I started a dedicated lab to practice Zero Trust in Azure—not as a checklist exercise, but as a place to break things, observe outcomes, and document what actually holds up under real constraints.
What the lab covers
The environment focuses on identity-first access: Conditional Access policies, MFA enforcement, least-privilege roles, and network segmentation between a small set of sample workloads. Terraform provisions the baseline; policy and access decisions stay explicit so I can change one variable and see the blast radius.
Why a lab instead of slides
Security architecture makes more sense when you can test it. A lab forces tradeoffs: legacy apps that cannot do modern auth, break-glass accounts, logging gaps, and the operational cost of tightening a policy. Those lessons do not stick as well in theory alone.
What’s next
I am wiring in more telemetry—sign-in risk, policy failures, and east-west traffic patterns—so each change has evidence behind it. The repo linked from my projects page will grow as the lab stabilizes.