ZTNA over Azure VPN

As the title states,

I've been doing research in switching from Azure VPN to a ZTNA Platform and from the ones I've found, TwinGate, ZeroTier, Fortinet ZTNA, no one really gives a clear indication.

The scenario is that I have a few limited users that work from home, at least 4 days a week, now I understand the concept of ZeroTrust.

But I need to find some answers I can bring to management as to WHY ZTNA is better than the current VPN, I already have my answer for this but what I am currently not getting is yes, ZTNA platform is better but what if the user does work at the office, how will that work?

I guess my question is, would you if you had the option. And which option would you go for?

Keep in mind that we have on-prem forti along with cloud forti.

there's a few very easy youtube videos on this....

not to be a dick but the pros/cons are already well weighted. IMO alot of it is marketing gimmicks.,

The best security benefit is that your users only gain access to the resources they are required to. An example would be someone in Finance only being able to access a file server via SMB but not initiate an RDP connection to it.

We use ZPA and a big plus is that it requires no inbound connectivity to use - the VPN (App Connector) initiates a secure tunnel to the Zscaler service edge, and the user is connecting to that edge - so the risk of exploit on your infrastructure is much lower.

Isn't ZTNA an architecture design philosphy? Why is it being weirdly productized as what seems like a SASE product? Or am I stupid?

Entra global secure access ztna now had the capability for local network delivery but still processing the access rules

If they already sit on the office LAN most of the week, ZTNA does not have to wrap them the same way as the four days at home. Office can stay on-net. ZTNA is for the user who is not on that LAN and should only get the apps they need, not a full tunnel into everything.

You already have Forti on-prem and in the cloud. That is the least messy option to take to management unless TwinGate is dramatically cheaper. Adding a third remote-access vendor next to Forti and Azure VPN is how you end up with three tools and the same tickets.

I would not rip Azure VPN out this quarter just to say you have Zero Trust. I would pick one remote path, use it for the WFH people, and leave office traffic alone.

Ideally it works the same for a user whether they're off site or on. ZTNA is a different mindset than traditional defensive networking. Its all about identity, not about network location.

Thanks, this I get. So the issue that I am currently have and why I was considering Zero Trust. Azure VPN client has a horrible disconnect in the background, and most of the times when a user locks laptop or idle for too long the connection drops, DNS updates on internal apps, and they receive a 403. Now this is frustrating to user because they would be busy with something, click away and connection dropped and lose all their work that they were busy with. We use Bunker Web as a WAF

why would you not have the same access policy for office and nremote? why would you just remove zero trust once they are in office?

That is a client problem more than a Zero Trust slogan problem.

Locking and idle-dropping Azure VPN is common. User gets a new path, BunkerWeb sees a different session, app returns 403, work is gone. ZTNA can feel better because the app session is the product, not one fat tunnel that dies when the laptop sleeps.

Before you buy a new platform, see if the Azure client can stay connected on lock, or if Forti already gives you a more stable client for those WFH people. If the 403 is BunkerWeb tying the session to the VPN IP, that will follow you to the next tool unless the WAF/app is set for roaming users.

Tell management: we are replacing a flaky remote client, not installing Zero Trust as a poster.

I would not turn Zero Trust off in the office.

I meant: do not make the first project “wrap every on-site user in the same ZTNA client you give the WFH people.” They already have a LAN, Forti, and an Azure VPN that falls over. Fix remote first.

In office, you still want identity, least privilege, and no flat trust of the building network. That can be Forti, app proxies, or the same ZTNA later. It does not have to be the same overlay on day one, or you will fight the LAN and the laptop sleep issue at the same time.

Same policy idea. Different first cutover.

With only a few remote users, I’d first ask whether the added complexity and cost are actually worth it. If the current VPN is secure and working well, ZTNA may not give you enough benefit to justify the switch.

For only a few users, I would keep Azure VPN if they need broad network access and you already enforce MFA, device compliance, and least-privilege groups. Move selected apps to ZTNA when you want per-application access without exposing a routable subnet, and compare operational overhead plus audit coverage rather than the product label.