“Least-privileged access” can sound a lot like “zero trust,” and indeed, they’re closely related but still crucially different concepts. You can think of least-privileged access like a key card you give to each of your employees that’s uniquely coded to their job function. This lets you tailor access controls so most users can access common areas like Microsoft 365, but only some can access more sensitive material, such as financial information, HR data, and so on, reducing the risk of excessive permissions leading to data breaches. Zero trust takes this a step further, not granting trust simply because an employee has a unique key card. Before granting access, a zero trust policy establishes a user’s identity and full context for the connection request, such as the user’s device, their location, the application in question, and its content. This way—to extend the metaphor—another user can’t simply pick up a key card, take on its access rights, and start getting into places they don’t belong. Read more.