Run a ZTNA pilot on one internal web application with a clear owner and a small user group. Define who may reach it, which device checks apply, and what success looks like before you start. Expand only after you have compared support tickets, login failures and access logs with the old VPN path.
Pick the right first application
Choose something real but forgiving. An internal wiki, an admin dashboard or a staging environment works. Avoid the system that runs payroll or production deploys for your first try.
Good first candidates share these traits:
- Web based, so a browser can reach it through a proxy.
- A named owner who will answer questions.
- Fewer than a few dozen users.
- Already behind single sign on, or easy to put there.
Write the access rule before the config
A pilot fails when nobody agrees on who should get in. Write one sentence for the rule: "Members of group X, on a managed device with disk encryption and a current operating system, may reach application Y."
Then list the exceptions you will allow, such as a contractor group with expiry dates. Keep the exceptions short. Each one is a future audit question.
Fix identity first
NIST SP 800-207 treats authentication and authorization of users and devices as separate steps that happen before a session is established. In practice that means your identity provider must have clean groups, working MFA and current offboarding. If groups are stale, the pilot will mirror that staleness faithfully.
Run it beside the VPN
Do not cut over on day one. Give pilot users both paths for a few weeks. Ask them to use the new one by default and report anything that breaks.
Track a short list:
- Login failures and their causes.
- Tickets raised, and how many were device check problems.
- Time to first page load compared with the VPN.
- Access requests approved or denied.
Decide what you will do with the result
Set the decision in advance. For example: expand to the next three apps if tickets stay low and logs show the access rule worked as written. Roll back if the broker becomes a single point of failure you cannot support.
The CISA Zero Trust Maturity Model, version 2.0, describes progress in stages from traditional through initial and advanced to optimal. A one app pilot is a reasonable move from traditional to initial, not a finish line.
After the pilot
Move web apps first, then think about legacy protocols. Remove VPN access for each group when its apps have moved, not before. Offboarding remote access should cover both paths during the overlap.
Quick check
How long should a pilot run?
Long enough to cover a normal work cycle, including a few device updates and at least one onboarding or offboarding event. A few weeks is common, but set the length by what you need to observe.
Do I need a new product to pilot this?
Not always. Some identity providers and cloud platforms already offer identity aware proxies. Check what you own before you buy.
Sources
Last reviewed: 19 October 2026.
