Multicloud AI & ERP / Cloud Networking, Edge & Zero Trust for AI
Why it matters
Traditional VPNs grant broad network access once a user connects, so a stolen laptop or password exposes far more than one application. Zero-trust access narrows that to exactly the apps a person needs, only while their device is healthy.
How it works
How a zero-trust decision is made
A user opens an internal application. The access proxy checks identity (sign-in with MFA), device posture (managed, patched, encrypted) and context (location, risk) against a per-application policy. Only then is the request passed to the private app, which never needs to be on the internet.
Every request, not every session
Decisions are re-evaluated continuously. If a device falls out of compliance or a sign-in looks risky, access stops immediately, without anyone touching a firewall.
AWS, Azure and Google Cloud compared
| AWS | Azure | Google Cloud | |
|---|---|---|---|
| Zero-trust access | AWS Verified Access | Microsoft Entra Private Access | Identity-Aware Proxy |
| Identity | Identity Center or any OIDC provider | Microsoft Entra ID | Cloud Identity or federation |
| Device signals | Device trust providers | Intune compliance | Endpoint Verification |
| Policy language | Cedar policies | Conditional Access | Access levels, IAM conditions |
| Broader platform | Verified Access | Global Secure Access | Chrome Enterprise Premium |
| Admin access without public IPs | Session Manager | Bastion | IAP TCP forwarding |
What makes each cloud different
AWS
AWS Verified Access evaluates Cedar policies that combine identity and device signals from providers such as CrowdStrike and Jamf, giving VPN-free access to HTTP and TCP applications with every decision logged.
Azure
Microsoft's Global Secure Access brings Entra Private Access and Internet Access together, with Conditional Access and Intune compliance driving each decision. For Microsoft 365 organizations it extends existing policies to private apps.
Google Cloud
Google pioneered BeyondCorp. Identity-Aware Proxy guards web apps, SSH and TCP services, Access Context Manager defines device and network conditions, and Chrome Enterprise Premium extends zero trust to any application.
Design decisions that matter
- 01Start with high-value apps
Admin consoles and sensitive internal tools first.
- 02Require device health
Managed and compliant devices for sensitive apps.
- 03Per-app policies
No broad network access, ever.
- 04Retire the VPN in stages
Move app by app until it is only a fallback.
Common mistakes we see
- Zero trust as a product purchase. It is a policy model; tools only enforce it.
- Ignoring device posture. Identity alone still trusts compromised laptops.
- Big-bang VPN shutdown. Users lose access to apps nobody inventoried.
A practical 30-day plan
- Week 1
Inventory internal apps and who uses them.
- Week 2
Connect identity and device signals to the access proxy.
- Week 3
Publish the first sensitive apps with per-app policies.
- Week 4
Measure VPN usage and plan the next wave of apps.
How NTS helps
NTS designs and rolls out zero-trust access with AWS Verified Access, Microsoft Global Secure Access and Google IAP: app inventory, policy design, device integration and staged VPN retirement.
What you get
- Identity-aware access to internal apps without a VPN
- Device posture and MFA checks on every request
- Conditional access policies by user, device and risk
- A phased plan to retire legacy VPN access
Typical outcomes
- VPN dependency reduced or removed
- Every access decision based on identity and device
- Smaller blast radius when credentials leak
How we work with you
- 1Assess
A focused review of your zero-trust access across AWS, Azure and Google Cloud. We look for the gaps we find most often: zero trust as a product purchase, ignoring device posture and big-bang VPN shutdown.
- 2Design
A target architecture and roadmap built on the decisions that matter most: start with high-value apps, require device health, per-app policies and retire the VPN in stages.
- 3Build
Hands-on delivery alongside your team. We inventory internal apps and who uses them, connect identity and device signals to the access proxy, publish the first sensitive apps with per-app policies, and finally measure VPN usage and plan the next wave of apps.
- 4Run and improve
We onboard new applications, tune policies with real sign-in data and keep device checks current.
Why teams choose NTS for zero-trust access
- Practical zero trust
We deliver working access controls, not a slide deck about principles.
- Better for users too
People reach apps faster without clunky VPN clients.
- Phased and safe
We migrate apps in waves so nobody loses access along the way.
Book a free 30-minute review
Talk to an NTS architect about your zero-trust access on AWS, Azure and Google Cloud.