How MDS delivered a sovereign-grade Zero Trust security transformation for a national technology ministry — protecting a critical Microsoft investment and establishing a governance model built for the AI era.
Customer: A national technology ministry responsible for a country’s digital infrastructure and public technology policy Industry: Public Sector / SLED (National Government) Country: Latin America Microsoft Investment: Microsoft 365 E5 Security
The Customer
This ministry is the government body responsible for its nation’s digital infrastructure and public technology policy. It oversees the technology programs, digital services, and connectivity initiatives that directly shape how citizens access government services and participate in the digital economy. With more than 1,000 users operating across 1,200+ endpoints in a hybrid Microsoft environment, the ministry’s security posture is not simply an IT concern — it is a matter of national digital sovereignty.
The Opportunity
The ministry had already made a significant strategic commitment to Microsoft 365 E5 Security, one of the most powerful security platforms available. Like many ambitious government institutions navigating rapid digital transformation at scale, the organization found itself at a pivotal moment: the platform was in place and the investment was real, but its full capabilities had not yet been operationalized. Security tools were partially configured, endpoint governance was inconsistent, data protection controls were not yet in enforcement mode, and AI was in active use across nearly 1,000 users without the governance framework needed to protect sensitive government data. A three-year Microsoft licensing contract was also at risk of non-renewal, as leadership sought clearer evidence of the value their investment was delivering.
MDS’s Senior Microsoft 365 Security Engineers conducted a comprehensive, hands-on security assessment of the ministry’s environment — complemented by CapametriX cybersecurity maturity benchmarking. The assessment surfaced six critical opportunity areas:
- Endpoint compliance: Only 3% of 1,200+ endpoints were compliant in Microsoft Intune, with 946 devices non-compliant and Conditional Access enforcement unreliable across the device estate.
- Defender coverage: 379 devices had zero Microsoft Defender sensor coverage — no security telemetry across more than 30% of the endpoint estate.
- Data protection: Zero DLP policies were in production enforcement mode, despite 54.95 million already-labeled items across the environment with no active exfiltration controls.
- AI governance: 30,700+ Microsoft 365 Copilot interactions were being generated daily by 988 users, with no DSPM for AI activation and no sensitivity label enforcement on prompts or responses.
- Shadow IT exposure: 1,160 cloud applications were in active use, with only 3% formally authorized, and 5.7TB of network traffic flowing through unclassified and ungoverned applications.
- Security maturity: The organization rated 3 out of 5 stars overall, with a Microsoft Secure Score of 55.62%, an Exposure Score of 57/100, and 244 expired certificates active across the environment.
The gap was not technological. The ministry had already invested in one of the most powerful security platforms available. What the organization needed was a trusted partner capable of activating, integrating, and operationalizing that investment to its full potential.
The Solution: An Integrated Zero Trust Transformation
MDS did not introduce new vendor complexity. Every solution deployed was part of the ministry’s existing Microsoft 365 E5 Security subscription — already licensed, already available, and ready to be fully activated.
MDS — a 30-year Microsoft Strategic Partner and member of the Microsoft Intelligent Security Association (MISA) — delivered a structured Zero Trust transformation program co-delivered with Gustavo Gomez, Microsoft Security Specialist, and formally registered as a Microsoft co-sell engagement. The program was anchored by two Microsoft MCI Envisioning Workshops — AE Security Threat Protection Envisioning and AE Security Data Security Envisioning — establishing a shared transformation roadmap aligned to Microsoft’s Zero Trust framework across all six pillars: Identities, Devices, Data, Apps, Infrastructure, and Networks.
- Domain 1 — Endpoint Security & Modern Management (Microsoft Intune, Microsoft Defender for Endpoint P2) MDS diagnosed the root causes of the 97% non-compliance rate — identifying fragmentation across MDM, GPO, and ConfigMgr as the primary driver — and delivered a structured remediation roadmap that drove endpoint compliance from 3% to 50%. Defender for Endpoint P2 was operationalized across the device estate with full EDR capability, and a risk-prioritized vulnerability management program was established.
- Domain 2 — Identity & Access Governance (Microsoft Entra ID P2, Microsoft Defender for Identity) MDS operationalized Conditional Access policies across the ministry’s hybrid Active Directory and Entra ID environment, enforcing Zero Trust identity principles across every user and device. Microsoft Defender for Identity was incorporated into the ministry’s threat detection strategy to surface credential-based attacks and lateral movement. Identity risk monitoring was established across 77 flagged at-risk users via Entra ID Protection.
- Domain 3 — Data Protection & Compliance (Microsoft Purview DLP, Information Protection, eDiscovery) MDS activated production-grade DLP enforcement for the first time in the ministry’s history — building on an existing foundation of 54.95 million labeled items that included custom sensitive information types for citizen identity records, health classifications, and salary data. 244 expired certificates were fully eliminated across the environment, and eDiscovery capabilities were activated to support ongoing compliance readiness.
- Domain 4 — Secure AI Governance (Microsoft Purview DSPM for AI, Microsoft 365 Copilot) MDS activated Microsoft Purview DSPM for AI and established governance policies covering 30,700+ active Copilot interactions — extending DLP controls and sensitivity labels directly to Copilot prompts and responses to ensure classified and sensitive government information could not be inadvertently disclosed through AI. MDS also delivered dedicated AI Readiness and Secure Copilot Deployment workshops, equipping the ministry’s teams to expand AI adoption responsibly. The ministry is now evaluating broader Copilot license expansion on the governance foundation MDS established.
- Domain 5 — Cloud Application Governance (Microsoft Defender for Cloud Apps) MDS deployed Microsoft Defender for Cloud Apps to deliver the ministry’s first comprehensive view of shadow IT risk — classifying 1,160 previously ungoverned cloud applications across 1,006 users, establishing risk-based governance controls, and systematically reducing the organization’s unmanaged cloud attack surface across 5.7TB of active network traffic.
How MDS Delivered It
| Phase | What Happened |
| Assess | Senior Microsoft 365 Security Engineers conducted a comprehensive hands-on security assessment across all six Zero Trust pillars, establishing an objective, evidence-based baseline with CapametriX as a complementary maturity benchmarking tool. |
| Envision | Two formal Microsoft MCI Envisioning Workshops were delivered in direct collaboration with Microsoft’s Security Specialist, establishing a shared transformation roadmap. |
| Transform | MDS executed the Zero Trust remediation roadmap across all five domains, activating, configuring, and operationalizing the ministry’s full Microsoft 365 E5 Security investment as a unified, integrated security platform. |
| Measure | Security posture improvements were quantified across Secure Score, Exposure Score, endpoint compliance, and data protection metrics, giving leadership clear, board-level evidence of the value their Microsoft investment was delivering. |
The Results
| Metric | Before | After |
| Microsoft Secure Score | 55.62% baseline | +35% improvement |
| Endpoint Compliance | 3% | 50% (a 16x improvement under Microsoft Intune) |
| Microsoft Exposure Score | 57/100 | 79/100 (a 39% risk reduction) |
| Expired Certificates | 244 active | 0 — fully eliminated |
| DLP Policies in Production | 0 | Multiple policies in active enforcement |
| AI Interactions Governed | 0 | 30,700+ Copilot interactions governed under Microsoft Purview DSPM for AI |
| Shadow IT Applications | 1,160 unclassified and ungoverned | Classified, risk-rated, and governed |
| Microsoft Contract | Three-year renewal at risk of lapsing | Three-year renewal secured |
Why MDS
Assessment-Led Methodology. MDS led with evidence, not assumptions. A hands-on security assessment conducted by Senior Microsoft 365 Security Engineers established an objective, board-level view of the ministry’s security posture before a single configuration change was made — earning organizational trust and ensuring every recommendation was grounded in data rather than estimation.
Microsoft Field Alignment. As a member of the Microsoft Intelligent Security Association (MISA) and a 30-year Microsoft Strategic Partner, MDS co-delivered this engagement with Microsoft’s Security Specialist, ensuring every recommendation aligned to Microsoft’s highest standards of field validation and platform best practice. The engagement was formally registered as a Microsoft co-sell opportunity.
Sovereign-Grade, In-Market Delivery. MDS delivered the entire engagement bilingually, in direct alignment with the country’s government compliance requirements, public sector operational constraints, and regional context — a combination no global systems integrator can replicate at MDS’s speed, depth, or cost structure.
The Road Ahead
This engagement establishes a clear roadmap for continued security maturity:
- Microsoft Sentinel — extending security operations with cloud-native SIEM and SOAR capabilities and unified threat intelligence across the environment.
- Windows Autopilot & Windows Update for Business — completing endpoint modernization and eliminating manual device provisioning across the full device estate.
- Expanded Microsoft 365 Copilot Licensing — scaling responsible AI adoption across the organization on the governance foundation now established through Microsoft Purview DSPM for AI.
A Blueprint for the Region
This engagement is the operational foundation for MDS’s Zero Trust Government Security Transformation practice across Latin America, Central America, and the Caribbean. The hands-on assessment model — anchored by dual Microsoft MCI Envisioning Workshops and the M365 E5 full-platform activation approach — is a fully repeatable, deployable program for national and regional government agencies across the region. MDS has demonstrated the ability to deliver sovereign-grade security transformation — at speed, in-market, and in-language — in a way no global competitor can replicate.
Maureen Data Systems (MDS) is a 30-year Microsoft Solutions Partner delivering Security, AI, and Data transformation across FinServ, Healthcare, SLED, and Professional Services. Learn more at www.mdsny.com.