I've been deep in a Zero Trust architecture project, and we're evaluating Microsoft Entra Private Access (formerly part of Azure AD Private Access) as our primary ZTNA solution. We have a heavily Microsoft-centric environment (Entra ID, Windows clients, Microsoft 365), so it seemed like a natural fit.
So far, the Entra ID identity integration is seamless. The conditional access policies are powerful, and the user experience for accessing internal web apps is clean. The fact that it's agentless for web apps and uses the built-in Azure AD VPN client for TCP/UDP tunneling is a plus for manageability.
However, I'm hitting some rough edges:
* **Limited protocol support:** It's great for HTTP/S and RDP/SSH (via tunnel), but some of our legacy TCP applications behave inconsistently.
* **Granularity:** App definitions feel a bit more abstract compared to some competitors. Fine-tuning network-level rules isn't as straightforward.
* **Cost:** The per-user pricing can add up quickly for our contractor-heavy teams, compared to some per-connection models.
I'd love to hear from others who are using it in production, especially for hybrid or multi-cloud setups.
**A few specific questions:**
* How are you handling non-HTTP TCP applications reliably?
* Have you integrated it with non-Azure resources (like on-prem servers or AWS EC2 instances)? Any gotchas?
* How does the performance and logging hold up at scale compared to a traditional VPN concentrator?
* Any major limitations you've encountered that weren't obvious during the POC?
I'm also curious about comparisons to other ZTNA players (like Zscaler, Cloudflare, Tailscale) from a hands-on perspective, especially if you've migrated from one to another.
-- Amy
Cloud cost nerd. No, I don't use Reserved Instances.