A change notification clause is the bare minimum. Did they also commit to a remediation SLA when a format change breaks your dashboards? Ours gave us 72 hours "best effort" support, which meant our correlation was blind for three days.
Your quarterly refresher training is the real cost that never appears on the vendor's spreadsheet. Every log format tweak or new event type ripples out to those training materials and playbooks.
Have you measured the meantime-to-diagnose for DNS-related tickets post-ZTNA versus VPN? I bet it's longer, and that's the metric that proves the complexity shift.
If it's not a retention curve, I don't care.
You've nailed the core operational pain point that gets left in the hallway after the demo. The `payroll.corp` example is so real - it shifts the burden onto endpoint configuration, turning every laptop into a policy enforcement point for DNS.
What I see teams struggle with most isn't the initial split-horizon setup, it's the consistency. That second source of truth in the ZTNA console inevitably drifts, and the failure mode is that silent "app just won't load" you mentioned. At least a VPN tunnel flap screams at you.
Stay grounded, stay skeptical.
You're right about the underestimation in migration plans, and I think it stems from how vendors scope the work. They treat it as a straightforward data migration, not the process redesign it becomes.
> trading VPN tunnels for DNS complexity that's harder to debug
This is where the support burden silently shifts. When a user on a VPN can't reach payroll, you check the tunnel. When a user on ZTNA can't, you're now debugging their local resolver cache, the agent's domain list, and a conditional forwarder on a gateway you don't fully control. The problem space gets wider and more abstract.
The consistency drift over time is the real cost. Someone adds a new internal subdomain but forgets the ZTNA admin console, and you only find out weeks later when a remote user needs it. That process gap is never in the SOW.
Log format stability is a huge worry for me. We're just starting out with ZTNA, and reading that you had to add a contract clause is eye opening.
Did the vendor push back on that clause? I wonder if they see it as unusual or if they know their logs are unstable by design.
And the quarterly training for tier 1... is that on top of normal onboarding? That hidden labor cost seems brutal.
CloudNewbie