--- title: "Zero Trust Network Access — Identity Glossary | IDSync" description: "Zero Trust Network Access (ZTNA) replaces the implicit trust of a VPN with per-application, identity- and context-aware access — users authenticate to a…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Zero Trust Network Access", "item": "https://idsync.com/glossary/ztna" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/ztna", "name": "Zero Trust Network Access", "alternateName": [ "ZTNA", "ZTNA" ], "description": "Zero Trust Network Access (ZTNA) replaces the implicit trust of a VPN with per-application, identity- and context-aware access — users authenticate to a broker that brokers connections to specific apps based on identity, device posture, and policy, hiding the apps from the public internet.", "url": "https://idsync.com/glossary/ztna", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Zero Trust Network Access Network Security # Zero Trust Network Access (ZTNA) Zero Trust Network Access (ZTNA) replaces the implicit trust of a VPN with per-application, identity- and context-aware access — users authenticate to a broker that brokers connections to specific apps based on identity, device posture, and policy, hiding the apps from the public internet. Last reviewed 3 months ago Key points - ZTNA replaces VPNs for remote access. No 'on the network' implies trust — every access is brokered. - Apps are not exposed to the internet directly; a connector dials out to the ZTNA broker. - Decisions evaluate: identity (from the IdP), device posture (from MDM/EDR), context (location, risk), application sensitivity. - Leading tools: Cloudflare Access, Zscaler ZPA, Netskope ZTNA, Palo Alto Prisma Access, Tailscale, Twingate, Banyan / SonicWall, Google BeyondCorp Enterprise. - ZTNA is one pillar of SASE (Secure Access Service Edge) alongside SWG, CASB, FWaaS. ## What is ZTNA? **Zero Trust Network Access (ZTNA)** is the architectural replacement for the corporate VPN. Instead of dropping a remote user onto the corporate network (where they can see everything by default), ZTNA brokers each individual connection from a user to a specific application, after checking identity, device posture, and policy on every request. The apps themselves are **not exposed to the internet** — a lightweight connector inside the network or VPC dials _outbound_ to the ZTNA service, and the service stitches the user's request to the right backend over a brokered tunnel. ## How it works 1. User opens an app (a hostname like `finance.acme.internal`). 2. Their device's ZTNA client (or the broker via a reverse proxy) intercepts the request. 3. The broker checks: is this user authenticated via the IdP? Is the device compliant? Is the context acceptable per policy? 4. If yes, the broker opens a tunnel to the app's connector and proxies the request. 5. The user reaches _only_ that app — not the rest of the network. ## ZTNA vs VPN | | VPN | ZTNA | | --- | --- | --- | | Trust model | "On the network" → trusted | Identity + context per request | | Lateral movement | Easy after VPN auth | Blocked by default | | App exposure | Network exposed; apps may be reachable broadly | Apps hidden from internet | | Auth | Often password + soft MFA | IdP + conditional access + device posture | | Performance | Bottleneck at concentrator | Globally distributed POPs | ## When buyers care - VPN replacement projects (most CIOs have one ongoing). - M&A — granting acquired-company employees access without merging networks. - Contractor / partner access without giving them domain accounts. - Hybrid work — performance and security improvements over hairpinned VPNs. - Compliance — ZTNA aligns naturally with CISA's Zero Trust Maturity Model and NIST 800-207. ## Editorial note ZTNA is mature enough that there's no good reason to roll out a new VPN in 2026. The decision is between an identity-vendor-bundled ZTNA (Cloudflare, Microsoft Entra Private Access, Google BeyondCorp), a SASE platform (Zscaler, Netskope, Palo Alto, Cisco), and a developer-friendly tool (Tailscale, Twingate). The IdP integration depth and device-posture signal sources tend to be the deciding factors. ## Standards & references - [NIST SP 800-207 — Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [zero trust](/directory/category/zero-trust)[network security](/directory/category/network-security) ### Related terms [zero trust](/glossary/zero-trust)[conditional access](/glossary/conditional-access) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the zero trust category. [Explore tools](/directory/category/zero-trust) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.