What SASE and Zero Trust Access Tools Are
Written by MSP Outpost.
In Short
These tools replace the traditional VPN. Instead of putting a remote user on the whole office network, they check who the person is and what device they are using, then let them reach only the applications or networks they are allowed to. Many also include a cloud web gateway that filters internet traffic wherever staff work, with policies you set for each client.
What It Does
- VPN replacement. Gives remote staff access to specific applications instead of the whole network.
- Identity-aware access. Checks the user and their device each time, rather than trusting anyone already inside.
- Secure web gateway. Filters internet traffic in the cloud, so protection follows staff to home and public networks.
- Private app access. Reaches internal servers and systems without opening inbound ports to the internet.
- Per-client policy. Applies different rules, users and logs to each client from one console.
- Device checks. Allows access only from devices that are managed, patched or encrypted.
- Branch connectivity. Some also link offices and sites, and steer traffic between them.
When You Need One
A well-configured VPN or the remote access built into the firewall is usually enough for a small client base. Look at this category when a client asks about zero trust, or when VPN support starts taking your time.
VPN tickets and firewall changes for remote staff are recurring work. Pick one product with a proper multi-tenant console and start moving clients across one at a time, beginning with those who use mostly cloud applications.
Larger clients with several offices and a mix of cloud and internal applications want one policy across all of them. Expect to plan around agent rollout, logging, and how your technicians reach client systems for support.
How It Is Priced
Pricing is usually per user each month, sometimes with a separate charge for bandwidth, sites or connectors, and many vendors quote rather than publish. Look at the minimum number of users, the contract term, and whether the web gateway, logging or device checks are extras. Ask how a partner program bills when a client has only a handful of staff.
Switching
Moving from a VPN means installing an agent on every device and rebuilding which users reach which applications. Plan to run both in parallel for a while, and move one group at a time, because a missing rule shows up as a locked-out user. Find out how long logs stay available after you cancel, and how you export policies.
Questions to Ask a Vendor
- Can I manage every client from one console and keep their policies and logs separate?
- What happens to a user's access if your service has an outage?
- Which identity providers does it work with, and does it need the client's directory?
- Is it priced per user, per site or by bandwidth, and what is the minimum per client?
- How do my technicians reach client systems for support without a separate VPN?
- What does an agent do on a laptop, and how is it deployed and updated?
- How long are logs kept, and can I export them?