Zero Trust Security in Azure Local: Architecting with Entra and SDN

Table of Contents

1. Introduction to Zero Trust for Hybrid and On-Prem
2. Why Zero Trust for Azure Local?
3. Microsoft’s Zero Trust Architecture: Core Principles
4. Entra: The Modern Identity and Access Pillar
5. SDN in Azure Local: Microsegmentation and Policy Enforcement
6. Architecting Zero Trust in Azure Local Environments
   • Logical Reference Architecture (ASCII Diagram)
   • Identity and Access Control Workflows
   • Network Segmentation with SDN (Sample Code)
7. Implementation Patterns
   • Greenfield
   • Brownfield / Modernization
8. Real-World Insight: Customer Quote and Reference
9. Challenges, Lessons Learned, and Mitigation Tips
10. Conclusion

1. Introduction to Zero Trust for Hybrid and On-Prem

Zero Trust is no longer just a cloud buzzword. In today’s evolving threat landscape, attackers target everything from remote endpoints to east-west traffic deep within your datacenter. Microsoft’s Zero Trust model recommends verifying every request, enforcing least-privilege, and assuming breach at every layer. Azure Local (formerly Azure Stack HCI) now brings Zero Trust principles to on-prem, allowing organizations to enforce modern identity, segmentation, and automation regardless of where workloads live.

2. Why Zero Trust for Azure Local?

Traditional perimeter defenses are no longer effective. With lateral movement and credential theft on the rise, enforcing Zero Trust in your on-prem environment closes the gaps. Azure Local enables you to apply cloud-native controls such as microsegmentation, conditional access, and policy automation, without moving your data offsite.

3. Microsoft’s Zero Trust Architecture: Core Principles

Microsoft’s latest Zero Trust framework is built on three core tenets:

• Verify explicitly: Always authenticate and authorize based on all available data points, including user identity, device, location, and workload context.
• Use least privileged access: Limit user and app permissions to just what is needed, just-in-time and just-enough access.
• Assume breach: Segment networks, use encryption, and monitor continuously for anomalous behavior.

Read the full Zero Trust Guidance from Microsoft.

4. Entra: The Modern Identity and Access Pillar

Entra (formerly Azure Active Directory) is the backbone of Zero Trust identity. With the latest version of Microsoft Entra, you can:

• Enforce Conditional Access policies for on-prem and hybrid users
• Enable Passwordless and Multi-Factor Authentication (MFA)
• Leverage Entra ID Protection and Continuous Access Evaluation (CAE)
• Integrate with on-prem Active Directory for hybrid identities

Example:
You can require that all administrative access to Azure Local resources passes Conditional Access evaluation, device compliance, and real-time risk scoring—before any sensitive operations are allowed.

“We gained instant visibility and control over privileged access to our local clusters using Entra Conditional Access—without sacrificing performance.”
—CISO, Fortune 500 Manufacturer
See Case Study

5. SDN in Azure Local: Microsegmentation and Policy Enforcement

Software-defined networking (SDN) in Azure Local provides a programmatic way to segment networks, enforce security policy, and respond to threats rapidly.

• Microsegmentation: Isolate east-west traffic between workloads, even on the same VLAN or subnet
• Dynamic Policy Updates: Use automation to update network rules as identities and threats evolve
• Visibility: Export logs and telemetry for continuous monitoring and compliance

SDN Microsegmentation Reference

Each subnet is isolated by NSGs and SDN policies, with Entra enforcing identity-based access and microsegmentation.

6. Architecting Zero Trust in Azure Local Environments

Logical Reference Architecture

• Entra as the central trust authority
• Azure Local SDN for all network controls
• NSGs, SLBs, and firewall rules as enforcement points
• All privileged actions governed by Conditional Access

Identity and Access Control: Sample Workflow

1. User requests access to sensitive resource
2. Entra evaluates risk (location, device, role, user risk)
3. Conditional Access triggers: Require MFA, check device compliance
4. Azure Local SDN dynamically adjusts: Opens NSG port for user’s session
5. Access is logged and monitored via Entra and Azure Monitor

PowerShell Example: Enforcing NSG Rules for Zero Trust

# Example: Only allow management port 3389 from a compliant device group
$ResourceGroup = "AzureLocalRG"
$NSGName = "ZeroTrust-NSG"
$RuleName = "Allow-RDP-From-Compliant"

Add-AzNetworkSecurityRuleConfig `
  -Name $RuleName `
  -NetworkSecurityGroup $NSGName `
  -Priority 100 `
  -Direction Inbound `
  -Access Allow `
  -Protocol Tcp `
  -SourceAddressPrefix "10.0.1.0/24" `
  -SourcePortRange "*" `
  -DestinationAddressPrefix "*" `
  -DestinationPortRange 3389 `
  -Description "Allow RDP from compliant Entra group only"

Automate this with Power Automate or Azure Functions for real-time access control.

Bicep Example: Deploying Segmented VNets

resource vnet 'Microsoft.Network/virtualNetworks@2022-09-01' = {
  name: 'ZeroTrustVNet'
  location: resourceGroup().location
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }
    subnets: [
      {
        name: 'Web'
        properties: {
          addressPrefix: '10.0.1.0/24'
        }
      }
      {
        name: 'App'
        properties: {
          addressPrefix: '10.0.2.0/24'
        }
      }
      {
        name: 'DB'
        properties: {
          addressPrefix: '10.0.3.0/24'
        }
      }
    ]
  }
}

7. Implementation Patterns

Greenfield: Designing New Environments

• Start with Entra identity-first. All admin and app identities are managed in Entra.
• Deploy Azure Local SDN using SDN Express for consistent segmentation.
• Automate network policy assignment by user or workload identity.
• Leverage Conditional Access and device compliance at every touchpoint.

Brownfield: Modernizing Existing Environments

• Integrate existing AD with Entra for hybrid identity.
• Discover current east-west network flows with SDN analytics.
• Phase in microsegmentation using NSGs and SLBs.
• Migrate high-value assets to tightly segmented subnets.
• Automate policy enforcement using PowerShell and scheduled tasks.

8. Real-World Insight: Customer Quote and Reference

“Deploying Zero Trust with Entra and SDN in our Azure Local environment let us achieve the same security posture as our public cloud—without moving a single workload offsite. The visibility and control is a game changer.”
— IT Security Architect, Global Retailer
Read similar stories

9. Challenges, Lessons Learned, and Mitigation Tips

10. Conclusion

Zero Trust is not a product. It is a comprehensive security strategy that can now be enforced across on-prem, hybrid, and multicloud environments with Azure Local, Microsoft Entra, and SDN. Start by verifying identity, segmenting networks, and automating policy enforcement. Use the latest versions of Azure Local, Entra, and SDN Express to simplify and accelerate your Zero Trust journey, without compromise.

Disclaimer: The views expressed in this article are those of the author and do not represent the opinions of Microsoft, my employer or any affiliated organization. Always refer to the official Microsoft documentation before production deployment.