Zero Trust Network Access (ZTNA) for Australian Business

Key facts

• ZTNA grants access per application based on identity and device posture, not blanket network access like a legacy VPN.
• It is built on the zero trust principles of verify explicitly, use least privilege, and assume breach.
• The two routes most Australian SMEs will consider are Microsoft Entra Private Access (part of Global Secure Access) and Tailscale.
• Microsoft Entra Private Access requires an Entra ID P1 or P2 licence, then either a standalone add-on (around US$5 per user per month) or the Entra Suite (around US$12 per user per month).
• ZTNA directly supports the ACSC Essential Eight goals around restricting access and limiting the blast radius of a compromised account.
• ZTNA is a strong fit for remote and hybrid teams, contractor access, and retiring hardware VPN concentrators.

What is zero trust network access?

Zero trust network access is an approach where no user or device is trusted by default, and access to each application is granted only after identity, device health, and policy are verified. The old model was simple and dangerous: get onto the VPN, and you were effectively inside the building with the run of the place. ZTNA flips that. A user is authenticated, their device is checked, and they are connected to the one application they are entitled to, nothing else. If their account is later compromised, the attacker reaches only what that user could reach, not the entire network.

The model rests on three principles that come up in every serious discussion of it: verify explicitly (check identity and context on every request), use least privilege (grant the minimum access needed), and assume breach (design as though an attacker is already inside, and limit how far they can move).

How is ZTNA different from a traditional VPN?

A traditional VPN connects a user to the network; ZTNA connects a user to a specific application, and that is the difference that matters. With a VPN, once the tunnel is up, the user’s device is on your LAN and can see whatever the network routing and firewall rules allow, which is usually far more than they need. With ZTNA, access is brokered per application against a policy, so someone who needs the accounting system does not also get a clear path to your file server, domain controller, or CCTV recorder.

There is also the practical side. VPN concentrators are hardware that ages, needs patching, and becomes a single point of failure and a favourite target for attackers. In our experience supporting Sydney SMEs, the old VPN box is very often the least-maintained device on the network, still running firmware from three years ago because nobody wanted to risk the downtime of an upgrade. ZTNA moves that function into a managed, identity-aware service and takes the ageing appliance out of the equation.

Which ZTNA solution is right for an Australian SME?

For most Australian SMEs the choice comes down to Microsoft Entra Private Access if you are already invested in Microsoft 365, or Tailscale if you want a fast, flexible mesh that is not tied to the Microsoft stack. Both are genuinely good. They suit different situations, and we deploy and manage both, so we have no reason to push one where the other fits better.

Microsoft Entra Private Access is the natural choice if you are already on Microsoft 365 Business Premium or an E-plan, because it builds on the Entra ID and Conditional Access policies you already have. It is part of Microsoft’s Global Secure Access offering, and it lets you extend the same MFA, device-compliance, and location rules you use for email and SharePoint to your internal applications. If your identity already lives in Microsoft, this keeps everything in one policy engine.

Tailscale is the better fit when you want something quick to deploy, work across mixed environments (on-premises servers, multiple clouds, developer machines), or connect infrastructure rather than just staff laptops. It builds a peer-to-peer mesh on the WireGuard protocol, deploys incrementally without touching your existing firewall rules, and is refreshingly simple to stand up. We have written a dedicated page on how we deploy and manage Tailscale for Australian businesses if that is the direction you are leaning.

There is a case for keeping a traditional VPN, to be fair: if you have a single site, a handful of staff, and a VPN that is patched and working, ripping it out for its own sake is not a priority. ZTNA earns its place when you have remote or hybrid staff, contractors needing scoped access, multiple locations, or a compliance driver. That is where the model pays for itself.

How does ZTNA support the Essential Eight and Australian compliance?

ZTNA directly supports the “restrict administrative privileges” and access-control goals of the ACSC Essential Eight by enforcing least-privilege access to applications. When every connection is tied to a verified identity and a policy, you get an audit trail of who accessed what and when, which matters both for the Essential Eight maturity model and for demonstrating reasonable security steps under the Privacy Act 1988 and the Notifiable Data Breaches scheme. If a breach does occur, being able to show that access was segmented and logged, rather than everyone having flat network access, is a materially better position to be in.

How do we deploy ZTNA for clients?

We start by mapping what actually needs remote access, then deploy incrementally so nothing breaks while the old access method is still running. The first step is an inventory: which applications, servers, and services do people genuinely need to reach remotely, and who needs each one. From there we stand up the ZTNA service (Entra Private Access or Tailscale), connect the first application to a pilot group, confirm it works, and expand in waves. Identity provider integration and MFA go in early, ACLs and device-posture rules follow, and the legacy VPN is only decommissioned once everything it carried has been moved across and verified. Done properly, staff barely notice the transition beyond things getting faster and simpler.