Microsoft Zero Trust Assessment: analysing and improving your tenant's security posture

Introduction

The Zero Trust model has become the architectural reference for security in cloud and hybrid environments: there is no longer a network that is “trusted” by definition; every access must be continuously verified, regardless of location, user or device.

To support organisations on this journey, :contentReference[oaicite:0]{index=0} provides the Microsoft Zero Trust Assessment, an official tool that analyses the configuration of a Microsoft 365 tenant and assesses how well it aligns with Zero Trust principles.

In this article we will look at:

• what the Microsoft Zero Trust Assessment is and what it is for;
• the prerequisites needed to run it;
• how to install and run the assessment with PowerShell;
• how to read and make proper use of the final results.

What the Microsoft Zero Trust Assessment is

The Microsoft Zero Trust Assessment is a read-only analysis tool, distributed as a PowerShell module, that runs a series of checks on the tenant configuration by querying Microsoft Graph and Microsoft Azure.

The assessment checks settings related mainly to the following pillars:

• Identity
• Devices

and compares the tenant’s current state with Microsoft’s recommendations as described in the Zero Trust model.

The output is a detailed, navigable local HTML report that highlights:

• passed or failed checks;
• the associated risk level;
• remediation recommendations for each test.

It is important to make clear from the outset that:

the assessment does not apply any changes automatically and does not “certify” the tenant’s security; it provides a technical snapshot of the current state.

What the Microsoft Zero Trust Assessment is for

The tool is designed to support technical and architectural decisions, not to replace them.

In particular, the Microsoft Zero Trust Assessment lets you:

• identify security gaps in the tenant configuration;
• assess your current Zero Trust maturity level;
• get concrete, context-specific technical recommendations;
• create a baseline to start from for a progressive improvement plan;
• measure how your security posture evolves over time by re-running the assessment.

Its main value is not the “score”, but the quality of the information that comes out of the individual checks.

Prerequisites

Before running the assessment you need to check a few key prerequisites.

Technical requirements

• PowerShell 7 installed (Windows, Linux or macOS).
• Connectivity to Microsoft Graph and Microsoft Azure.

Required roles

• First run: an account with the Global Administrator role, needed to grant permissions to the Microsoft Graph PowerShell app.
• Subsequent runs: the Global Reader role is sufficient.

If an earlier version of the Zero Trust Assessment module is present on the system, it must be completely removed before proceeding.

Installing the Zero Trust Assessment module

Open a new PowerShell 7 session and run:

Install-Module ZeroTrustAssessment -Scope CurrentUser

The module uses Microsoft Graph PowerShell and, on first use, asks for consent to a set of read-only permissions needed to analyse identities, devices, policies and security configurations.

Connecting to Microsoft Graph and Microsoft Azure

To start the assessment you need to authenticate:

Connect-ZtAssessment

During this step:

• you are asked to consent to the Microsoft Graph permissions;
• a second sign-in window opens for Microsoft Azure;
• if no Azure subscription is available, the tests that depend on Azure logs are simply skipped.

The module does not change any tenant configuration.

Running the assessment

Once authentication is complete, start the assessment with:

Invoke-ZtAssessment

Main characteristics of the run:

• read-only process;
• data is saved locally;
• on large tenants the run can take several hours (in some cases more than 24 hours);
• the assessment must not be interrupted while it is running.

When it finishes, the report is generated: .\ZeroTrustReport\ZeroTrustAssessmentReport.html

The file opens automatically in the default browser.

⚠️ The report contains sensitive information about the tenant: it must be stored securely and shared only with authorised staff.

You can specify a custom path with the -Path parameter.

Analysing the results

The report is organised into several sections.

The Overview tab gives a high-level view of the tenant’s Zero Trust status. The Identity and Devices sections show the detailed list of tests run, with:

• check status (Pass / Fail / Warning);
• risk level;
• technical description of the test;
• remediation recommendations.

By selecting an individual check you can see:

• what was verified;
• why it matters from a Zero Trust perspective;
• which corrective actions are suggested.

How to act on the final results

A common mistake is treating the assessment as a checklist to be completed 100%. In reality, the results need to be put into context with respect to:

• the size of the organisation;
• business requirements;
• operational and licensing constraints;
• the acceptable risk model.

An effective approach is to:

• start with high-impact, low-complexity recommendations;
• fold the remediations into a structured security plan;
• document any deliberate decision not to apply certain recommendations;
• re-run the assessment periodically to measure progress.

Zero Trust is a continuous journey, not an end state.

Conclusion

The Microsoft Zero Trust Assessment is an extremely useful tool for anyone who wants to tackle Zero Trust in a concrete, measurable way that is aligned with Microsoft best practice. Used properly, it becomes a reliable technical guide for progressively improving the security posture of your Microsoft 365 tenant, supporting architectural and governance decisions based on real data.