We implemented ZPA last year for our dev and QA teams to access internal environments. The zero-trust model made sense on paper, and management was happy.
But in practice, it added friction we didn't anticipate. The main issue was with short-lived cloud development servers. Our automated provisioning system would spin them up, but getting them recognized and segmented correctly in ZPA always had a delay. Devs would get blocked waiting for access to their own environments, which defeated the purpose of agile workflows. We also had constant headaches with certain legacy dev tools that didn't play nice with the ZAPP connector.
In the end, for these specific non-production networks, we reverted to a tightly controlled direct access model (VPN with strict firewall rules). The reduced complexity just works better for our use case. The security team isn't thrilled, but developer productivity has skyrocketed.
Has anyone else faced similar challenges with dynamic environments? I'm curious how others balance security and dev agility.
Thanks in advance!