Cybersecurity
ZTNA gives a person a session to one application after the identity and the device meet a policy, instead of opening the whole network. It is one way to reduce a broad VPN. It is not, by itself, a zero-trust program. Novatelia places it on the network-security solution when remote access is the requirement. The directory and the applications still have to exist.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- The grant is an application, not a subnet, when the product works that way.
- Identity and device posture are prerequisites.
- A product name is not a completed zero-trust program.
Definition
Zero trust network access is an access method. The user authenticates, the device is checked against the policy the license can enforce, and the session reaches the named application.
How it works
A connector sits in front of the application. The client or browser authenticates. The policy allows or refuses that application. Other applications on the same network are not automatically included.
Architecture
- Directory and multi-factor sign-in.
- Connectors for the applications in scope.
- A policy that names users, devices, and applications.
Use cases
- Contractors need one application and should not join the office network.
- A VPN is broader than the applications people actually use.
- Device compliance should be checked before access, using a signal the products share.
Selection guidance
- List the applications, not just “remote access”.
- Confirm the identity provider and the device signal.
- Keep firewall and segmentation work on the network-security solution when the question is east-west traffic.
Questions
Does ZTNA replace the firewall?
No. It changes how a remote person reaches an application. Traffic between systems inside the network is still a firewall and segmentation question on the network-security solution.
Is this available in every Microsoft 365 tenant?
No. Some Microsoft licenses include related access features and some do not. The design uses the license the customer has. Novatelia does not claim a Microsoft partnership.
Related
More in Cybersecurity
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.