RemoteZTNA explained
A VPN lets people onto the network. ZTNA lets them into one app.
Remote access VPNs sit on the internet, get attacked constantly and, once connected, often reach far more than the user needs. Zero Trust Network Access checks the person and the device, then connects them to a single application. Here is how it works, what you may already own, and a tool that maps what is behind your VPN to its replacement.
Microsoft licensing from Microsoft Learn; edge device guidance from ASD. Checked 31 October 2026.
- VPN risks explained
- What Microsoft includes
- VPN exit planner
Reviewed by Blake Bath, General Manager, on 31 October 2026.
Why VPNs are a problem
Four reasons remote access VPNs are a risk.
Exploiting vulnerabilities was the most common way into breaches in Verizon's 2026 report, at 31%. Internet-facing remote access is exactly that kind of target.
Exposed to the internet
The VPN device has to be reachable, so every new flaw in it is attacked quickly.
- Patch in days
- No exposed admin
- Logging on
Too much access
Once connected, users can often reach the whole office network.
- Per-app access
- Segmentation
- Least privilege
No device check
A compromised home computer with valid details gets the same access as a managed laptop.
- Device compliance
- EDR healthy
- Managed only
Little visibility
Logs show addresses talking, not which person used which app.
- Per-app logs
- Identity in logs
- Alerts
VPN exit planner
What is behind your VPN, and what replaces it?
Pick what people still reach over the VPN. You get a replacement for each, and whether you need a ZTNA product at all.
Tell us what still sits behind your VPN. You get the replacement for each, and whether you need a ZTNA product at all.
Your path
Phase in ZTNA
- File shares. Move them to SharePoint and Teams where possible. That removes the reason for a tunnel at all.
- Remote desktop and servers. Use a ZTNA product per app, such as Entra Private Access (an add-on licence on top of P1), so users reach one host, not the network.
- Until the VPN is gone, patch it within days of any fix, require MFA on it, and watch its logs. Internet-facing remote access devices are a favourite target.
- Set a date to switch the VPN off, or both paths stay open indefinitely.
Step by step
How ZTNA connects someone to an app.
- A connector inside your networkA small service reaches out to the ZTNA cloud. No inbound firewall rules.
- Apps published one by oneA remote desktop host, an internal web app, a file server, each defined separately.
- The person signs inThrough your identity provider, with MFA and Conditional Access.
- The device is checkedManaged, encrypted, updated and protected, or access is limited.
- Access to that app onlyNo route to anything else on the network.
- Checked again during the sessionIf the risk changes, the session can be cut.
What you may own
What Microsoft 365 already covers.
| Option | What it covers | Licence |
|---|---|---|
| SharePoint and Teams | Files, without any tunnel | Most Microsoft 365 plans |
| Entra application proxy | Internal web apps, published with Conditional Access | Entra ID P1 (Business Premium, E3, E5) |
| Entra Private Access | Full ZTNA for servers, remote desktop and other protocols | Standalone or Entra Suite, plus Entra ID P1 |
Other ZTNA products work well too, especially if you use another identity provider or firewall platform. Choose by what you already run.
The meantime
Keeping the VPN safe until you switch it off.
ASD and its partners published guidance on securing edge devices in February 2025. The essentials for a small business:
- Patch fastApply vendor fixes for the VPN within days, not at the next maintenance window.
- MFA on every connectionNo VPN account without MFA, including suppliers.
- No admin page on the internetManage the device only from inside the network.
- Logs kept and watchedSign-ins and admin changes sent somewhere an attacker cannot wipe.
Our view
Often the cheapest fix is needing less remote access.
When we inventory what sits behind a small business VPN, it is usually file shares and one or two apps. Moving files to SharePoint and publishing web apps through application proxy can retire the VPN without buying anything new.
Where servers and remote desktop remain, ZTNA is the right replacement. We pilot one app with a small group, move the rest one at a time, and set the date the VPN is switched off.
The order
Moving off the VPN in five steps.
- Step 1Inventory
Every app, share and host people reach over the VPN.
- Step 2Shrink it
Files to SharePoint, web apps to application proxy.
- Step 3Pilot ZTNA
One app, a small group, measured.
- Step 4Move the rest
App by app, in order of risk.
- Step 5Switch off the VPN
On a set date, with the port closed.
Related guides
Zero trust in practice. Identity, devices, network.
The controls ZTNA depends on.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about ZTNA.
What is ZTNA in simple terms?
Zero Trust Network Access gives a person access to one application at a time, after checking who they are and whether their device is healthy. They never get a tunnel onto the whole network, so a compromised laptop cannot wander to other systems.
Do we need ZTNA if we already have a VPN?
Not always. If the VPN is only used for file shares and a couple of web apps, moving files to SharePoint and publishing the web apps through an identity-aware proxy may be enough. ZTNA earns its place when people still need servers, remote desktop or client-server apps.
Does Microsoft 365 include ZTNA?
Not fully. Entra ID P1, in Business Premium and E3, includes Entra application proxy for internal web apps. Full ZTNA, Entra Private Access, is a separate licence or part of the Entra Suite, and needs Entra ID P1 or P2.
Does ZTNA replace our firewall?
No. ZTNA replaces remote access. You still need a firewall for internet traffic, segmentation in the office and anything that has to be exposed.
How long does a VPN to ZTNA move take?
It depends on how many apps sit behind the VPN. Start with one pilot app and a small group, then move app by app. Set a switch-off date for the VPN so both paths do not stay open forever.
Can contractors use ZTNA?
Yes. They sign in through your identity provider with their own account, get access to only the apps they need, and the access can expire with the contract. That is safer than handing out VPN accounts.
Next step
Want to retire your VPN?
We inventory what sits behind it, move what can go to the cloud, and publish the rest app by app, then switch the VPN off on a set date.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. Microsoft licensing from Microsoft Learn, edge device guidance from ASD, breach data from a summary of Verizon's 2026 report. Checked 31 October 2026. Microsoft Learn, What is Global Secure Access; Microsoft Learn, Microsoft Entra licensing; ASD, Mitigation strategies for edge devices: practitioner guidance; Positive Technologies, Verizon DBIR 2026 summary