Zero Trust for a Fifty-Person Company: Where to Start

Once network location stops being the gate, the sign-in becomes the gate. In practice that means Entra ID, or whichever identity provider fronts your SaaS estate, is now the most security-critical system the business owns, ahead of the firewall and probably ahead of the endpoint fleet. Every meaningful control you deploy from here hangs off the question the identity provider answers dozens of times a day: should this request, from this person, on this device, in this context, be honoured?

The first obligation identity carries is multi-factor authentication that actually resists the attacks it will face. SMS codes and simple push approvals fall to real-time phishing kits and prompt-bombing. The practical ceiling for an SMB is passkeys or FIDO2 keys for administrators and an authenticator app with number matching for everyone else. Just as important is closing the side door: legacy authentication protocols such as IMAP, POP and basic-auth SMTP ignore MFA entirely. Microsoft has been switching basic authentication off in Exchange Online in stages, but the defensible position does not rely on a vendor timetable: one conditional access policy blocks legacy authentication tenant-wide and covers whatever a migration, a multifunction printer doing scan-to-email, or a third-party client left behind.

Conditional access is the policy engine that turns identity into a perimeter. Microsoft 365 Business Premium, a plan capped at 300 seats so a fifty-person company fits with room to grow, includes Entra ID P1, which covers the policies that matter: require MFA for all users, block legacy authentication, require a compliant device for access to company data, and fence administrative sign-ins. Tenants on cheaper licensing still get security defaults, which enforce MFA broadly with no per-policy control. Either way the capability is already paid for. The real work is deciding the policy, running it in report-only mode, and reading the exceptions before you enforce.

A verified identity on a compromised laptop is still a compromise. The second signal a zero trust decision needs is whether the device making the request is one you manage, in a defensible state. For a Microsoft-centred SMB that means Intune enrolment plus a compliance policy: disk encryption on, operating system within a supported patch window, endpoint protection running, screen lock enforced. Compliance on its own is just a report. It grows teeth when a conditional access policy says company data is only reachable from a compliant device, because at that point a stolen password no longer works from an attacker's machine at all.

Personal devices deserve honesty rather than pretence. Most fifty-person companies will not enrol a staff member's own phone into full management, and should not claim to. App protection policies give a defensible middle path: corporate mail and files live inside managed applications with their own PIN and encryption, and can be wiped without touching the rest of the phone. Decide explicitly which data classes may be reached from unmanaged devices and write the decision down. The dangerous position is the accidental one, where BYO access exists because nobody ever said no.

Standing privilege is the quiet enabler of every serious incident: the account that was always a Global Administrator, the daily login that also holds admin rights, the consultant's OAuth app that still has full mailbox access two years after the campaign ended. Least privilege at SMB scale does not require a privileged access management platform. It requires separation and expiry. Administrators get a second account used only for administration, protected with the strongest MFA in the business, holding roles scoped to the actual job: Exchange Administrator, not Global Administrator. Privileged Identity Management makes elevation temporary and logged instead of permanent and invisible; it sits in Entra ID P2, one licensing step above Business Premium, and where that step is not worth taking, a scheduled quarterly review of who holds which role is the honest manual fallback.

The same logic applies at the endpoint. Local administrator rights on laptops turn every malware execution into a full device compromise, which is why restricting administrative privileges is one of the ACSC's Essential Eight strategies rather than an optional refinement. Removing local admin from daily accounts, then handling the handful of legitimate exceptions deliberately, is unglamorous work that materially shrinks what an attacker can do with a foothold. If the business is already working towards an Essential Eight maturity level, this stream and the MFA stream count double: they are zero trust moves and compliance moves in the same motion.

Sequencing matters more than ambition. A zero trust roadmap that begins with network micro-segmentation at a fifty-person company is a consulting artefact, not a plan. The order that works starts where attacks start.

Each move builds on the one before it. MFA makes identity trustworthy enough to become the perimeter. Device compliance gives conditional access a second signal worth evaluating. Privilege reduction limits the blast radius on the day something still gets through. All three are measured in weeks of effort, and all three remove more risk than any appliance the business could buy in the same quarter.

Treat zero trust as a filter for every future decision rather than a milestone to declare. When a new SaaS tool arrives, it goes behind single sign-on and conditional access or it does not come in. When someone requests admin rights, the default answer is scoped and temporary. When a vendor pitches a zero trust platform, the question is which of the three signals (identity, device, privilege) it strengthens beyond what the existing licensing already does. The honest answer is often none of them.

This is the shape of the work Black Shard does inside Azure security reviews and ongoing vCISO engagements: not installing a product called zero trust, but moving a business one enforced policy at a time towards a state where nothing is trusted for where it sits and everything is verified for what it is. A fifty-person company that makes the three moves above ends up more resilient than plenty of businesses twice its size, and it gets there on licensing it already owns.