero Trust uplift"
- "Build the Zero Trust scorecard for the steering committee"

## How this skill works, step by step

1. Identity pillar: assess MFA coverage, Conditional Access posture, privileged identity management, agent identity governance
2. Devices pillar: assess Intune enrolment, compliance policies, device-based Conditional Access
3. Network pillar: assess Private Access / Internet Access deployment, network segmentation, named locations
4. Applications pillar: assess application proxy use, application registration hygiene, app consent governance
5. Data pillar: assess sensitivity labelling coverage, DLP, encryption at rest and in transit
6. Score each AT.8xxx control: Traditional / Initial / Advanced / Optimal
7. Record one evidence pointer per control (report URL, query, document path)
8. Produce the scorecard below

## Output format

| Pillar | Control | Maturity | Evidence | Next Step |

Followed by:

- Pillar averages: Identity / Devices / Network / Applications / Data
- Overall maturity: Traditional | Initial | Advanced | Optimal
- Top three uplift opportunities

## Scope and safety

Read-only. This skill does NOT:

- Modify any tenant configuration (read-only)
- Replace a formal Zero Trust deployment plan
- Score third-party platforms outside Microsoft 365

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Conditional Access, MFA and Privileged Identity Management posture | Microsoft Entra ID P1 (PIM and risk-based access require P2) |
| Intune device enrolment and compliance posture | Microsoft Intune Plan 1 |
| Sensitivity labelling, DLP and encryption posture | Microsoft Purview (Microsoft 365 E5 Compliance or equivalent add-on) |

### Least-privilege roles

- Global Reader — read-only visibility across Entra, Intune and Purview configuration
- Security Reader — read Conditional Access, identity protection and security posture
- Compliance Administrator (read) — review sensitivity labels, DLP policies and encryption settings

### Microsoft Graph permissions (read-only)

- `Policy.Read.All` — read Conditional Access and authentication method policies
- `RoleManagement.Read.Directory` — read privileged role and PIM assignments
- `DeviceManagementConfiguration.Read.All` — read Intune compliance and configuration policies
- `DeviceManagementManagedDevices.Read.All` — read enrolled device compliance state
- `Application.Read.All` — read application registrations and consent grants
- `InformationProtectionPolicy.Read.All` — read sensitivity label configuration

Note: sensitivity labelling, DLP and encryption posture is reviewed via the Microsoft Purview portal and Security and Compliance PowerShell, not all of which is exposed through Microsoft Graph.

## Related skills

- [Secure Score Improvement Plan](/purview/secure-score-improvement-plan): run before this skill to rank open Secure Score actions by impact and effort.
- [Conditional Access Coverage Gap](/purview/conditional-access-coverage-gap): run after this skill to find users and apps that no Conditional Access policy protects.
- [MFA and Strong Authentication Coverage Audit](/purview/mfa-strong-auth-coverage-audit): run after this skill to close multifactor authentication gaps on the identity pillar.
- [Intune Device Compliance Baseline Gap](/purview/intune-device-compliance-baseline-gap): run after this skill to close device compliance gaps.
- [Copilot Readiness Guide](/sharepoint/copilot-readiness-guide): the pillar guide on readiness for Microsoft 365 Copilot.

## Sources and compliance

- Aligned to Microsoft's Zero Trust maturity model and the AT.8xxx internal control family
- Reference: [https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-overview](https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-overview)
- Re-baseline quarterly to demonstrate maturity progression to leadership