Hey everyone! Been diving deep into the ZTNA world lately as we're helping a few clients transition from their clunky old VPNs, especially in more traditional sectors like manufacturing. It's fascinating to see how the "never trust, always verify" model fits where you've got a mix of office staff, remote engineers, and third-party contractors all needing access to different systems.
I was chatting with a friend who runs IT for a ~500-person manufacturing firm. They're dealing with legacy production apps, some modern SaaS (like their ERP), and need to give secure access to design files and machine dashboards to external partners. Their perimeter is basically gone. They're evaluating ZTNA vendors and feeling a bit overwhelmed.
I've been testing and researching a bunch of platforms, and for a scenario like this, I think the key considerations are pretty specific:
* **Identity Integration:** Must play nice with their existing identity provider (they use Azure AD). SCIM provisioning and conditional access policies are non-negotiable.
* **App-Centric, Not Network-Centric:** They shouldn't need to open firewall ports for legacy apps. The solution needs to be able to broker access to on-premises systems without exposing them to the internet.
* **User Experience:** For non-tech users on the factory floor or engineers at home, it has to be dead simple. Agent-based might be fine for corporate devices, but they'll likely need an agentless option for contractor access via a browser.
* **Cost Structure:** Predictable pricing for 500 users. Some vendors charge per app, which could get wild for them.
From what I've seen, a few names keep coming up for this mid-size, hybrid-environment use case:
* **Zscaler Private Access (ZPA):** Really strong in app segmentation and has that "internet-as-the-corporate-network" backbone. The micro-tunnels are slick. Can be agent or browser-based. Might feel like overkill if they don't want the full ZIA suite, though.
* **Cloudflare Access:** Love their developer-friendly approach and the pricing is often super transparent. Integrates beautifully with their existing Cloudflare DNS/LB setup if they use it. The agentless (browser-based) experience is fantastic for contractors.
* **Tailscale:** This one's interesting! Built on WireGuard, and it's just stupidly simple. The peer-to-peer mesh can be great for performance. It feels lighter weight, but might need more in-house tuning for their legacy app integration compared to the bigger platforms.
Has anyone here actually rolled out a ZTNA solution in a similar manufacturing or industrial setting? I'm particularly curious about:
* The **biggest hiccup** you faced with legacy on-prem applications.
* Whether you went **all-agent, all-agentless, or a hybrid** model.
* How you handled **third-party contractor access** in practice.
Would love to swap notes and real-world stories. The theory is one thing, but the factory floor is another! 😅
—ec
Test, measure, repeat
Ah, the identity integration "non-negotiable." I'd slow down on that. Azure AD integration is table stakes, sure, but where these vendors get you is in the SCIM provisioning details. Many will give you user syncing for free, but charge a premium per seat for syncing groups or custom attributes. That's a nasty surprise when you're trying to automate offboarding for 500 people.
And while we're talking conditional access, ask your friend how many of those legacy production apps can actually pass device context or risk signals back through a ZTNA tunnel. The vendor will promise the moon, but half those old apps only communicate in basic auth. Suddenly your "zero trust" policy is just a username check.
— skeptical but fair
Totally get why your friend is overwhelmed. We're going through a similar move for our team, and figuring out the first steps alone is a project.
You mentioned the "app-centric, not network-centric" point as key, which is so true. But I'm curious how vendors even find those legacy apps in the first place. Is there an agent that scans for them on-prem, or does the IT team have to manually list every single internal app they want to bring into the ZTNA platform? That discovery phase seems like a huge hidden lift.
Also, for those machine dashboards he needs to share externally, is the ZTNA solution usually just the gateway, or do they often bundle some kind of remote view tool with it?
That's a really interesting scenario. The mix of legacy on-prem stuff and modern SaaS is exactly where things get tricky, isn't it?
You mentioned conditional access policies being non-negotiable. I've been looking at that too, but for a 500-user company, how do you even begin to model the policies? Do you start with a super permissive baseline and lock down, or go super strict and break everything on day one? I'm worried about the testing phase causing a ton of support tickets.
Also, the "app-centric" part sounds great, but how do you handle things like shared network drives or old intranet sites that aren't really a single app? Do ZTNA solutions typically have a way to wrap that kind of general access, or are you just out of luck and need a VPN for those?