implementing-zero-trust-network-access

Inventory applications behind the VPN, deploy identity-aware proxies such as AWS Verified Access or GCP IAP, enforce MFA and device compliance through conditional access policies, then migrate users in phases and decommission the VPN after validating access logs.

Create a Verified Access trust provider of type OIDC pointing to your IdP endpoints, attach it to a Verified Access instance, then create a group with a policy document gating on verified-access:user/groups and an endpoint targeting your load balancer.

No. Creating a private endpoint does not isolate the service unless publicNetworkAccess is set to Disabled on the PaaS resource. Verify with az webapp show --query publicNetworkAccess and confirm the public hostname no longer resolves to a routable IP.

NetworkPolicy resources are silently ignored on clusters using a non-enforcing CNI such as plain kubenet. Confirm an enforcing CNI like Calico or Cilium is installed, then test by connecting from an unauthorized pod and expecting a timeout.

ZTNA complements but does not replace firewalls and network ACLs, is unsuitable for internet-facing public applications where a WAF fits better, and does not work for IoT devices that cannot perform identity-based authentication.