Zero Trust Assessment: Find Your Tenant’s Weak Spots Before Someone Else Does

The zero trust assessment is Microsoft’s free PowerShell module that checks your Microsoft 365 tenant against hundreds of security settings, then tells you, quite politely, where you’ve gone wrong.

Most tenants weren’t designed, they accumulated. A Conditional Access policy from 2021, an app registration nobody owns, and a Global Administrator account belonging to Dave, who left in March. Checking all of that by hand takes days, and you’d still miss something.

This guide walks through running the zero trust assessment from a clean PowerShell 7 session, the roles you need, where the report actually lands (spoiler: possibly System32), and how to turn a wall of red results into a fix list you can work through.

Never miss a guide: subscribe here and check out my YouTube channel.

Prefer to watch first? Merill Fernando has an excellent walkthrough of the tool on his YouTube channel:

What is the zero trust assessment?

The zero trust assessment is an open source PowerShell module from Microsoft. It reads your tenant configuration, runs it through a long list of tests and builds an HTML report with a risk rating and remediation steps for every check.

The tests line up with Microsoft’s Zero Trust guidance and the Secure Future Initiative, and draw on standards from NIST, CISA and CIS. Think of it as a very thorough auditor who never needs a lunch break and never comments on your naming conventions.

It’s read-only. Nothing in the tenant changes, and the data is collected and stored locally on the machine you run it from. The full detail is on the Zero Trust Assessment overview on Microsoft Learn.

What’s changed in the zero trust assessment in 2026

When I first wrote this guide, the report had two tabs worth talking about: Identity and Devices. The tool has grown since. Microsoft Learn now documents Identity, Devices, Network and Data tabs, plus a set of AI checks for agent identities.

The project’s GitHub README goes further. By default, Invoke-ZtAssessment now runs Identity, Devices, Network, Data, Infrastructure, SecOps and AI. Infrastructure results come from Microsoft Defender for Cloud recommendations and only include Azure subscriptions tagged ZeroTrustAssessment:Infrastructure.

More pillars means more connections. Connect-ZtAssessment now signs in to Microsoft Graph, Azure, Exchange, SharePoint and Azure Information Protection, so expect a few more sign-in prompts than you might remember.

Zero trust assessment prerequisites

What you need	Why
PowerShell 7	The module runs on PowerShell 7. Windows PowerShell 5.1 won’t do.
Global Administrator (first run only)	To consent to the Microsoft Graph permissions the tool requests.
Reader roles for later runs	Learn lists Global Reader, Security Reader, Exchange Administrator and SharePoint Administrator.
Microsoft Visual C++ Redistributable (x64)	The module depends on it, and a fresh Windows build may not have it.
An x64 Windows device	Windows on ARM64 isn’t supported yet.
Azure subscription (optional)	Used to check whether sign-in and audit logs are exported. No Azure, no problem; that test is skipped.

On roles, the same Learn page also says later runs can be performed as a Global Reader once consent is in place. Treat Global Reader as the starting point, and add the other roles if the Exchange or SharePoint connections fail.

Licensing matters too. Some checks look at features such as Privileged Identity Management, which needs Microsoft Entra ID P2 or Microsoft Entra ID Governance, so a smaller tenant will see recommendations it can’t act on without a bigger licence.

How to run the zero trust assessment in 7 steps

Step 1: Install PowerShell 7 and the Visual C++ Redistributable

Check what you’re running first. If the version comes back as 5.1, you’re in Windows PowerShell and need to install PowerShell 7 alongside it.

$PSVersionTable.PSVersion
winget install --id Microsoft.PowerShell --source winget

Then open PowerShell 7 (pwsh.exe), not the blue Windows PowerShell icon you’ve been clicking since Windows 7.

If the Visual C++ Redistributable is missing, the module says so when you try to run it. On some builds you get a cryptic DuckDB error instead. Install the latest x64 package from aka.ms/vcredist and restart PowerShell.

Step 2: Activate Global Administrator for the first run

The first run needs a Global Administrator to consent to the Microsoft Graph permissions. If you use PIM, and you should, that means activating the role for a short window rather than handing out a permanent assignment.

For my lab, I made the demo user Olavi King eligible for Global Administrator in PIM, then activated it for two hours to run the zero trust assessment. In the Microsoft Entra admin centre, go to ID Governance > Privileged Identity Management > My roles > Microsoft Entra roles, select Activate, give a reason and confirm.

If PIM is new to you, my Microsoft Entra PIM guide covers eligible assignments, activation settings and approvals. Once consent is granted, later runs don’t need Global Administrator at all.

Step 3: Install the ZeroTrustAssessment module

Open a new PowerShell 7 window and install the module for your own user account. No elevation needed.

Install-Module ZeroTrustAssessment -Scope CurrentUser

You’ll probably see a warning that PSGallery is an untrusted repository. That’s PowerShell being cautious about the gallery in general, so type A for Yes to All and press Enter. It pulls in dependencies such as Az.Accounts, so give it a minute.

If you prefer the newer PSResourceGet commands, the project README uses this instead:

Install-PSResource -Name ZeroTrustAssessment -Scope CurrentUser

Then confirm it installed:

Get-Module ZeroTrustAssessment -ListAvailable

Uninstall-Module ZeroTrustAssessment -Force -AllVersions

Step 4: Connect to your tenant and consent

Connect-ZtAssessment

Sign in to Microsoft Graph as the Global Administrator and accept the permissions. The list includes AuditLog.Read.All, Directory.Read.All, Policy.Read.ConditionalAccess and IdentityRiskEvent.Read.All. Every one is a read permission, which is exactly what you want to see.

The consent prompt only appears if the Microsoft Graph Command Line Tools app doesn’t already have those permissions. Next time you connect, it goes straight past.

A second window then opens for Azure. Sign in if you have a subscription and want the log export check; otherwise close it, ignore the warning, and the assessment skips that one test.

Pick a tenant and subscription if prompted, then work through the Exchange and SharePoint sign-ins as they appear.

Step 5: Change to a working folder first

This is the step everybody skips, including me. The report is saved to .\ZeroTrustReport under whatever folder you’re in when you run the command.

Open PowerShell 7 as administrator and the current folder is C:\Windows\System32. That’s exactly where my first zero trust assessment report ended up, sitting among the DLLs like a lost tourist.

New-Item -Path C:\ZTA -ItemType Directory -Force
Set-Location C:\ZTA

Step 6: Run Invoke-ZtAssessment

Invoke-ZtAssessment

Or skip the folder dance and use -Path. This saves the report as C:\ZTA\2026-10\ZeroTrustAssessmentReport.html:

Invoke-ZtAssessment -Path C:\ZTA\2026-10

The console then works through users, applications, service principals, devices, role assignments and sign-in logs. It’s oddly hypnotic, like watching a Windows 98 defrag.

How long does it take? Microsoft doesn’t publish typical times, only a warning that large tenants can take more than 24 hours. Leave it running even if it logs warnings or errors, and watch progress in the zt-export\logs folder inside the assessment folder.

When it finishes, the report opens in your default browser automatically.

Step 7: Store the report, then clean up

The zero trust assessment report and its export folder describe exactly where your tenant is weak. Treat them like a password spreadsheet: share them only with people who need them, keep them somewhere access-controlled, and delete the local copy when you’re done.

Disconnect-ZtAssessment
Remove-Item -Path C:\ZTA\2026-10 -Recurse -Force

Finished with the tool entirely? Remove the module too:

Uninstall-Module ZeroTrustAssessment -Force -AllVersions

And check your PIM activation has expired or been deactivated. Global Administrator shouldn’t hang around longer than the job needs.

How to read the zero trust assessment report

The report opens on the Overview tab. Here’s mine, from a lab tenant full of demo users and questionable decisions.

Overview tab

The top row counts users, guests, groups, apps and devices, with an Assessment panel showing tests passed per pillar. My lab passed 25 of 84 identity tests and 8 of 35 device tests, which is the security version of a school report saying “could try harder”.

Below that, flow charts show how privileged users and everyone else authenticate, and how sign-ins pass through Conditional Access. If you see single factor feeding into your privileged users, stop reading and go and fix that first.

The device charts cover platform split, compliance and ownership, plus how many sign-ins come from compliant devices. That last one tells you whether your Conditional Access device rules are doing anything at all.

Identity, Devices, Network and Data tabs

Each pillar tab lists its tests with a risk level and a status: Passed, Failed or Investigate. Investigate means the tool couldn’t decide for you, which is fair, because sometimes neither can I.

Select any test to open the detail. You get what was checked, why it matters, what the tool found in your tenant, and remediation links that go straight to the relevant Learn article.

What the ratings mean

Each recommendation is rated on risk level, user impact and implementation cost. The assessment glossary on Microsoft Learn defines them like this:

Rating	High	Medium	Low
Risk level	Environment-wide exposure until you fix it	Moderate exposure until you fix it	Defence in depth or an operational optimisation
User impact	A large number of non-privileged users need to act or be told	A subset of non-privileged users are affected	Admins act; users don’t need telling
Implementation cost	An ongoing programme of work for IT and SecOps	A project for IT and SecOps to drive	Targeted actions

Turning zero trust assessment results into a fix list

A report with 80 red rows isn’t a plan. Sorting it into one is the bit that earns your salary.

Priority	What to look for	Typical fixes
1. High risk, low cost	Single-factor or phishable MFA on admins, gaps in MFA coverage, permanent admin roles	Phishing-resistant MFA for admins, Conditional Access, PIM
2. High risk, higher cost	Sign-ins from unmanaged devices, long-lived app secrets, logs not exported	Device compliance in Conditional Access, credential rotation, diagnostic settings
3. Medium risk	Guest access, user consent settings, Conditional Access gaps	Tighten consent and guest settings, refine policies
4. Low risk	Defence in depth and tidy-ups	Schedule into normal change windows

This isn’t an official ordering; it’s how I triage. High risk with low implementation cost goes first, because those are quick wins that close the biggest holes.

Some of my guides map straight onto common failures: phishing-resistant MFA for admins, restricting app consent, blocking personal Windows devices and testing changes with the Conditional Access What If tool before they go live.

Prove it worked: re-run the zero trust assessment

Once a batch of fixes is in, run the zero trust assessment again into a new dated folder. Two reports side by side are the easiest evidence you’ll ever hand an auditor or a security board.

Uninstall-Module ZeroTrustAssessment -Force -AllVersions
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-ZtAssessment
Invoke-ZtAssessment -Path C:\ZTA\2026-11

I re-run it after major configuration changes, before audits and on a regular cycle such as quarterly. Reinstall the latest version first each time (Learn advises removing old versions before installing), because the test list keeps growing.

Later runs only need reader roles, so there’s no excuse to keep Global Administrator active for it.

Zero trust assessment troubleshooting and gotchas

Report in System32. Covered above, but it catches everyone. Run from a working folder or use -Path.

Visual C++ missing. You’ll see either the friendly prerequisite message or a DuckDB “type initializer” exception. Install the x64 Visual C++ Redistributable and restart PowerShell.

Could not load Microsoft.Graph.Authentication. This means conflicting Microsoft Graph PowerShell versions. Learn suggests removing every Graph module (Merill’s Uninstall-Graph helper does the hard work), uninstalling all versions of the assessment, restarting PowerShell and reinstalling:

Install-Module Uninstall-Graph
Uninstall-Module ZeroTrustAssessment -Force -AllVersions
Uninstall-Graph

Windows on ARM. Not supported yet, so your shiny new Arm laptop sits this one out.

Azure prompt. No subscription? Close the window. You lose one log export test, not the whole run.

Getting help. Run the command below in the same session as the failed run, zip the output with the assessment folder, and raise an issue on the Zero Trust Assessment GitHub repo, which is the support route Learn points to.

New-PSFSupportPackage -Path C:\ZTA\SupportLog -Force

Should you run the zero trust assessment?

Yes. It’s free, read-only and one command once the setup is done. The worst outcome is learning things you’d rather not know, which still beats an attacker learning them first.

It isn’t a replacement for Microsoft Secure Score or a proper security review. It’s a point-in-time snapshot with clear evidence and links, which makes it ideal for starting a security project or proving one is finished.

If you only do three things: run it from a working folder, fix the high-risk identity findings first, and book a re-run in the calendar. Then put the kettle on.

Zero trust assessment FAQs

Further reading

• Get started with the Zero Trust Assessment (Microsoft Learn)
• What is the Zero Trust Assessment? (Microsoft Learn)
• Zero Trust assessment terminology (Microsoft Learn)
• Configure agent identity security with the Zero Trust Assessment (Microsoft Learn)
• Activate a Microsoft Entra role in PIM (Microsoft Learn)
• Microsoft Entra PIM: set it up properly
• Restrict app consent in Microsoft Entra
• Conditional Access session controls

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.