entra id private access vs traditional vpn: migration checklist
Checklist for migrating from traditional VPN to Microsoft Entra Private Access (ZTA). Covers app inventory, connector deployment, policy mapping, and pilot steps. Use when planning the migration. Not for troubleshooting either product.
TL;DR
Inventory every app users reach over VPN, deploy Private Access connectors on the app networks, map VPN group access to Private Access policies per app, pilot with one team, then migrate in waves. Do not turn off the VPN until the last app is verified reachable without it.
The error
(Migration planning; no error.)Steps
- Inventory VPN usage: survey or log what users actually access (file shares, intranet, RDP, dev tools). Expected: app list. You cannot migrate what you have not inventoried.
- Deploy the Private Access connector on each app network segment. Expected: connectors healthy in Entra. One connector group per network segment is the standard layout.
- For each app, create a Private Access policy: users/groups, the app's internal FQDN or IP, and the access requirements (compliant device, MFA). Expected: policies mirror the old VPN authorizations per app.
- Pilot with one team and one app. Expected: users reach the app with no VPN connected. Verify performance and collect feedback before widening.
- Migrate app by app, keeping the VPN as fallback. Expected: each wave verified. Only decommission the VPN when zero users need it, confirmed by gateway logs.
When to use
- Planning VPN-to-ZTA migration
- Evaluating Entra Private Access
When not to use
- Troubleshooting existing VPN issues
- Non-Microsoft ZTA products (concepts transfer, steps differ)
Compatibility
- Microsoft Entra ID P1+ with Internet Access/Private Access licensing; Global Secure Access client
Variants
Apps that need raw network access (not just TCP)
Private Access covers TCP/UDP per-app; anything exotic may need to stay on VPN longer.
Thick clients with hardcoded IPs
They work if the IP is in the policy, but prefer FQDNs for maintainability.
Why it happens
VPN grants network access; Private Access grants app access. The migration is really an authorization remodel: from "on the network" to "allowed to this app", which is more work than a client swap.
Edge cases
- Keep the VPN for break-glass admin access even after migration.
- User training: "no VPN" feels wrong to veterans; communicate early.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_3tKXswjQc2Z0Mt9t-DEXZA
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.