We are replacing our legacy VPN with a Zero Trust Network Access (ZTNA) solution.

That’s a solid modernization path. A successful VPN → ZTNA migration is less about replacing one remote-access product with another and more about changing the access model from “connect to the network, then access resources” to “authenticate and authorize access to each resource.” NIST’s Zero Trust Architecture guidance explicitly emphasizes protecting individual resources rather than trusting users because of their network location.

Recommended migration approach

1. Inventory what the VPN actually provides

• Applications and services reachable through the VPN
• Users, groups, contractors, and service accounts
• Network shares, RDP/SSH, databases, internal web apps, etc.
• Dependencies that assume the user is “on the corporate network”
• Legacy applications that cannot work with an agent, proxy, or identity-based access

2. Map applications to identities

• Integrate ZTNA with your IdP/SSO.
• Require strong MFA, preferably phishing-resistant MFA where practical.
• Establish device posture requirements: managed device, encryption, EDR status, OS version, certificate, etc.
• Define access around user + device + application + context, rather than IP/subnet membership. NIST describes dynamic context such as identity, device health, resource sensitivity, and anomalous behavior as inputs to access decisions.

3. Create application-specific policies

For example:

Finance users + compliant corporate device → ERP

Developers + managed device + MFA → Git/CI

Contractors + MFA → specific web application only

Avoid recreating the VPN by giving a user broad access to an entire subnet. CISA similarly recommends moving controls closer to applications and resources and away from traditional perimeter-based security. CISA 4. Run VPN and ZTNA in parallel

• Start with a low-risk application.
• Pilot with a representative user population.
• Monitor authentication failures, application dependencies, latency, and help-desk volume.
• Gradually move applications and user groups to ZTNA.
• Keep the VPN as a controlled fallback during migration.

5. Handle non-ZTNA-friendly workloads explicitly

Some things won't migrate cleanly, particularly legacy protocols, network discovery, unusual UDP applications, broad administrative access, and systems that fundamentally require network-level connectivity. NIST's implementation guidance emphasizes that there isn't one migration approach suitable for every enterprise and that ZTA is an incremental evolution. NIST Pages 6. Decommission the VPN only after proving the replacement Before shutting it down, verify:

• 100% of required business applications have an access path.
• Break-glass/admin access is documented.
• Logging reaches your SIEM.
• Access policies have owners.
• Device and identity lifecycle events automatically affect access.
• Third-party and service-account access has been addressed.
• There are no undocumented VPN-dependent workflows.

A useful target architecture

User → IdP/MFA → ZTNA policy decision → ZTNA enforcement point → specific application

rather than:

User → VPN → corporate network → many reachable applications

That distinction is the heart of the migration. CISA has also specifically recommended moving organizations toward Zero Trust/SSE/SASE approaches while highlighting the risks associated with traditional remote-access VPN deployments and misconfiguration.

If you're planning the project, I can also lay out a 90-day VPN-to-ZTNA migration plan, including phases, workstreams, policy design, pilot criteria, testing, and VPN decommissioning gates.

Migrating from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a major upgrade for security, user experience, and network visibility.

Here is a structured, scannable roadmap to help guide your transition:

• Asset discovery: Map all internal applications, legacy services, databases, and network resources currently behind the VPN.

• User profiling: Identify user groups (employees, contractors, third-party vendors) and their specific access requirements.

• Legacy dependency check: Identify apps using non-standard or legacy protocols (like UDP/heavy TCP streaming) that might not map cleanly to standard ZTNA connectors.

• Deployment model: Decide between cloud-delivered ZTNA (SaaS edge) or agent-based vs. agentless (browser-based) access.

• Identity provider (IdP) integration: Ensure deep integration with your existing IdP (e.g., Azure AD/Entra ID, Okta) to enforce multifactor authentication (MFA) and contextual access policies.

• Pilot group selection: Pick a tech-savvy or isolated department (like IT or a specific engineering team) to test the initial rollout.

• Micro-segmentation: Move away from "network-level access" to "application-level access." Users should only connect to the specific apps they are authorized to see.

• Contextual guardrails: Build policies incorporating device posture (compliant, encrypted, managed) and location risk.

• Phased enforcement: Start in audit/monitoring mode if supported, then move to blocking unauthorized requests.

• Dual-running period: Run the ZTNA solution alongside the legacy VPN for a designated transition window.

• User training: Provide clear documentation for end-users on how to access internal resources via the new ZTNA client or portal.

• Telemetry monitoring: Watch connection success rates, latency, and helpdesk ticket volumes closely during the initial waves.

• Cutover completion: Migrate all remaining user groups off the legacy VPN.

• Access revocation: Disable VPN gateways, firewall rules permitting inbound VPN traffic, and old credentials.

• Post-migration review: Audit logs and finalize the transition documentation.

To help tailor this transition strategy, let me know:

• What ZTNA vendor or IdP are you leaning toward or currently using?
• Do you have legacy apps that rely on non-web protocols?

I can give you more specific advice on connector placement or handling legacy apps.

That’s a sensible modernization path. The key is to treat the project as an access-model transformation, not simply a VPN replacement. NIST recommends an incremental, risk-based migration, and current NCSC guidance specifically warns against leaving legacy VPN paths that bypass ZTNA policy enforcement.

A practical migration approach is:

1. Inventory current VPN usage

• Users, groups, devices, applications, servers, and third parties.
• Identify what each VPN profile actually provides access to.
• Map application dependencies and traffic flows.
• Identify legacy systems that cannot immediately support ZTNA.

2. Define the access policies

• Move from “user is on the corporate network” to “this authenticated user/device may access this specific application.”
• Incorporate identity, MFA, device posture, role, application sensitivity, and other contextual signals.
• Apply least privilege and per-application access rather than broad network connectivity. NCSC identifies policy enforcement, multiple signals, continuous reevaluation, application minimization, observability, and resilience as core ZTNA design requirements.

3. Pilot with low-risk applications

• Select a representative set of applications and users.
• Run ZTNA alongside the VPN initially.
• Measure authentication success, application compatibility, latency, help-desk volume, policy violations, and user experience.

4. Migrate in waves

• Move applications and user populations incrementally.
• Prioritize high-value applications where eliminating broad network access provides a significant security benefit.
• Keep a tightly controlled VPN exception process for genuinely incompatible legacy systems.

5. Integrate the surrounding controls

• Identity provider/SSO and strong MFA.
• Endpoint management and device-health signals.
• SIEM/security monitoring.
• DNS and application discovery.
• Privileged-access controls for administrators.
• Logging sufficient to reconstruct access decisions.

6. Decommission the VPN deliberately

• Remove old VPN profiles and firewall rules.
• Close unnecessary VPN-facing infrastructure.
• Update network diagrams, runbooks, incident-response procedures, and access reviews.
• Verify that no alternative route lets users bypass the ZTNA policy engine. NCSC explicitly identifies retaining such parallel routes as a ZTNA anti-pattern.

The biggest architectural shift

With the legacy VPN, the model is often:

User → VPN → trusted network → many reachable resources

With ZTNA, aim for:

User + device + context → policy decision → specific application/resource

That distinction matters more than the particular ZTNA vendor. CISA and its partner agencies likewise recommend moving away from broad remote-network access toward granular, risk-based access controls.

NIST's 2025 implementation guidance is particularly useful here because it includes 19 example Zero Trust architectures and emphasizes inventory, policy, incremental implementation, and continuous improvement.

If you're developing the migration program, I can also lay out a 90-day ZTNA migration roadmap, including workstreams, milestones, KPIs, pilot criteria, and VPN decommissioning gates.

Migrating from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a massive upgrade for your security posture and remote user experience.

Here is a quick-hitting guide to setting up a successful ZTNA rollout:

Key Migration Phases

1. Discovery and Mapping
   • Inventory all existing internal applications, data repositories, and legacy user access patterns.
   • Categorize applications by sensitivity, user dependency, and protocol type (HTTP/HTTPS vs. legacy non-web protocols like TCP/UDP).
2. Policy Definition
   • Shift from network-level trust (IP addresses, subnets) to identity- and context-aware policies (user identity, device posture, location, and risk score).
   • Define least-privilege access rules per application or micro-segment rather than blanket network access.
3. Pilot and Testing
   • Deploy the ZTNA connector/gateway and enroll a small, tech-savvy pilot group (e.g., IT or engineering).
   • Test both standard web apps and edge-case legacy applications to validate latency, routing, and user experience.
4. Phased Rollout
   • Migrate non-critical business units or remote branch offices first.
   • Gradually transition high-privilege users (like developers and admins) and mission-critical legacy applications.
5. Decommissioning Legacy VPN
   • Monitor fallback usage and ensure no lingering legacy dependencies remain.
   • Revoke VPN credentials, turn off concentrators/gateways, and close inbound firewall ports associated with the old VPN.

Popular ZTNA Solutions to Compare

• Cloudflare One (explore options on the Cloudflare Zero Trust platform)
• Zscaler Private Access (learn more via Zscaler ZPA)
• Palo Alto Networks Prisma Access (check details on Prisma Access)
• Microsoft Entra Private Access (overview available on Microsoft Entra)

To help tailor this migration plan, tell me:

• What legacy applications (e.g., SSH, RDP, SMB, custom fat-client apps) are you most concerned about supporting?
• Are you leaning toward a vendor-managed cloud service (SSE/SASE) or an on-premises/hybrid controller model?

Here are top web results for exploring this topic:

Microsoft Community Hub·https://techcommunity.microsoft.com**Replace your legacy VPN** with an identity-centric ZTNA Microsoft Entra Private Access offers a modern solution to replace VPNs with an identity-centric Zero Trust Network Access (ZTNA) approach, ensuring secure, precise access to private apps and resource Fortra·https://www.fortra.com**Replace legacy VPN with a zero trust network access** (ZTNA) solution.The Solution. VPNs serve a wide range of use cases, but many of those use cases are outdated. If anything, VPNs' static security measures are no longer adequate, nor do they help with productivity. Ze Versa Networks·https://versa-networks.com**Replace VPN** with ZTNA: Zero Trust Network Access vs VPN Why organizations are replacing legacy VPNs with Zero Trust Network Access (ZTNA), the key differences in security and performance, and how to migrate securely. Zscaler·https://www.zscaler.com How Does ZTNA Replace Traditional VPN Solutions ? | Zpedia What Is Zero Trust Network Access (ZTNA)?. Zero trust network access (ZTNA), is a security model that grants authenticated users rights to only the specific resources they need instead of opening up t Reddit·https://www.reddit.com Has anyone replaced their VPN with ZTNA and was it worth it?We replaced legacy VPN for most internal apps with ZTNA about 18 months ago. The biggest win was identity-aware access and reducing lateral movement risk. User experience improved too, especially for Zero Networks·https://zeronetworks.com**Replace** Outdated VPN with ZTNA | Secure Zero Trust Access Replace VPN with ZTNA — Without Shortcomings. Connect remote employees and third parties to the network with zero trust principles and zero performance impact. Request a Demo; Watch the Video ... Repl YouTube·https://www.youtube.com**Replace your Legacy VPN** with an Identity Centric ZTNA Solution Join us for a webinar to explore why it's time to replace your legacy VPN with identity-centric Zero Trust Network Access (ZTNA). Traditional VPNs often lack the security and flexibility needed today, iCertGlobal·https://www.icertglobal.com Can "Zero Trust Network Access" (ZTNA ) completely replace your ...We finished our VPN retirement project last summer. For the legacy apps, we used a "ZTNA Connector" that acts as a proxy. The user authenticates with their modern IDP, and the connector handles the le DefensX·https://www.defensx.com Why It's Time to Move Beyond VPN: The Shift to ZTNA - DefensX VPNs no longer protect today's hybrid and identity-driven world. Learn why Zero Trust Network Access (ZTNA) delivers safer, faster, application-level security for modern organizations. TechnologyMatch·https://technologymatch.com**Replacing** Cisco AnyConnect with ZTNA : A Migration Guide for IT ...Cisco AnyConnect 4.x is end-of-life. Cisco's upgrade path exists but staying on Secure Client with VPNaaS isn't the same as going Zero Trust. This guide covers what a genuine ZTNA migration requires,

Understood. Replacing a legacy VPN with ZTNA is best treated as an access-architecture transformation, not simply a VPN product swap.

A sound migration should focus on:

• Identity-first access: authenticate and authorize every request rather than trusting someone because they are “on the VPN.”
• Application-level access: give users access to specific applications/resources rather than broad network connectivity.
• Device posture: incorporate device health, management status, OS version, security controls, and other relevant signals into policy.
• Least privilege: grant only the applications and permissions each user needs.
• Continuous evaluation: reassess access as identity, device, risk, and policy conditions change.
• Segmentation: prevent a compromised account or endpoint from moving laterally through the environment.
• Phased migration: inventory applications and dependencies, prioritize workloads, pilot ZTNA, then progressively retire VPN access.

NIST's current implementation guidance specifically recommends a gradual, risk-based migration and provides 19 example ZTA implementations. NIST Computer Security Resource Center NIST Pages The UK's NCSC also cautions against leaving broad VPN access running indefinitely alongside ZTNA because it can reintroduce implicit trust and undermine the architecture.

A practical target architecture is:

User → IdP/MFA → ZTNA policy engine → policy enforcement point → specific application

rather than:

User → VPN → corporate network → many reachable systems

If you're planning the migration, I can help with a ZTNA migration roadmap, target architecture, requirements/RFP, application-migration strategy, or VPN-to-ZTNA comparison.

Migrating from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a major milestone for modernizing corporate security.

To help you navigate this transition smoothly, here is a breakdown of the core strategy, phased rollout, and key considerations:

• Discovery and Mapping : Audit your existing legacy VPN usage. Identify who connects, what applications they access (internal web apps, legacy thick-client apps, file shares), and who owns those resources. You cannot secure what you do not map.
• Policy Redefinition : Move away from network-level perimeter trust (IP addresses and subnets) to identity- and context-aware policies. Define rules based on user identity, device health/compliance, location, and data sensitivity.
• Pilot Program (Low-Risk Users) : Start by migrating a non-critical group—such as a remote engineering team or IT staff—using a pilot ZTNA deployment. This helps validate user experience and uncovers any hidden application dependencies.
• Application Onboarding : Prioritize moving high-value or most-used web applications to the ZTNA gateway first. For legacy or non-web applications, verify if your chosen ZTNA vendor supports secure TCP/UDP tunneling or requires micro-segmentation connectors.
• Phased Decommissioning : Gradually transition all user groups off the legacy VPN. Once the final department is migrated, monitor traffic for a buffer period before revoking VPN credentials and turning off the hardware or virtual appliances.

To help tailor this transition plan, let me know:

• What ZTNA vendor or platform are you leaning toward or currently evaluating?
• Are your internal resources primarily cloud-hosted, on-premises , or a hybrid mix?
• Do you have legacy/non-web apps that rely on thick clients or specific protocols?

Moving from a legacy VPN to a Zero Trust Network Access (ZTNA) solution is a significant architectural change. The main shift is from network-level trust (“authenticate once, then access the network”) to application-level, policy-driven access (“verify every request and grant only the required access”).

A typical migration approach looks like this:

1. Assess your current VPN usage

Inventory:

• Users and groups using VPN
• Applications and services accessed through VPN
• Remote administration workflows
• Third-party/vendor access
• Dependencies on network-level access (file shares, legacy apps, admin tools)

The goal is to understand what should become application access rather than simply recreating VPN connectivity in a new platform.

2. Establish identity and device foundations

ZTNA decisions usually depend on signals such as:

• User identity and role
• MFA strength
• Device compliance/posture
• Endpoint security status
• Risk signals
• Location or behavioral context

Strong identity management, SSO, phishing-resistant MFA, and device visibility are key prerequisites.

3. Define access policies

Replace broad VPN rules like:

“Employees on VPN can reach the internal network”

with granular policies like:

“Finance users on managed devices with MFA can access the finance application.”

Examples:

• Developers → development environments only
• HR → HR systems only
• Vendors → specific applications and time-limited access
• Administrators → privileged access workflows

ZTNA should enforce least privilege and avoid exposing entire networks after authentication.

4. Deploy ZTNA alongside the VPN initially

A common migration pattern:

1. Select a small application set
2. Publish those applications through ZTNA
3. Pilot with a limited user group
4. Measure access issues and user experience
5. Expand application-by-application
6. Retire VPN access gradually

Avoid a “big bang” replacement unless your environment is simple.

5. Protect private applications

For internal applications, good ZTNA designs typically:

• Keep applications off the public internet
• Use connectors/proxies to broker access
• Segment applications to limit lateral movement
• Apply policy before allowing connections

6. Update operations and monitoring

Plan for:

• Logging of access decisions
• Integration with SIEM/SOC tooling
• Incident response workflows
• Policy reviews
• User lifecycle management

ZTNA should provide visibility into who accessed what, when, from which device, and why access was allowed or denied.

Common migration pitfalls

Avoid:

• Recreating a “VPN behind a new logo” with broad network access
• Allowing all users access to all applications
• Ignoring device posture
• Migrating without cleaning up old VPN permissions
• Treating ZTNA as a standalone product instead of part of a broader zero trust strategy

A successful migration usually combines ZTNA with:

• Identity provider improvements
• MFA
• Endpoint management/EDR
• Application segmentation
• Privileged access management
• Strong monitoring

If you are planning this migration, the next useful step is usually building a VPN-to-ZTNA application migration matrix (current VPN access → target application policy → user groups → rollout phase).

That’s a sound modernization path. The key is to treat ZTNA as an access-architecture transformation, not simply a one-for-one VPN replacement. CISA specifically recommends moving toward modern approaches such as Zero Trust because traditional VPN deployments can create significant risk when misconfigured or compromised.

A practical migration approach would be:

1. Inventory the VPN estate

   • Users, applications, servers, privileged/admin access, service accounts, and third parties.
   • Identify which applications actually require network-level connectivity versus application-specific access.
   • Document dependencies and legacy systems that cannot immediately support ZTNA.

2. Establish the identity foundation

   • Centralize authentication through your IdP.
   • Require phishing-resistant MFA where feasible.
   • Tie access decisions to user identity, device posture, role, and risk.
   • Eliminate shared accounts wherever possible.

3. Define application-level access policies Instead of:

   “User is on the corporate VPN → user can reach the internal network”

   Move toward:

   “This authenticated user, on this compliant device, under these conditions → may access this specific application.”

   This aligns with Zero Trust's least-privilege and per-resource access model.

4. Pilot before removing the VPN Start with a relatively contained population and several representative applications. Measure:

   • Authentication success/failure
   • User experience and latency
   • Application compatibility
   • Policy exceptions
   • Help-desk volume
   • Security telemetry

5. Migrate application groups incrementally A useful sequence is: low-risk apps → standard business apps → sensitive apps → privileged/admin access → difficult legacy applications.

   Don't force legacy systems into an unsuitable ZTNA pattern; isolate them and develop a separate modernization or compensating-control strategy.

6. Reduce lateral movement ZTNA should be paired with segmentation/microsegmentation rather than becoming a new centralized gateway that recreates the VPN's implicit trust model. CISA's current guidance highlights microsegmentation as a way to reduce attack surface and limit lateral movement.

7. Run VPN and ZTNA in parallel temporarily Maintain a controlled rollback path while validating coverage. Establish explicit exit criteria for each VPN use case rather than setting an arbitrary “VPN shutdown” date.

8. Decommission deliberately Once application coverage, users, devices, policies, logging, and operational procedures are validated:

   • Remove unused VPN accounts/configurations.
   • Close VPN exposure.
   • Retain required logs/configuration records.
   • Update incident-response procedures and network diagrams.
   • Monitor closely after cutover.

The architecture shift

Legacy VPN:

User → VPN gateway → trusted network → application

ZTNA:

User + Device + Context → Identity/Policy → ZTNA enforcement → Specific application

That distinction is important: CISA's Zero Trust Maturity Model describes moving away from broad perimeter/macro-segmentation toward service-specific connectivity and eventually dynamic, just-in-time, just-enough access.

If you're designing the migration now, I would make the application inventory + dependency mapping + access-policy model the first major deliverable. Those three things will determine whether the actual VPN retirement is straightforward or painful.

Moving from a legacy VPN to a Zero Trust Network Access (ZTNA) architecture is a major milestone for modernizing your organization's security posture. ZTNA shifts the paradigm from "trust, then verify" to "never trust, always verify," granting least-privilege access per application rather than broad network-level access.

Key Benefits of Transitioning to ZTNA

• Reduced Attack Surface : Eliminates lateral movement by hiding internal applications from the public internet and exposing only specific apps to authenticated, authorized users.
• Improved User Experience : Provides fast, seamless connections without the friction of traditional full-tunnel or split-tunnel VPN clients.
• Granular Contextual Access : Evaluates device posture, identity, location, and risk signals before granting access to individual resources.
• Simplified Management : Replaces complex internal firewall rules and legacy remote-access appliances with cloud-managed policies.

Recommended Migration Steps

1. Discovery and Inventory : Map out all legacy VPN usage, including user groups, internal applications (IP ranges, ports, protocols), and external third-party vendors.
2. Define Policies and Grouping : Categorize applications by sensitivity and map user identities (leveraging your IdP like Okta, Entra ID, or Ping) to the appropriate access groups.
3. Pilot with a Non-Critical Group : Roll out the ZTNA solution to a pilot group (such as an IT or engineering team) to test performance, device posture checks, and app compatibility.
4. Phased Application Migration : Move applications over incrementally—starting with SaaS-adjacent or web apps, followed by legacy client-server or TCP/UDP apps.
5. Sunset the Legacy VPN : Revoke legacy VPN access profiles and decommission hardware appliances once all workflows have transitioned and stabilized.

To help tailor this transition strategy, could you tell me:

• What ZTNA vendor or solution you are considering (e.g., Cloudflare, Zscaler, Palo Alto Prisma, Tailscale)?
• What kind of legacy applications you need to support (web-based, thick-client, SSH/RDP, or non-HTTP protocols)?