We design, deploy and manage SASE and Zero Trust on Fortinet and Microsoft, with coordinated access and security policies for branch offices, remote staff and contractors. They cover private applications, internet traffic, SaaS and AI use, and the information people send.
Access decided per user, device and application.Contractor on an unmanaged device. Browser access to one approved application.Laptop fails compliance. Access blocked until the device is fixed.Branch user uploads to an unsanctioned AI tool. DLP policy blocks the upload.Admin console requested. Phishing-resistant MFA required first.
Secure access
ZTNA·Secure Web Gateway·CASB·Data loss prevention·FortiSASE·Entra Private Access·Conditional Access·VPN replacement
Common triggers
What’s prompting you to rethink access?
You might be reviewing VPN access, securing several sites or tightening control over cloud applications. Select the situations you recognise to see where we’d start.
What we'd look at 2 selected
Select one or more situations to see what we'd look at first.
VPN is getting hard to manageThe applications people use, their network dependencies and which user groups can move to ZTNA first.
Contractors need access without joining the networkNamed identities, application entitlements, device requirements and browser-based access.
Branch security differs from site to siteYour FortiGate and SD-WAN estate, traffic paths, inspection points and central policy management.
SaaS and AI use is growing faster than the controlsApplication visibility, inspection, CASB, DLP and how policy is enforced.
Identity and device controls have gapsEntra ID, Conditional Access, device compliance, privileged access and application permissions.
Cloud apps take the long way roundReal application paths, internet connectivity, inspection needs, latency, jitter and packet loss.
A platform decision is coming upWhat to keep, which controls need to change and which platform suits your environment.
A FortiGate upgrade can change your remote accessYour FortiGate models and target firmware, who relies on SSL VPN for which applications and the replacement that suits each group.How the SSL VPN change works →
Most access stacks still authenticate once, then trust the network segment.
Our SASE services
What we design, deploy and run
We bring networking, identity and security together to protect access across your sites, users and applications. That can involve cloud-delivered security, your existing network infrastructure or a combination of both.
Service
What it gives you
How it works
Zero Trust Network Access
Access scoped to each application
Users reach the private applications they're authorised for, based on identity, device and policy. Contractors get their applications without a way into the wider network.
Secure internet access
Web policy that follows the user
Web filtering, threat protection and traffic inspection through Secure Web Gateway and firewall services, in the office, at home or on the road.
SaaS and AI controls
See which cloud and AI tools are in use
CASB and application controls show which SaaS and AI services people use, sanctioned or not, and where business information can be uploaded or shared.
Data loss prevention
Control what leaves the business
Classification and DLP policies control sensitive information moving through web and cloud channels. We agree the data types, applications and exceptions with you before anything is enforced.
Branch security and SD-WAN
Your sites under the same policy
Cloud security and access policy connect to FortiGate, SD-WAN and your existing network. Each site keeps the connectivity that suits it, under consistent security controls.
Identity and device security
The foundation each access decision uses
Entra ID, Conditional Access, MFA and device compliance are built into the access design, with accounts, groups and application entitlements cleaned up first.
Architecture
See how the controls work together
A SASE design decides where users authenticate, how access is granted, which traffic is inspected and where policy events are recorded. We build it around your network, identity provider, private applications and cloud services.
Layer 1 of 5
Networking and traffic steeringFirewall and traffic inspectionSecure Web GatewayCASB · cloud application controlZTNA · private application access
What it does
WAN, SD-WAN, internet links and endpoint forwarding bring traffic to the controls that apply to it.Cloud-delivered firewall services and branch FortiGates enforce policy where it fits best.Web access and threat protection policy on internet traffic, wherever staff work.Visibility and policy over SaaS and AI tools, sanctioned and unsanctioned.Application-specific access through an enforcement point and an application connector.
Policy
Identity and device information drives access decisions. Web, cloud and firewall policies are enforced by the security service that owns them.
Policy in action
How access policies work across your business
Select a user and application to see how identity, device requirements and access policies affect the connection. The controls and enforcement points depend on the platform and where the user is connecting.
Who
Tries to
Request traceBranch FortiGateCloud point of presenceCloud access proxy
IdentitySigned in with MFANamed guest account with MFAEntra ID account, staff groupScoped to the project they work on
DeviceCompany laptop, compliantUnmanaged personal laptopCompany laptop, not compliantManaged, encrypted, up to dateNo agent, so browser access onlyMissing security updates
Enforced atBranch FortiGateCloud point of presenceCloud access proxyInspected at the site edgeNearest SASE location, no trip to head officeBrowser session through the access serviceSame rules as the office
PolicyZTNA entitlementNot in their entitlementsDevice condition failsConditional AccessConditional Access session controlsCASB and DLPDownload controlsSecure Web GatewayOutside your trafficFinance group, this application onlyThe finance system isn’t published to themAccess requires a compliant deviceTrusted user and deviceUnmanaged device, web apps onlyDevice compliance requiredUnsanctioned AI service, customer data matchedCustomer data can’t reach their laptopNewly registered domain, high riskTheir own browsing on their own device
AllowedLimitedStoppedAllowed to the finance systemNot visible, not reachableBlocked until the laptop is updatedAllowed, direct to MicrosoftAllowed in the browser, no downloadsBrowser only until compliantUpload stopped, user pointed to CopilotDownloads blocked on their laptopBlocked and loggedNot inspected by design
The request reaches the finance system and nothing else on the network. Other applications need their own entitlement.Same entitlement as in the office, enforced from the cloud. There is no VPN tunnel into the wider network, and no inbound port open to the application.The contractor only sees the applications assigned to them. The finance system doesn’t appear in their portal, so there is nothing to try.The sign-in checks out, but the device isn’t in a state to touch financial data. They’re prompted to update, and access returns automatically once the laptop is compliant.Microsoft 365 traffic breaks out locally at the branch after inspection, so Teams and Outlook don’t take the long way through head office.Same Conditional Access policy as in the office. Web and SaaS inspection happens at the nearest point of presence, close to the user.The contractor can work in email and documents in the browser, but files can’t be downloaded or synced to their own laptop.Policy can allow limited web access while the laptop catches up on updates. You choose how strict this is.CASB recognises the AI service as unsanctioned and DLP matches customer records in the file. The upload is stopped, the user sees why, and the event is logged.The same data rule applies at home as in the office, because inspection happens in the cloud service as well as at the branch firewall.On a personal laptop you don’t inspect their browsing. The design limits what reaches their laptop instead: browser-only sessions block the list from being downloaded to it.Data rules don’t depend on the device check. Even with the laptop out of date, the upload is identified and stopped.Web filtering at the branch FortiGate blocks the site before the page loads. The security team can see who was sent the link.At home the same web policy applies through the cloud gateway, so a phishing link is stopped whether the person is in the office or not.A contractor’s personal browsing isn’t your traffic to inspect. What you control is what they can reach in your environment, which is why access is scoped per application.Web protection keeps working on an out-of-date laptop, which is exactly when it matters most.
What changes
What your business gains from a coordinated access model
Today
With SASE and Zero Trust
Staff rely on VPN for private applications
→
Supported applications use identity-led, application-specific access
Contractors get broad network access or a pile of exceptions
→
Contractors reach the applications they're approved for
Each branch filters and inspects traffic its own way
→
Security policy is managed consistently across sites
Internet and SaaS activity is hard to see
→
Internet and SaaS activity is inspected and recorded
Sensitive information leaves through unmanaged cloud channels
→
CASB and DLP enforce your application and data policies
Identity and device exceptions keep piling up
→
Access decisions use defined identity and device conditions
Network, identity and security changes bounce between teams
→
Policy ownership is agreed and documented
Platforms
Built on Fortinet and Microsoft
We work across Fortinet networking and security and Microsoft's identity and secure access services. The choice comes down to your applications, existing infrastructure, inspection needs and who will run it.
Fortinet
FortiSASE, FortiGate ZTNA and Fortinet networking
Branch networking and FortiGate security combine with cloud-delivered internet security and private application access. Designs can include FortiGate, Fortinet SD-WAN, FortiSASE, FortiManager and FortiAnalyzer, and we keep the Fortinet equipment you already have wherever it still fits.
A good fit when
You run FortiGate and Fortinet SD-WAN
Your branches need more consistent internet security
Remote users need ZTNA or cloud-delivered security
You want network and security run as one operation
Microsoft
Entra Internet Access, Entra Private Access and Conditional Access
Microsoft's Global Secure Access brings internet and private application access into Entra ID, Conditional Access and your Microsoft endpoint environment. We design and implement it, covering application support, client requirements, licensing, traffic forwarding and how it works alongside your firewalls.
A good fit when
You run Entra ID and Microsoft 365
Remote access to private applications needs rethinking
Access policy needs identity and device conditions
You want Microsoft secure access alongside your network security
Both together
Fortinet at the branch, Microsoft for identity and access
Many businesses keep FortiGate at their sites and use Microsoft for identity and secure access. We set clear ownership for authentication, traffic steering, inspection, policy changes and logging, so the two platforms work as one design.
A good fit when
FortiGate runs your branches and Entra ID runs your identities
Remote access is moving to identity-led access
Internet security is needed in the office and outside it
Network and identity teams need one operating model
Zero Trust Network Access
How Zero Trust Network Access works
ZTNA gives users access to the private applications they're authorised for, through identity and access policy. A typical design has an identity provider, a policy decision point, a policy enforcement point and a connector or gateway in front of the protected application.
It follows the NIST SP 800-207 Zero Trust Architecture model. The policy decision weighs identity, device and context before the application connection is made, and policy can re-evaluate those signals during the session.
Applications stay off the network
Published applications are reached through a broker or connector, so a user can work in one application without general network access. With connector-based services such as Entra Private Access, connectors dial out to the access service, so no inbound port opens to the application. FortiGate ZTNA exposes only its access proxy, and the application stays behind it.
Agent-based and agentless access
An endpoint agent supports more protocols and device checks. Browser-based, agentless access suits contractors and unmanaged devices with narrower protocol and posture options, so we match the method to each application.
Identity holds it together
ZTNA is only as strong as the identities behind it: MFA, accurate groups and clear application ownership. The identity provider becomes part of the access architecture, with availability and break-glass access planned in the deployment.
VPN replacement
ZTNA vs VPN: when to replace VPN
VPN still does a job. It gives encrypted connectivity between users or sites and permitted network resources, and a well-engineered VPN can enforce MFA, segmentation, device checks and granular firewall rules.
ZTNA takes a different approach for user access to private applications: the user gets the approved application, through the access service. The difference is the scope of access and where it's enforced.
How VPN, ZTNA and SASE compare
VPN
ZTNA
SASE
What it is
Encrypted connectivity to permitted network resources
Identity-led access to private applications
Networking plus cloud-delivered security and access
Access scope
Set by VPN policy, routing, segmentation and application permissions
Set by application or resource entitlements
Set across the networking and security services in the design
Identity
MFA and identity integration can be enforced
Central to the access design
Drives access and security policy across services
Device controls
Through compatible endpoint and VPN controls
Device posture and compliance signals
Integrated endpoint and security signals
Legacy support
Suits network-dependent systems and older protocols
Depends on application and protocol support
Follows the access method used for each application
Contractor access
Restricted through accounts and network policy
Application-specific or browser-based access
ZTNA plus web and cloud security controls
Operations
VPN gateways, routing, user permissions and access rules
Connectors, entitlements, identity dependencies and policy
Several security and network services, each with a named owner
When ZTNA makes sense
Employees need selected private applications from different locations
Contractors need narrowly defined access without general network connectivity
Existing VPN permissions are hard to maintain or review
Application access needs identity, MFA and device conditions
Reducing the exposure of private applications is a priority
ZTNA and VPN
When VPN still fits
A legacy application depends on a protocol or network behaviour the ZTNA platform can't support
Network administration needs connectivity that a controlled VPN handles better
Site-to-site connectivity stays part of the network design
Identity, application ownership or device management need work before ZTNA can start
Can VPN and ZTNA run together?
Yes. VPN can stay alongside ZTNA for the systems that still need it. We define which users and applications use it, restrict that access and name who maintains it. It can be a stage in the migration or a long-term decision, but it shouldn't become a way around the policies ZTNA enforces.
With VPN, a stolen credential connects to a permitted network segment, and how far it gets depends on routing, firewall rules and application permissions. With application-specific ZTNA, the same credential reaches only the applications assigned to that identity, and each other application needs its own authorisation. That matters most for contractors, remote staff and networks where permissions have built up over the years.
Same stolen password, two access models
What it could reach
VPN
ZTNA
Applications assigned to the user
Reachable
Reachable
Other applications
Depends on permissions
Needs its own authorisation
Other systems on the permitted segment
Depends on firewall rules
Not reachable
With VPN, a stolen credential connects to a permitted network segment. How far it gets depends on routing, firewall rules and application permissions.With application-specific ZTNA, the same credential reaches only the applications assigned to that identity. Each other application needs its own authorisation.
Security and governance
Keeping control of where information goes
Information protection
Secure Web Gateway, CASB and DLP give you visibility and control over web, SaaS and AI traffic. We work out which information needs protecting, what the platform can inspect and which actions to restrict, with inspection exceptions designed in from the start.
Data residency
Inspection, access logs, management data and administration can sit in different regions. We check the service regions and contractual terms against your requirements and document the result before deployment. Australian hosting of one management component doesn't make the whole service resident in Australia.
Essential Eight
SASE and ZTNA support specific Essential Eight strategies, chiefly multi-factor authentication and restricting administrative privileges. Device compliance checks strengthen both, though they aren't an Essential Eight strategy in their own right. Patching, application control, backups and the rest of the framework still need their own controls. Where higher assurance is required, we design for phishing-resistant MFA in place of SMS codes.
Residency record
Documented before deployment
Traffic inspection
Service regions confirmed for the selected platform
Log retention
Location and retention period documented
Management data
Where it sits and who holds administrative access
Requirements
Privacy Act and contractual obligations captured in the design
Our approach
How we design and operate secure access
Identity
Identity and application access
We review accounts, access groups, authentication, device conditions and the applications people need. That decides where ZTNA and Conditional Access policies apply.
Network
Network and inspection architecture
We design branch connectivity, traffic forwarding, internet breakout, private application paths and inspection points around your existing firewalls and SD-WAN.
Platforms
Platform selection and integration
We weigh Fortinet and Microsoft against your environment and keep what still works. Licensing, interoperability and who runs what are part of the decision.
Migration
Controlled migration
We move defined user groups and applications in stages. VPN stays available for approved needs while the new services prove themselves.
Operations
Policy ownership and ongoing service
We agree who manages entitlements, exceptions, connectors, filtering policy, security events and platform changes. Our engineers can run it, or work alongside your team.
Secure Access Service Edge brings networking and security services into one architecture. It can include SD-WAN, Secure Web Gateway, CASB, cloud firewall services and ZTNA.
What is the difference between SASE and SSE?
Security Service Edge covers the cloud-delivered security services, such as ZTNA, Secure Web Gateway and CASB. SASE adds the networking component. Many businesses start with SSE alongside their existing WAN or SD-WAN.
What is ZTNA?
Zero Trust Network Access controls access to private applications through identity and access policy. Users reach the applications they're authorised for, without general connectivity to the internal network.
Can we replace VPN with ZTNA?
Yes, for the applications and access needs the ZTNA platform supports. Legacy protocols, site-to-site connectivity and specialist administration may still need VPN.
Can VPN remain permanently alongside ZTNA?
Yes. Long-term coexistence suits defined applications or connectivity needs. The remaining VPN access is restricted, documented and owned, so it doesn't become a way around ZTNA policies.
Will a FortiGate firmware upgrade affect our remote access?
It can, depending on the model and the target FortiOS release. SSL VPN tunnel mode is no longer available from FortiOS 7.6.3, and some models lose SSL VPN in earlier releases. We check your models and upgrade path, and set up replacement access before the upgrade. See how the SSL VPN change works on our FortiGate page.
Does SASE require SD-WAN?
No. You can add cloud security or ZTNA without replacing your WAN. SD-WAN can form part of a wider SASE design later.
Do we need to replace our existing FortiGate firewalls?
Not necessarily. Existing FortiGates often keep their branch security and networking roles. We check compatibility, integrations and how enforcement is split before recommending any change.
Can Microsoft Entra provide secure internet and private application access?
Yes. Entra Internet Access and Entra Private Access, part of Microsoft's Global Secure Access, cover both. We confirm they suit your applications, traffic, identity setup, endpoints and licensing before designing around them.
Can SASE control data uploaded to SaaS and AI tools?
Yes. CASB, Secure Web Gateway and DLP can identify and restrict uploads and sharing to SaaS and AI services. We set what's inspected and enforced for each application in the design.
Can contractors use ZTNA without installing an agent?
Yes, for suitable applications. Browser-based access needs no agent, though it supports fewer protocols and device checks than an endpoint client.
What happens if the identity provider is unavailable?
New access requests can fail while the identity check can't complete. The design covers provider availability, existing sessions, break-glass access and recovery steps.
Does SASE meet Essential Eight requirements?
SASE supports specific controls such as MFA and restricting administrative privileges. Full Essential Eight alignment also depends on patching, application control, backups and the rest of your environment.
Who manages SASE after deployment?
We agree responsibilities for identity changes, application entitlements, connectors, traffic policy, logging, incident investigation and vendor escalation. Our engineers can run it, or share it with your IT team.
Talk to us before your next VPN or security decision
Tell us what you’re working on, whether that’s replacing VPN, tightening contractor access or choosing between Fortinet and Microsoft. We start with a Secure Access Review and talk you through what we’d do first.
A conversation with an engineer who knows Fortinet, Microsoft Entra and Zero Trust access
A clear view of who can reach what today, and where your VPN leaves gaps
