We are replacing our legacy VPN with a Zero Trust Network Access (ZTNA) solution.

That’s a solid modernization path. The key is to treat ZTNA as an access-control architecture, not simply a replacement VPN product. NIST’s Zero Trust Architecture guidance emphasizes protecting individual resources rather than granting broad network access based on where a user connects from.

Recommended migration approach

1. Inventory what the VPN actually provides

• Applications and services users access through it
• User groups and access requirements
• Network shares, RDP/SSH, databases, legacy applications, etc.
• Machine-to-machine and administrative access
• Third-party/vendor access

2. Map access to identities and resources Instead of policies such as:

“Employees on VPN can access 10.20.0.0/16” Move toward:

“Finance users on managed, compliant devices can access the finance application, subject to MFA and risk policy.” This aligns with the ZTNA model of explicit authentication and authorization for resource access.

3. Establish the identity foundation Your IdP becomes central:

• SSO
• Phishing-resistant MFA where practical
• Groups/roles
• Device identity and posture
• Conditional/risk-based access
• Lifecycle automation for joiners, movers, and leavers

4. Deploy ZTNA alongside the VPN Don't switch everything at once. Pick a relatively self-contained application and migrate a pilot group first. NIST's implementation guidance specifically recommends a gradual, risk-based evolution rather than assuming there is one migration architecture that fits every organization.
5. Reduce implicit network access A successful migration should eventually eliminate the pattern where connecting to the VPN effectively places a device on a trusted corporate network. Users should receive access to specific applications/resources, not an unnecessarily broad network segment.
6. Handle the difficult legacy cases separately Pay particular attention to:

• Non-web applications
• SMB/file shares
• RDP/SSH
• Industrial/OT systems
• Applications requiring fixed source IPs
• Devices that cannot run an endpoint agent
• Service accounts and automated workloads

These often determine whether a complete VPN shutdown is realistic. 7. Build monitoring before decommissioning Measure authentication failures, policy denials, device posture, unusual access, application usage, and administrative activity. ZTNA's policy-enforcement components become critical infrastructure, so availability and scaling also need to be engineered carefully.

A practical target architecture

User/device → IdP + MFA + device posture → ZTNA policy decision → application-specific policy enforcement point → private application

Rather than:

User → VPN → trusted corporate network → everything reachable

That distinction is the heart of the migration.

If you tell me your current VPN technology, identity provider (e.g. Entra ID/Okta), major applications, and whether workloads are on-prem, cloud, or hybrid, I can turn this into a concrete phased ZTNA migration plan, target architecture, and VPN decommissioning checklist.

Moving from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a massive upgrade for security, user experience, and network visibility.

To help you navigate the transition smoothly, here is a structured roadmap and key considerations for your migration:

• Assessment and Discovery
  • Inventory all existing legacy VPN use cases, including remote user access, third-party vendor access, and site-to-site connectivity.
  • Map out all legacy applications (both cloud-hosted and on-premises) to understand traffic patterns and dependencies.
  • Identify user personas and their specific access requirements (e.g., standard employees vs. heavy developers vs. external contractors).
• Vendor Evaluation and Selection
  • Determine whether you need an agent-based (device-installed client) or agentless (browser-based) ZTNA solution, or a combination of both.
  • Look for integration capabilities with your existing Identity Provider (IdP) for Multi-Factor Authentication (MFA) and Single Sign-On (SSO).
  • Evaluate context-aware access policies (device posture checking, user location, risk scoring).
• Pilot Deployment
  • Select a low-risk, tech-savvy department or a non-critical application set for your initial ZTNA proof of concept.
  • Validate micro-segmentation rules and ensure least-privilege access policies function without breaking user workflows.
  • Gather end-user feedback on connection reliability, login friction, and performance.
• Phased Rollout and Policy Tuning
  • Migrate user groups in waves (e.g., remote sales teams first, then engineering, then corporate headquarters).
  • Implement continuous monitoring and logging to catch any anomalous access patterns or misconfigured application policies early.
  • Refine latency and edge-node performance, especially for global workforces connecting to on-premises resources via connectors/gateways.
• Decommissioning the Legacy VPN
  • Run a parallel period where the VPN remains available only as a fallback for edge-case applications not yet migrated.
  • Revoke active VPN profiles, disconnect concentrators/hardware, and close unnecessary inbound firewall ports.
  • Conduct a final security audit to ensure no residual backdoors or legacy rules remain active.

To help tailor this transition, tell me:

• Are your applications mostly cloud-hosted (SaaS/IaaS) or on-premises (data center)?
• What Identity Provider (IdP) are you currently using (e.g., Azure AD/Entra ID, Okta, Ping)?

That’s a strong modernization move. A successful VPN-to-ZTNA migration should be treated as an access-control redesign, not simply swapping one remote-access product for another. NIST’s current guidance emphasizes protecting individual resources rather than extending a trusted network perimeter.

Recommended migration approach

1. Inventory applications and users

• Identify applications currently reachable through the VPN.
• Map users, groups, devices, service accounts, dependencies, and data sensitivity.
• Identify applications that genuinely require network-level connectivity and may not be suitable for immediate ZTNA migration.

2. Establish identity as the primary control plane

• Integrate ZTNA with your IdP.
• Require MFA/phishing-resistant authentication where practical.
• Use device posture signals such as managed/unmanaged status, OS version, encryption, EDR status, and compliance.
• Apply least-privilege access at the application/resource level rather than granting broad network access.

3. Create application-specific policies

Instead of:

“Employee connected to VPN → can access corporate network” Move toward:

“User + device + application + context satisfy policy → access only this application.” This aligns with NIST's zero-trust model, which explicitly rejects implicit trust based on network location.

4. Pilot before retiring the VPN

• Choose a relatively self-contained application set.
• Run ZTNA and VPN concurrently.
• Measure authentication success, application performance, help-desk impact, policy violations, and user experience.
• Expand application-by-application rather than attempting a single cutover.

5. Handle legacy applications separately

• Older client/server applications, SMB/file shares, RDP, SSH, VoIP, and applications with unusual protocols may require connectors, private-access gateways, segmentation, or temporary VPN coexistence.
• Don't force every workload into an identical ZTNA pattern.

6. Build monitoring and rollback into the migration

• Centralize ZTNA, IdP, endpoint, and application logs.
• Monitor denied/allowed access, anomalous behavior, device posture changes, and authentication events.
• Keep the legacy VPN available as a controlled fallback until critical applications have been validated.

7. Decommission the VPN last

• Remove unused VPN accounts and infrastructure.
• Revoke legacy certificates/credentials.
• Close unnecessary inbound VPN/firewall exposure.
• Verify that applications no longer depend on implicit network trust.

NIST's 2025 implementation guide is particularly useful here: it documents 19 practical ZTA implementations and stresses that migration should be incremental rather than a wholesale replacement.

A practical target architecture

User → IdP/MFA → ZTNA policy engine → application connector → specific application

with policy decisions informed by:

Identity + device posture + application + risk/context + authorization

rather than:

User → VPN → trusted corporate network → everything reachable

If you're planning the actual migration, I can also lay out a 90-day VPN-to-ZTNA migration plan, including architecture, phases, pilot criteria, policy design, testing, rollback, and VPN decommissioning.

Transitioning from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is one of the most impactful moves you can make to shrink your attack surface and eliminate lateral movement. Moving away from "castle-and-moat" network access to an identity- and context-aware model requires a structured migration strategy.

Key Migration Best Practices

1. Discover and Map First
   • Don't guess what's running on your old VPN. Use app-discovery or traffic-logging tools to map out actual private application usage, ports, protocols (web, SSH, RDP, SMB), and legacy user habits.
2. Start with "Quick Access" or Broad Groupings
   • Trying to define micro-segmented, single-app policies on day one will stall your project. Begin by onboarding apps using broader group- or subnet-level policies, then incrementally tighten them down to a true least-privileged model.
3. Integrate Strong Identity and Posture Checks
   • Tie your ZTNA platform directly into your Identity Provider (IdP) (e.g., Microsoft Entra ID, Okta) to enforce mandatory Multi-Factor Authentication (MFA) and device compliance/health posture validation before granting a connection.
4. Run in Parallel Briefly
   • Keep the legacy VPN functional for a targeted pilot group (e.g., IT or a willing business unit) while routing pilot ZTNA traffic. This helps iron out DNS resolution quirks, latency issues, and edge-case protocols.
5. Sunset Subnets Iteratively
   • As applications and user groups transition over, actively trim split-tunnel permissions and decommission physical or virtual VPN gateways department by department.

To help tailor this migration plan, tell me a bit more about your environment:

• What is your current Identity Provider (IdP)?
• Are your private applications mostly on-premises, in a public cloud (AWS/Azure/GCP), or a hybrid mix?
• Do you have non-web legacy protocols (like RDP, SSH, or custom client-server apps) that users rely on?

That’s a significant architecture change. The key is to avoid treating ZTNA as simply a “new VPN.” ZTNA should move you from broad network access to identity-, device-, application-, and context-based access. CISA specifically recommends modern approaches such as Zero Trust for more granular remote access and reduced exposure compared with traditional VPN deployments.

A practical migration approach is:

1. Inventory current VPN access

• Users and groups
• Applications/subnets they access
• Privileged/admin access
• Third-party/vendor access
• Machine-to-machine and legacy protocols

2. Map users to applications, not networks

• Replace rules like “Finance → 10.20.0.0/16” with “Finance users → Finance application.”
• Start with least privilege and application-specific policies.

3. Integrate identity

• Connect ZTNA to your IdP.
• Require strong/phishing-resistant MFA where practical.
• Use groups, roles, device posture, and risk signals in access decisions.

4. Establish device trust

• Require managed/compliant endpoints for sensitive applications.
• Incorporate EDR/MDM posture where your ZTNA platform supports it.

5. Segment critical resources

• Don't recreate the VPN's broad network reach through ZTNA.
• Microsegmentation can reduce lateral movement and attack surface.

6. Run ZTNA and VPN in parallel

• Pilot a representative group.
• Migrate applications incrementally.
• Keep an emergency/break-glass path while validating the new architecture.

7. Measure before decommissioning VPN

• Successful/failed authentication
• Policy denials
• Device compliance
• Application reachability
• Privileged access
• User experience
• Unexpected dependencies

8. Retire VPN deliberately

• Remove obsolete firewall rules and VPN accounts.
• Close exposed VPN interfaces.
• Update documentation and incident-response procedures.
• Verify that applications are no longer implicitly reachable through the old network path.

CISA's Zero Trust Maturity Model similarly emphasizes moving toward service-specific connectivity, isolation, micro-perimeters, and just-enough/just-in-time access, rather than relying on large network-level VPN tunnels.

If you're planning the actual migration, I can help you build a VPN → ZTNA migration plan, including architecture, phases, policy design, pilot criteria, cutover/rollback strategy, and a checklist for identifying applications that won't work cleanly with ZTNA.

Migrating from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a major milestone for modernizing corporate security. ZTNA shifts the paradigm from "trust, then verify" to "never trust, always verify," granting least-privilege access per application rather than broad network access.

To ensure a smooth transition, here is a structured roadmap for your implementation:

1. Discovery and Inventory

• Application mapping: Catalog all internal applications, users, and data resources currently accessed via the legacy VPN.
• Classification: Identify critical data, legacy protocols (e.g., non-HTTP/HTTPS traffic), and third-party vendor dependencies that require special handling.

1. Define Access Policies

• Identity integration: Connect your ZTNA provider with your Identity Provider (IdP) for Multi-Factor Authentication (MFA) and Single Sign-On (SSO).
• Contextual rules: Establish policies based on user identity, device posture (health, compliance, management state), and location.

1. Pilot and Phased Rollout

• Select a pilot group: Choose a tech-savvy department or a low-risk user group (like IT or a specific business unit) to test the new workflow.
• Non-critical apps first: Deploy ZTNA for a handful of web apps before moving to heavy legacy or database applications.

1. User Experience and Training

• Enable onboarding: Provide clear documentation so users understand how seamless connectivity will work without the manual "connect/disconnect" VPN ritual.
• Collect feedback: Address latency, connection drops, or authentication friction early during the pilot phase.

1. Full Migration and Decommissioning

• Cutover: Transition all remaining user groups and applications off the legacy VPN.
• Deprecate infrastructure: Revoke firewall rules that allowed wide-scale VPN access, and safely shut down or patch the legacy VPN gateways to eliminate their attack surface.

To help tailor this migration plan, could you share:

• What ZTNA vendor or platform you are considering or deploying?
• Are you dealing with a lot of legacy/non-web applications (like TCP/UDP-based apps or thick clients)?
• Roughly how many users need to be migrated?

That’s a solid modernization path. A successful VPN → ZTNA migration is less about replacing one remote-access product with another and more about changing the access model from “connect to the network, then access resources” to “authenticate and authorize access to each resource.” NIST’s Zero Trust Architecture guidance explicitly emphasizes protecting individual resources rather than trusting users because of their network location.

Recommended migration approach

1. Inventory what the VPN actually provides

• Applications and services reachable through the VPN
• Users, groups, contractors, and service accounts
• Network shares, RDP/SSH, databases, internal web apps, etc.
• Dependencies that assume the user is “on the corporate network”
• Legacy applications that cannot work with an agent, proxy, or identity-based access

2. Map applications to identities

• Integrate ZTNA with your IdP/SSO.
• Require strong MFA, preferably phishing-resistant MFA where practical.
• Establish device posture requirements: managed device, encryption, EDR status, OS version, certificate, etc.
• Define access around user + device + application + context, rather than IP/subnet membership. NIST describes dynamic context such as identity, device health, resource sensitivity, and anomalous behavior as inputs to access decisions.

3. Create application-specific policies

For example:

Finance users + compliant corporate device → ERP

Developers + managed device + MFA → Git/CI

Contractors + MFA → specific web application only

Avoid recreating the VPN by giving a user broad access to an entire subnet. CISA similarly recommends moving controls closer to applications and resources and away from traditional perimeter-based security. CISA 4. Run VPN and ZTNA in parallel

• Start with a low-risk application.
• Pilot with a representative user population.
• Monitor authentication failures, application dependencies, latency, and help-desk volume.
• Gradually move applications and user groups to ZTNA.
• Keep the VPN as a controlled fallback during migration.

5. Handle non-ZTNA-friendly workloads explicitly

Some things won't migrate cleanly, particularly legacy protocols, network discovery, unusual UDP applications, broad administrative access, and systems that fundamentally require network-level connectivity. NIST's implementation guidance emphasizes that there isn't one migration approach suitable for every enterprise and that ZTA is an incremental evolution. NIST Pages 6. Decommission the VPN only after proving the replacement Before shutting it down, verify:

• 100% of required business applications have an access path.
• Break-glass/admin access is documented.
• Logging reaches your SIEM.
• Access policies have owners.
• Device and identity lifecycle events automatically affect access.
• Third-party and service-account access has been addressed.
• There are no undocumented VPN-dependent workflows.

A useful target architecture

User → IdP/MFA → ZTNA policy decision → ZTNA enforcement point → specific application

rather than:

User → VPN → corporate network → many reachable applications

That distinction is the heart of the migration. CISA has also specifically recommended moving organizations toward Zero Trust/SSE/SASE approaches while highlighting the risks associated with traditional remote-access VPN deployments and misconfiguration.

If you're planning the project, I can also lay out a 90-day VPN-to-ZTNA migration plan, including phases, workstreams, policy design, pilot criteria, testing, and VPN decommissioning gates.

Migrating from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a major upgrade for security, user experience, and network visibility.

Here is a structured, scannable roadmap to help guide your transition:

• Asset discovery: Map all internal applications, legacy services, databases, and network resources currently behind the VPN.

• User profiling: Identify user groups (employees, contractors, third-party vendors) and their specific access requirements.

• Legacy dependency check: Identify apps using non-standard or legacy protocols (like UDP/heavy TCP streaming) that might not map cleanly to standard ZTNA connectors.

• Deployment model: Decide between cloud-delivered ZTNA (SaaS edge) or agent-based vs. agentless (browser-based) access.

• Identity provider (IdP) integration: Ensure deep integration with your existing IdP (e.g., Azure AD/Entra ID, Okta) to enforce multifactor authentication (MFA) and contextual access policies.

• Pilot group selection: Pick a tech-savvy or isolated department (like IT or a specific engineering team) to test the initial rollout.

• Micro-segmentation: Move away from "network-level access" to "application-level access." Users should only connect to the specific apps they are authorized to see.

• Contextual guardrails: Build policies incorporating device posture (compliant, encrypted, managed) and location risk.

• Phased enforcement: Start in audit/monitoring mode if supported, then move to blocking unauthorized requests.

• Dual-running period: Run the ZTNA solution alongside the legacy VPN for a designated transition window.

• User training: Provide clear documentation for end-users on how to access internal resources via the new ZTNA client or portal.

• Telemetry monitoring: Watch connection success rates, latency, and helpdesk ticket volumes closely during the initial waves.

• Cutover completion: Migrate all remaining user groups off the legacy VPN.

• Access revocation: Disable VPN gateways, firewall rules permitting inbound VPN traffic, and old credentials.

• Post-migration review: Audit logs and finalize the transition documentation.

To help tailor this transition strategy, let me know:

• What ZTNA vendor or IdP are you leaning toward or currently using?
• Do you have legacy apps that rely on non-web protocols?

I can give you more specific advice on connector placement or handling legacy apps.

That’s a sensible modernization path. The key is to treat the project as an access-model transformation, not simply a VPN replacement. NIST recommends an incremental, risk-based migration, and current NCSC guidance specifically warns against leaving legacy VPN paths that bypass ZTNA policy enforcement.

A practical migration approach is:

1. Inventory current VPN usage

• Users, groups, devices, applications, servers, and third parties.
• Identify what each VPN profile actually provides access to.
• Map application dependencies and traffic flows.
• Identify legacy systems that cannot immediately support ZTNA.

2. Define the access policies

• Move from “user is on the corporate network” to “this authenticated user/device may access this specific application.”
• Incorporate identity, MFA, device posture, role, application sensitivity, and other contextual signals.
• Apply least privilege and per-application access rather than broad network connectivity. NCSC identifies policy enforcement, multiple signals, continuous reevaluation, application minimization, observability, and resilience as core ZTNA design requirements.

3. Pilot with low-risk applications

• Select a representative set of applications and users.
• Run ZTNA alongside the VPN initially.
• Measure authentication success, application compatibility, latency, help-desk volume, policy violations, and user experience.

4. Migrate in waves

• Move applications and user populations incrementally.
• Prioritize high-value applications where eliminating broad network access provides a significant security benefit.
• Keep a tightly controlled VPN exception process for genuinely incompatible legacy systems.

5. Integrate the surrounding controls

• Identity provider/SSO and strong MFA.
• Endpoint management and device-health signals.
• SIEM/security monitoring.
• DNS and application discovery.
• Privileged-access controls for administrators.
• Logging sufficient to reconstruct access decisions.

6. Decommission the VPN deliberately

• Remove old VPN profiles and firewall rules.
• Close unnecessary VPN-facing infrastructure.
• Update network diagrams, runbooks, incident-response procedures, and access reviews.
• Verify that no alternative route lets users bypass the ZTNA policy engine. NCSC explicitly identifies retaining such parallel routes as a ZTNA anti-pattern.

The biggest architectural shift

With the legacy VPN, the model is often:

User → VPN → trusted network → many reachable resources

With ZTNA, aim for:

User + device + context → policy decision → specific application/resource

That distinction matters more than the particular ZTNA vendor. CISA and its partner agencies likewise recommend moving away from broad remote-network access toward granular, risk-based access controls.

NIST's 2025 implementation guidance is particularly useful here because it includes 19 example Zero Trust architectures and emphasizes inventory, policy, incremental implementation, and continuous improvement.

If you're developing the migration program, I can also lay out a 90-day ZTNA migration roadmap, including workstreams, milestones, KPIs, pilot criteria, and VPN decommissioning gates.

Migrating from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a massive upgrade for your security posture and remote user experience.

Here is a quick-hitting guide to setting up a successful ZTNA rollout:

Key Migration Phases

1. Discovery and Mapping
   • Inventory all existing internal applications, data repositories, and legacy user access patterns.
   • Categorize applications by sensitivity, user dependency, and protocol type (HTTP/HTTPS vs. legacy non-web protocols like TCP/UDP).
2. Policy Definition
   • Shift from network-level trust (IP addresses, subnets) to identity- and context-aware policies (user identity, device posture, location, and risk score).
   • Define least-privilege access rules per application or micro-segment rather than blanket network access.
3. Pilot and Testing
   • Deploy the ZTNA connector/gateway and enroll a small, tech-savvy pilot group (e.g., IT or engineering).
   • Test both standard web apps and edge-case legacy applications to validate latency, routing, and user experience.
4. Phased Rollout
   • Migrate non-critical business units or remote branch offices first.
   • Gradually transition high-privilege users (like developers and admins) and mission-critical legacy applications.
5. Decommissioning Legacy VPN
   • Monitor fallback usage and ensure no lingering legacy dependencies remain.
   • Revoke VPN credentials, turn off concentrators/gateways, and close inbound firewall ports associated with the old VPN.

Popular ZTNA Solutions to Compare

• Cloudflare One (explore options on the Cloudflare Zero Trust platform)
• Zscaler Private Access (learn more via Zscaler ZPA)
• Palo Alto Networks Prisma Access (check details on Prisma Access)
• Microsoft Entra Private Access (overview available on Microsoft Entra)

To help tailor this migration plan, tell me:

• What legacy applications (e.g., SSH, RDP, SMB, custom fat-client apps) are you most concerned about supporting?
• Are you leaning toward a vendor-managed cloud service (SSE/SASE) or an on-premises/hybrid controller model?