Quick answer
Microsoft positions the Zero Trust Assessment as the automated baseline and the Zero Trust Workshop as the facilitated planning motion. The Assessment evaluates tenant configuration and activity signals, then produces prioritized findings. The Workshop turns those findings into a First, Then, Next roadmap spanning 12 to 24 months.
Use them together, but do not collapse them into one claim. An assessment finding does not implement a control, and a workshop roadmap does not prove that a control works in production. Start with the local Zero Trust for AI assessment planner to define evidence owners before using Microsoft’s surfaces.
Assessment-to-workshop flow
| Stage | Primary output | Required owner check |
|---|---|---|
| Scope | Selected pillars, tenants, workloads, and stakeholders | Are agent, data, tool, memory, and development boundaries represented? |
| Assess | Baseline signals and prioritized recommendations | Is the evidence current, complete, and mapped to the actual deployment? |
| Workshop | First, Then, Next roadmap | Are dependencies, accountable owners, dates, and acceptance evidence explicit? |
| Implement | Identity, data, tool, pipeline, memory, and runtime controls | Are controls enforced outside the model and tested end to end? |
| Reassess | Updated findings and trend | Did exposure fall without breaking required workflows? |
Microsoft’s August 4 update adds AI, Security Operations, and Infrastructure checks to the Assessment. The Workshop adds a DevSecOps pillar with 15 control groups and 91 tasks, plus AI Memory guidance. Those counts describe the official planning surface; they do not mean every organization must implement an identical control set.
Build one evidence register
For every finding, record the affected tenant or environment, asset and agent owner, source signal, risk statement, current control, target control, remediation task, dependency, acceptance test, evidence link, exception approver, and review date. Keep raw findings and executive summaries traceable to the same evidence.
Connect cross-pillar dependencies. An agent tool allowlist may depend on identity, a protected repository, CI/CD policy, data classification, runtime monitoring, and fast credential revocation. A workshop task should not be considered complete because a document exists; require configuration evidence and a negative-path test.
Use the least-privilege guide for agent authority, the memory-safety guide for persistent context, and the DevSecOps controls guide for source-to-deployment work.
Frequently asked questions
What does Microsoft’s Zero Trust Assessment do for AI?
It evaluates tenant configuration and activity signals, establishes a posture baseline, and translates findings into prioritized recommendations across AI and other Zero Trust pillars.
What does the Zero Trust Workshop add?
The facilitated Workshop uses assessment findings and a First, Then, Next structure to create a phased 12- to 24-month remediation and implementation roadmap.
Does an assessment score prove an AI system is secure?
No. It is a posture baseline and prioritization input, not a certification, penetration test, agent-level authorization proof, or guarantee against compromise.
Official sources
Source check: August 12, 2026. Verify current access, tenant prerequisites, pillar content, outputs, licensing, partner involvement, and service terms before use.