> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scaliocloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Enforcing Zero-Trust Identity Principles in Scalio Nexus
> Learn how Nexus enforces zero-trust across your Entra estate — verifying every identity, applying least-privilege, and designing for breach resilience.
Zero trust is a security model built on three core principles: verify explicitly, use least-privilege access, and assume breach. Rather than trusting users or devices by virtue of their network location or a single credential check, zero trust requires continuous validation of identity, intent, and context. Scalio Nexus translates these principles into concrete checks and controls across your Microsoft Entra environment — so you're not just adopting a philosophy, you're enforcing it.
## Verify explicitly
The first zero-trust principle demands that every access request be authenticated and authorized using all available signals, not just a username and password. Nexus enforces this principle across your entire Entra estate by continuously checking the strength and coverage of your authentication controls.
* **MFA registration tracking.** Nexus reports the MFA registration status of every user in your tenant, broken down by authentication method. You can immediately see which users have no method registered and act before those accounts become a vector for compromise.
* **Conditional access coverage gaps.** Nexus maps your conditional access policies against your user population and application portfolio, then surfaces gaps where users or apps are excluded from policies that require strong authentication.
* **Weak or absent authentication methods.** Accounts still using SMS-only MFA, or accounts with no authentication method at all, are flagged as findings so you can enforce stronger options such as passkeys or Microsoft Authenticator.
* **Sign-in risk and unusual access patterns.** Nexus integrates with Entra ID Protection to surface risky sign-in events and flag accounts where unusual access patterns — such as impossible travel or unfamiliar locations — indicate potential compromise.
## Use least-privilege access
The second zero-trust principle holds that users, applications, and services should hold only the access they need to do their job — nothing more. Standing, broad permissions are a standing risk. Nexus operationalizes least privilege by continuously auditing your permission assignments and surfacing every place where access has grown beyond what is necessary.
* **Over-permissioned accounts.** Nexus compares the roles and group memberships assigned to each user against their typical activity and flags accounts carrying permissions that appear unused or excessive relative to their job function.
* **Standing privileged role assignments.** Accounts with permanent Global Administrator, Privileged Role Administrator, or other sensitive role assignments are flagged. Nexus guides you toward converting these to just-in-time access through Microsoft Entra Privileged Identity Management, so elevated rights exist only when they are actively needed.
* **Over-permissioned enterprise apps and service principals.** Nexus inventories every enterprise application and service principal in your tenant and highlights those with delegated or application permissions that exceed what their workloads actually require.
* **Access automation rules.** Nexus's automation engine lets you define rules that remove unnecessary access automatically — for example, revoking a guest user's group membership 90 days after their last sign-in, or removing a user from a privileged group when they change departments.
## Assume breach
The third zero-trust principle accepts that a breach may already be underway and designs controls accordingly. Rather than relying on a strong perimeter to keep attackers out, assume breach means you minimize blast radius, detect lateral movement early, and respond faster than an attacker can exploit their foothold. Nexus embeds this principle into every layer of the platform.
* **Continuous monitoring with real-time findings.** Nexus evaluates your Entra configuration on every sync cycle, not just once a week or once a month. Findings appear in your Posture dashboard within minutes of a misconfiguration emerging, dramatically shrinking the window between introduction and detection.
* **Audit log integration.** Nexus ingests the Microsoft Entra audit log and surfaces changes across your tenant — role assignments, application consent grants, guest invitations, policy modifications — in a single, searchable timeline. If an attacker modifies a conditional access policy or grants themselves a privileged role, the change is visible immediately.
* **Access reviews.** Nexus's access review workflows ensure that human reviewers certify access on a defined schedule. This regular certification process means that even if a compromised account gains access between reviews, that access will be caught and revoked at the next review cycle.
* **Automated remediation.** For certain high-severity findings, Nexus can remediate automatically — disabling stale accounts, revoking expired credentials, or removing a service account from an admin role — without waiting for a human to act. Faster remediation means a shorter window of exposure even when your team is unavailable.
## Zero-trust posture checklist
The five controls below represent the highest-impact zero-trust improvements Nexus helps you achieve. Use this checklist as a starting point when you first connect your tenant, and revisit it after each access review cycle.
Every user in your tenant — including break-glass accounts, service desk staff, and external guests — should have at least one strong MFA method registered and a conditional access policy that enforces its use. Nexus surfaces all users missing MFA registration and all policy gaps that allow sign-in without a second factor.
No user should hold a permanent assignment to a privileged role such as Global Administrator, Exchange Administrator, or Security Administrator. Use Microsoft Entra Privileged Identity Management to make all privileged roles eligible and require activation with justification and approval. Nexus flags every standing assignment that bypasses PIM.
Global Administrator is the most powerful role in your Entra tenant. No account — including break-glass accounts — should hold this role as a permanent assignment. Break-glass accounts should be eligible for Global Administrator via PIM and have their usage monitored closely. Nexus highlights any active standing Global Admin assignments and tracks the number of Global Admins in your tenant over time.
External guest accounts accumulate over time and frequently retain access long after a project or partnership ends. A quarterly access review of all guest users ensures that every external identity in your tenant has a current business justification and an owner responsible for it. Nexus automates the scheduling, assignment, and record-keeping of guest access reviews.
Enterprise applications and service principals with expired client secrets or certificates may fall back to less secure authentication methods or break entirely — and expired credentials are a common indicator of unmanaged applications. Nexus inventories every credential across your app registrations and service principals and alerts you before expiry, not after.
Start with Posture Insights to see your current zero-trust score and identify the highest-impact improvements.