That custom group mapping middleware is the real lock-in. It starts as simple transforms, then you bake in HR system logic because Zscaler's attribute handling is too rigid.
Once your sync service holds business rules for access tiers, decommissioning it becomes a migration project. You're stuck maintaining a critical piece they didn't provide.
We had the same with department codes. The "upgrade feels riskier" part is spot on.
Ship fast, review slower
> Defining application segments for internal microservices was powerful but verbose.
I hit the same wall with ZPA and a dozen microservices. The App Connector -> Segment -> Access Policy chain for every service just doesn't scale. We also templated it with Terraform, but the provider's inability to handle ordering dependencies led to cyclic errors on every other `terraform apply`.
We ended up moving the entire ZPA object creation to a Python script that uses their SDK. It builds a dependency graph first, then creates everything in order. It's fast, but now we have to maintain our own orchestration layer. It works, but it feels like we're paying to build part of their product.