Zero Trust Remediation Planner

Answer the same questions as the Zero Trust Scorecard and get a prioritised remediation runbook — with step-by-step instructions, admin portal links, and effort estimates for every gap identified.

Identity & MFA

How identities are secured and whether MFA can withstand modern phishing attacks.

How many Global Admin accounts exist?

Are admin accounts separated from standard user accounts?

What type of MFA is enforced for admin accounts?

Phish-resistant = FIDO2 keys, WHfB, passkeys, CBA. Standard = push, OTP, SMS, phone call.

What type of MFA is enforced for standard user accounts?

MFA registration coverage across enabled accounts?

Conditional Access

Policies that govern how and when access is granted.

Is Conditional Access used?

Is legacy authentication blocked?

Are admin portals restricted?

Risk-based Conditional Access policies?

Device compliance required for access?

Session controls configured?

Privileged Access

How privileged roles are managed, scoped, and reviewed.

Is PIM (Privileged Identity Management) used?

Regular access reviews in place?

Break-glass accounts documented and tested?

Scoped admin roles used instead of Global Admin?

Device & Endpoint

Device identity, management, and access restrictions.

Devices required to be Entra ID joined?

MDM (Intune) enforced?

Unmanaged devices restricted?

Data Protection

Classification, labelling, and data loss prevention.

Sensitivity labels in use?

DLP policies configured?

About this tool

How Zero Trust Remediation Planner works

Answer the Zero Trust Scorecard's questions on identity and MFA, Conditional Access, privileged access, devices and endpoints, and data protection. For every gap the planner adds a task, in priority order: for example enforcing MFA for admin accounts, blocking legacy authentication, setting up Privileged Identity Management or creating break-glass accounts.

Each task has the steps to follow, links to the right admin portal and an effort estimate, so you can turn it into a project plan.

Questions

Does it connect to my tenant?

Nothing. You answer questions from what you know about your tenant, or can check in the admin centres; the tool doesn't sign in to Microsoft 365 or read anything from it.

Where do my answers go?

Your answers stay in your browser and are worked out there. The site only counts, anonymously, that the tool was opened, finished or downloaded.

How is it different from the Zero Trust Scorecard?

The scorecard tells you where you stand, with a score per pillar. The planner takes the same answers and gives you the work to do, task by task.

Related tools