The compliant network check turns network position into something your identity system asserts rather than something you maintain a list of. It is included with the licence you already hold, and it stops at a boundary that shapes every decision later in this series.
The frameworks that define Zero Trust, the Microsoft stack mapped honestly to them, and the non-Microsoft names a practitioner should recognize: Zscaler, Netskope, Palo Alto, Cato, Cloudflare, Fortinet, CrowdStrike, Okta, Illumio. Plus the one question that cuts through every vendor claim.
A strategy you cannot buy still has to show up somewhere. Here is where: the sign-in, the VPN that quietly disappears, the admin rights that expire, the office network that stops being special, and the operational loop that keeps all of it honest. The lived experience of Zero Trust, costs included.
The castle-and-moat model was a reasonable design for a world that stopped existing. Where Zero Trust actually came from, the 2010 report that flipped the mantra, Google's proof that it works at scale, and the destination: every access is a per-session decision, made on evidence, by a policy engine.
Nobody sells Zero Trust, including the vendors who say they do. Microsoft says so on its own documentation, NIST needed 24 organizations and 19 distinct builds to demonstrate one, and the man who coined the term has spent a decade saying you cannot buy it. What you can do is practice it.
The pre-flight checks with their expected silence, the second controller then the last with the right flags, the insurance image, the tenant-side cleanup in order, and the stale-device sweep with the warning that saves a machine's recovery keys. The commands for the one stage that does not undo.
The last stage, and the one with a point of no return. An observation window and a scream test, the order of operations, the things that fail silently on their own schedule, and the go or no-go a consultant would actually sign. The build sheet handles the commands; this article handles the judgment.
Before you power anything off, one more census. The domain controllers carry quiet jobs that have nothing to do with logins: DNS, DHCP, time, the identity detection surface, the last stragglers still speaking old protocols. Stage 5 is the readiness check that stops a premature power-off.
