Quick answer
Choose Microsoft’s Zero Trust Assessment when the immediate question is “Where are the posture gaps?” Choose the Zero Trust Workshop when the question is “Who will remediate which gaps, in what order, with what dependencies?”
The official operating motion uses both: plan pillars and stakeholders, run the Assessment, then use the facilitated Workshop to build a 12- to 24-month First, Then, Next roadmap. Read the combined workflow guide for the handoff design.
Side-by-side decision table
| Dimension | Zero Trust Assessment | Zero Trust Workshop |
|---|---|---|
| Core job | Automated posture baseline and prioritized recommendations | Facilitated prioritization and implementation roadmap |
| Inputs | Tenant configuration and activity signals | Assessment findings, architecture, stakeholders, risk, and business constraints |
| Output | Practitioner guidance and executive-ready reporting | First, Then, Next tasks, owners, dependencies, and 12- to 24-month roadmap |
| AI scope | AI-focused checks alongside Identity, Devices, Network, Data, SecOps, and Infrastructure | AI pillar plus DevSecOps and cross-pillar planning |
| Best cadence | Baseline and reassessment | Initial roadmap and material-change reviews |
| Does it implement controls? | No | No |
| Does it certify security? | No | No |
The Assessment can identify a signal or configuration gap, but it cannot by itself establish business intent, agent purpose, exception ownership, or whether a downstream service rechecks authorization. The Workshop can resolve those planning questions, but a completed workshop artifact is still not runtime evidence.
Decide based on the missing evidence
Start with the Assessment when the team lacks a common, current view of its Microsoft environment. Define which tenants and pillars are in scope, who may access the results, how stale or unavailable signals are treated, and how recommendations will be tracked.
Start workshop preparation in parallel when ownership is unclear or a program spans security, identity, data, engineering, platform, privacy, and business teams. Do not finalize priority until baseline evidence is available. Convert each recommendation into an accountable task with an acceptance test and reassessment date.
For agent deployments, add evidence that a tenant-level posture score may not capture: unique agent identity, effective aggregate permissions, approved tool actions, downstream authorization, credential invalidation, memory provenance, retrieval-time checks, and end-to-end correlation IDs. Use the local assessment planner to expose these gaps.
Frequently asked questions
Should a team start with the Assessment or Workshop?
Microsoft’s documented motion starts with planning the pillars and stakeholders, then runs the Assessment for a baseline before using the Workshop to form a roadmap.
Can the Workshop replace automated posture evidence?
No. The Workshop structures decisions and remediation work; it does not replace current configuration, activity, identity, pipeline, memory, or runtime evidence.
Can the Assessment replace implementation testing?
No. Assessment recommendations still require owners, implementation, acceptance criteria, negative-path testing, and reassessment.
Official source
Source check: August 12, 2026. Verify current Assessment and Workshop scope, access, reporting, roadmap guidance, licensing, and terms.