What Zero Trust Means for an MSP
The assumption zero trust replaces stopped being true for most MSP clients. Remote work, cloud services and third party access mean there is no longer a meaningful inside, and a model that trusts location trusts whatever has reached that location, including an attacker on a compromised laptop. NIST describes zero trust as moving defenses from network perimeters to users, assets and resources, with no implicit trust based on network location.
Start at home. Named admin accounts with MFA, access to client tenants through delegated admin relationships rather than stored global admin passwords, and just in time elevation for your technicians close the path that would let one stolen login reach every client. Clients increasingly ask about this in security questionnaires, so doing it first also gives you a better sales story.
It applies to your MSP as much as to clients. Your RMM, PSA and admin accounts can reach every client you serve, which makes your own access the first place to apply it.
It Is Not a Product
The common misunderstanding is treating zero trust as something to install. There is nothing to buy that makes an environment zero trust; it is a set of decisions about identity, device health and least privilege, applied over time to systems built assuming the opposite. A vendor selling you zero trust is selling you one component of it.
| Pillar | What the MSP actually does |
|---|---|
| Identity | MFA everywhere, conditional access, no shared admin accounts. |
| Devices | Only managed, compliant devices reach client data; BYOD gets limited access. |
| Least privilege | Remove standing local admin rights and grant elevated access only when needed. |
| Monitoring | EDR or XDR signals feed access decisions and investigations. |
Where to Start With Clients
- Get MFA coverage close to complete, including service and admin accounts.
- Audit local administrators with the local admins script and remove what is not needed.
- Disable stale accounts with the stale AD accounts script.
- Replace broad VPN access with per application access for the systems that matter most.
- Put the roadmap on the QBR agenda so it is funded as a series of projects.
Zero trust sells best as a multi quarter roadmap rather than a single project. Each step reduces risk on its own, and frameworks like CMMC and SOC 2 ask for many of the same controls, so the work compounds. Clients in regulated industries tend to fund it fastest, because the controls double as audit evidence.
Measure progress the same way each quarter so the client sees the risk falling, not just the invoices rising.
Common Questions
Does zero trust mean getting rid of the VPN?
Often eventually, but not on day one. Many MSPs shrink VPN use gradually by moving key applications to identity based access first.
Is Microsoft 365 enough for zero trust?
Its higher license tiers cover much of identity and device control through conditional access and device management. Gaps usually remain in privileged access and legacy systems.
How do I charge for zero trust work?
Price the roadmap as scoped projects, then raise the managed rate to cover the ongoing policy and access reviews.
Does zero trust annoy end users?
Badly configured policies do. Well tuned conditional access prompts rarely on trusted devices and only asks more when risk rises.