Cybersecurity
Zero Trust for Mid-Sized UAE Companies: A 90-Day Plan
Zero Trust is a set of decisions, not a product. This is the 90-day sequence we use to get a 100-to-500-person UAE business from a flat network and shared passwords to verified access.
5 September 2026 · Zero Trust, Identity, Network Security, Microsoft Entra
Every vendor in the UAE now sells "Zero Trust". Most mid-sized companies we meet still have a flat network, a shared admin password, a VPN that grants access to everything, and staff who can install whatever they like. Zero Trust is the discipline of closing those gaps in a sensible order. Here is the order.
The principle in one sentence
Never assume a request is safe because of where it comes from. Verify the identity, check the device, grant the minimum access needed, and assume a breach is already underway.
Days 1 to 30: Identity
Identity is the new perimeter, so start here.
- MFA for everyone, enforced through Microsoft Entra conditional access, not left to users to opt in. Use the Authenticator app with number matching; SMS is a fallback, not a plan.
- Separate admin accounts from daily accounts. Nobody reads email as a Global Administrator.
- Privileged Identity Management so admin rights are activated for a task and expire, rather than being permanent.
- Block legacy authentication (IMAP, POP, SMTP basic auth). This one change stops most credential-stuffing attacks against Microsoft 365 tenants in the UAE.
- Break-glass accounts stored offline, tested, excluded from conditional access, so you are never locked out of your own tenant.
Days 31 to 60: Devices
A verified user on a compromised laptop is still a breach.
- Enrol every company laptop and phone in Intune.
- Define a compliance policy: disk encryption on, EDR running, OS patched within 14 days, screen lock enforced.
- Add a conditional access rule: non-compliant devices cannot reach company data. Start in report-only mode for two weeks, then enforce.
- Decide the BYOD position. For most clients we allow personal phones with app protection policies and block personal laptops from anything beyond web email.
Days 61 to 90: Network and applications
Now shrink what a compromised account can reach.
- Segment the network. Servers, user devices, printers, CCTV and guest Wi-Fi go on separate VLANs with firewall rules between them. Fortinet and SonicWall both make this straightforward.
- Replace the all-access VPN with Zero Trust Network Access, publishing individual applications rather than the whole network. Microsoft Entra Private Access and FortiSASE are the two we deploy most.
- Least privilege on file shares. Audit the shares where "Domain Users" has write access and fix them.
- Application control. Standard users cannot install software. Windows Defender Application Control or Intune app restrictions make this manageable.
What you will have at day 90
Every login is verified. Every device is known and healthy. A compromised account can reach a handful of applications rather than the whole company. That is most of Zero Trust, and it costs licences you probably already own plus configuration time.
What comes after
Monitoring. Zero Trust reduces the blast radius, but you still need to see attacks that get through. That is where a managed detection and response service or a SOC comes in, and it is the subject of our next article.
Binary Minds delivers this 90-day programme as a fixed-price engagement for UAE companies on Microsoft 365. Ask us for the plan template.