# Analysis of Azure Zero Trust Architecture Implementation for Mid-Size Organizations
## 5 Experimental Setup and Study Methodology
### Azure Conditional Access with MFA and SSPR  
Azure Entra ID Conditional Access is crucial to Microsoft's identity and access management service. It helps companies efficiently manage and protect access to their applications and data. Organizations can employ this capability to implement automatic access control decisions based on pre-established regulations. These policies enable administrators to create specific access rules and criteria, ensuring only authorized users can access sensitive information. Conditions may include several elements such as user characteristics, device adherence, geographical location, and amount of danger. Organizations can enhance security by combining several measures, such as implementing MFA, restricting access to specific locations, or enforcing device compliance checks. This high level of exact control enhances security by ensuring that access is granted only when specified conditions are met, thereby preventing unauthorized entrance and improving overall security. For CA to work, we need to meet specific requirements:  
* We need to turn off security defaults;
* We need to disable per-user MFA;
* We need a license that supports it (Business Premium, Entra ID P1 or P2). After we activate the required license, Azure UI takes us to the Microsoft 365 Admin Center, where we obtain the list of available permits and, if we are using a trial license, when the trial is valid. We can turn off the security defaults and start configuring Conditional Access Policies there. To ensure a secure environment, the organized Azure Conditional Access regulations will commence with implementing MFA for all users. This strategy aimed to diminish dependence on password-based security, which is vulnerable to brute force attacks. Conditional Access rules dynamically adjust access constraints by integrating contextual information, including device health, user location, and risk scores. This setup was chosen as it improves security while allowing flexibility in user access to resources. For Company X, these regulations were particularly beneficial in facilitating hybrid work situations, wherein people often use cloud resources from various devices and networks. So, after we obtain to the Home/Default Directory/Conditional Access tab, we can select the following blade from the UI as shown in Figure 3:There is a \"Zero Trust\" tab available here, with a selection of templates to use for ZTA implementation, as we can see in Figure 4:  
We can quickly check which Conditional Access Policies are enabled for our tenant, as can be seen in Figure 5:  
Figure 4: Selecting Zero Trust template available for configuration in Conditional Access in Azure. Figure 5: Enabling Central Access Policies. Figure 3: Configuring MFA as a mandatory Conditional Access Policy from a template. After enabling this specific Central Access Policy, we will obtain a familiar message when dealing with MFA on Azure, as we can see in Figure 6:  
Now that we have the basic Central Access Policy, we must add additional security measures to follow the ZTA architecture. In this regard, Microsoft recommends implementing additional risk policy configurations to protect our environment, specifically the User and Sign-in risk policies. User risk policy requires a secure password change if a user's risk level is detected as high. MFA is required before a password change is doable, so we first enforced the MFA policy on all users, as this significantly increased the baseline security level. The Sign-in risk policy requires MFA if a sign-in risk level is detected as medium or high. This way, the user can prove they are while trying to sign in. It is good practice to have some emergency access or a break-glass account(s) during these implementations so we do not lock ourselves out of our tenant. Let us first configure the Sign-in policy, as we can see in Figure 7:  
By having a break-glass account, we can target our policy so we would not lock ourselves out of the environment.