Definition
Zero Trust Network Access (ZTNA) is the network-level implementation of Zero Trust — granting per-application access via an identity-aware proxy or broker, rather than network-wide VPN access.
In more depth
ZTNA replaces traditional VPN with per-app micro-access. The user authenticates to a broker (Cloudflare Access, Zscaler ZTA, Palo Alto Prisma, etc.) which evaluates identity + device posture + context per request, then proxies to the specific application. Lateral movement is structurally limited.
ZTNA + IAP (identity-aware proxy) are largely the same idea with different vendor terminology. Both depend on a strong IdP and Conditional Access engine.
Want the work, not just the definition?