I'm evaluating whether to replace Azure VPN with a Zero Trust Network Access platform such as Twingate, ZeroTier, or Fortinet ZTNA. We only have a small number of users who work from home roughly four days a week, and our environment already includes Fortinet appliances on-premises and in the cloud. I understand the general Zero Trust model, but I need to explain the practical benefits to management. In particular, how would ZTNA work when users are in the office, and would you choose it over the current VPN? Our Azure VPN client also has reliability problems: connections often drop after a laptop is locked or idle, internal DNS stops working, and users may receive HTTP 403 errors and lose work. We also use BunkerWeb as a WAF.
4 Answers
For a small number of users, first confirm that the added licensing and administration are justified. If Azure VPN is secure and reliable after fixing MFA, device compliance, routing, DNS, and idle-timeout settings, keeping it may be the sensible choice. ZTNA becomes more compelling when users only need a few applications, when you want to avoid exposing a routable subnet, or when the VPN’s full-network access and reliability are ongoing problems. Compare actual operational and audit benefits rather than choosing based on product terminology.
A practical middle ground is to keep VPN access for workflows that genuinely require broad network connectivity while moving selected internal web apps and services to ZTNA. That lets you test application-specific access and user experience without making a risky all-at-once migration. Since your environment already includes Fortinet on-premises and in the cloud, also check whether its ZTNA and policy features can address the disconnect and DNS problems before evaluating unrelated products.
Users do not necessarily need a different experience in the office. You can apply the same identity- and device-based policies everywhere, rather than trusting someone simply because they are on the office LAN. Alternatively, office traffic can remain on-net while ZTNA handles remote access, but that is less consistent from a policy perspective. Given that you already operate Fortinet equipment, I would investigate Fortinet’s ZTNA capabilities before adding another vendor. Introducing a third remote-access platform alongside Azure VPN and Fortinet could create more operational work without solving the underlying issue. I also would not remove Azure VPN solely for the label of Zero Trust; pilot one or two applications and measure reliability, support effort, access control, and audit quality first.
Why should access policies become less strict just because someone is in the office? Applying the same identity-based controls on and off the corporate network seems more consistent, even if the actual traffic path differs.
The strongest security argument is limiting access to the specific applications and resources a person needs instead of putting them on a broad, routable network. For example, a Finance user might be allowed SMB access to a particular file service without being able to RDP to the server. Many ZTNA products also use outbound connectors, so there is no inbound VPN exposure into the environment. That can reduce the attack surface, although you still need to evaluate identity, device posture, logging, and application compatibility.
The main reason I’m considering a change is the VPN client’s reliability. After a laptop is locked or idle, the tunnel frequently drops, internal DNS no longer resolves correctly, and users can hit a 403 when they return. That interruption is more damaging than the security model itself, so I need to determine whether ZTNA would provide a more reliable user experience.