Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based access with BeyondCorp-style architectures. Use when replacing VPN remote access with identity-based controls, limiting lateral movement via micro-segmentation, or exposing cloud workloads to authenticated users without public internet exposure.
Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based access with BeyondCorp-style architectures. Use when replacing VPN remote access with identity-based controls, limiting lateral movement via micro-segmentation, or exposing cloud workloads to authenticated users without public internet exposure.
When replacing traditional VPN-based remote access with identity-based access controls
When implementing micro-segmentation to limit lateral movement within cloud networks
When compliance or security strategy requires zero trust architecture adoption
When providing secure access to cloud workloads without exposing them to the public internet
When building context-aware access policies based on user identity, device health, and location
Do not use as a complete replacement for network security controls (ZTNA complements but does not replace firewalls and network ACLs), for protecting internet-facing public applications (use WAF), or for IoT device access where identity-based authentication is not feasible.
Prerequisites
Identity provider (Entra ID, Okta, Google Workspace) with MFA enforcement
Zscaler ZPA: Enterprise ZTNA platform replacing VPN with application-level access based on identity and context
Common Scenarios
Scenario: Replacing Corporate VPN with Zero Trust Access for Cloud Applications
Context: An organization with 2,000 employees accesses 30+ internal cloud applications through a traditional VPN concentrator. VPN performance issues and security concerns drive the decision to implement ZTNA.
Approach:
Inventory all applications currently accessed through VPN and classify by sensitivity
Deploy GCP IAP or AWS Verified Access for web-based internal applications
Configure conditional access policies requiring MFA and device compliance for all applications
Implement micro-segmentation using security groups to limit lateral movement between application tiers
Set up continuous verification with re-authentication every 4 hours for sensitive applications
Migrate users in phases, starting with low-risk applications, monitoring access logs for issues
Decommission VPN after all applications are accessible through ZTNA with full logging
Pitfalls: Not all applications support identity-aware proxy integration. Legacy thick-client applications may require agent-based ZTNA solutions instead of proxy-based approaches. Device posture assessment requires an endpoint management solution deployed to all corporate devices. Break-glass access procedures must be documented for scenarios where the identity provider is unavailable.
Output Format
Zero Trust Network Access Implementation Report
==================================================
Organization: Acme Corp
Implementation Date: 2026-02-23
Applications Migrated: 24 / 30
ZTNA ARCHITECTURE:
Identity Provider: Microsoft Entra ID
Access Proxy: AWS Verified Access + GCP IAP
Device Management: Microsoft Intune
MFA: FIDO2 + Authenticator App
ACCESS POLICY COVERAGE:
Applications requiring MFA: 30 / 30 (100%)
Applications requiring compliant device: 24 / 30 (80%)
Applications with continuous verification: 18 / 30 (60%)
Applications with location restrictions: 12 / 30 (40%)
SECURITY IMPROVEMENTS:
VPN-related incidents (before): 12/month
ZTNA-related incidents (after): 2/month
Mean time to detect unauthorized access: 4 min (was 2 hours)
Lateral movement paths eliminated: 85%
MIGRATION STATUS:
Phase 1 (low-risk apps): 12/12 complete
Phase 2 (medium-risk apps): 12/12 complete
Phase 3 (high-risk apps): 0/6 in progress
VPN decommission: Scheduled after Phase 3
