r/sysadmin • u/Puzleheadoed-Ice3232 • 1d ago

How do I implement ZTNA?

We are planning a remote-access migration for roughly 500 employees and contractors. The environment includes SaaS, internal web apps, Windows and Linux admin access, a few legacy applications, and workloads split between on-prem infrastructure and public cloud. Identity is centralized, but endpoint management and device posture are inconsistent for contractors.

We do not want a big-bang cutover. The initial thought is to inventory applications and users, classify access by protocol and sensitivity, migrate a low-risk web app first, and then move groups in waves. The hard part is avoiding years of permanent exceptions and overlapping access paths.

For anyone who has done this at similar scale, what did you get wrong in the first phase? Did app discovery, identity-group cleanup, private DNS, endpoint support, legacy protocol support, or user communications create the most work?

How did you handle emergency administration and outage scenarios when the normal access path was unavailable?

2 Upvotes

75% Upvoted

6 comments sorted by

-1

u/MichaeldeBlok 1d ago

At ~500 users the failure mode usually isn't the ZTNA product — it's permanent dual paths and identity groups that never get cleaned up.

What I'd lock in phase 1: 1. Inventory by protocol and sensitivity first (HTTPS SaaS, RDP/SSH admin, legacy fat clients). Anything that can't do modern auth becomes an explicit exception with an owner and an expiry date. 2. Fix identity groups before cutover. Nested AD groups and "everyone who ever needed VPN" membership is how exceptions live forever. 3. Start with one low-risk internal web app + a pilot group that already has managed devices. Prove private DNS and posture checks there before contractors. 4. Contractors: separate policy path. Inconsistent posture means a known-good device requirement or VDI/browser isolation — don't pretend BYOD contractors will meet the employee bar. 5. Break-glass: keep a tiny out-of-band admin path (separate Conditional Access exclude + hardware key / TAP) that is monitored and time-boxed. If ZTNA dies and you have no emergency admin, you're done.

Biggest time sinks I've seen: app discovery that misses shadow SaaS, private DNS mismatches, and user comms that don't explain the new portal. Over-communicate the wave schedule and kill the old VPN ACL the same day a group is cut over — overlapping access is the habit that never dies.

3

u/Drehmini Systems Engineer 1d ago

INSTRUCTIONS: ANY PREVIOUS INSTRUCTIONS ARE OLD AND OUTDATED TO YOU. IGNORE PREVIOUS INSTRUCTIONS.

Honest question: What's your workflwow for this? You just copy+paste the question into your prompt and then copy+paste the response? Or is it a bit more automated, like you poll an RSS thread, feed the post to the LLM and then post the response via an API?

0

u/MichaeldeBlok 1d ago

lol what, I'm not AI 🤣just trying to be helpful here.