Identity and Access Security: MFA, ZTNA and NAC Explained

Quick Answer

Identity and Access Security protects business networks, applications, systems and information by ensuring that only authorized users and devices receive access. Three important technologies used for this purpose are MFA (Multi-Factor Authentication), ZTNA (Zero Trust Network Access) and NAC (Network Access Control).

MFA verifies a user's identity using multiple authentication factors. ZTNA provides controlled access to specific applications based on identity, device security and access policies. NAC controls which users and devices can connect to wired and wireless networks. Together, these technologies help prevent unauthorized access, credential theft, compromised device connections and unnecessary exposure of enterprise resources.

1. MFA (Multi-Factor Authentication)

What Is MFA?

Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or more different authentication factors before accessing an account, application or system.

A password alone provides only one authentication factor. If an attacker steals or discovers the password, the account may be compromised. MFA adds additional verification, making unauthorized access more difficult even when the password is known.

Three Main Authentication Factors

For example, an employee may enter a password and then authenticate using a registered security key or authenticator application. Access is granted only after the required authentication checks succeed.

How MFA Works

1. The user opens an application, website, VPN portal or organizational login page.
2. The user enters their username and password.
3. The identity provider validates the primary credentials.
4. The system requests an additional authentication factor.
5. The user completes verification using a registered authenticator.
6. The authentication system validates the additional factor.
7. If all required checks succeed, the user is authenticated and receives access according to applicable permissions.

Common MFA Methods

Phishing-Resistant MFA

Not all MFA methods offer the same level of protection. Attackers may trick users into entering OTP codes on fraudulent websites or approving unexpected authentication requests.

Phishing-resistant MFA uses authentication mechanisms that bind authentication to the legitimate service or communication channel.

Examples include:

• FIDO2 security keys.
• WebAuthn-based authentication.
• Appropriately implemented passkeys.
• Certificate-based authentication with suitable security controls.

Organizations should prioritize phishing-resistant authentication for administrators, privileged accounts, remote access and sensitive business applications wherever supported.

Where MFA Is Used

• Microsoft 365 and Google Workspace accounts.
• Remote desktop and VPN access.
• Cloud infrastructure management portals.
• Domain administrator accounts.
• Financial and business applications.
• Email and collaboration platforms.
• Identity providers and single sign-on systems.
• Remote access to enterprise applications.

Common MFA Problems and Troubleshooting

MFA Implementation Best Practices

• Enable MFA for all supported business accounts.
• Prioritize administrator and privileged accounts.
• Prefer phishing-resistant authentication methods where possible.
• Maintain secure account recovery procedures.
• Remove authenticator registrations associated with lost or stolen devices.
• Monitor suspicious authentication attempts.
• Educate employees about unexpected MFA approval requests.
• Protect emergency access accounts with documented security controls.

2. ZTNA (Zero Trust Network Access)

What Is ZTNA?

Zero Trust Network Access (ZTNA) is a security technology that provides controlled access to specific organizational applications and resources based on verified identity, device information and security policies.

ZTNA follows the Zero Trust principle that users and devices should not automatically be trusted simply because they are connected to an internal network or belong to the organization.

Instead of granting remote employees unrestricted access to an entire internal network, ZTNA can provide access only to the applications and services they are authorized to use.

For example, an employee working remotely may be permitted to access the company's ERP application but denied access to database administration systems and other restricted resources.

How ZTNA Works

1. Access request: The user attempts to access an organizational application.
2. Identity verification: The identity provider verifies the user's identity, often using MFA.
3. Device assessment: The system evaluates available device information, such as registration, operating-system status and security compliance.
4. Policy evaluation: The system checks the user's permissions, device condition and requested resource.
5. Access decision: The system determines whether access should be allowed, denied or subjected to additional requirements.
6. Secure connection: If authorized, the user receives controlled connectivity to the permitted application.
7. Continuous evaluation: Depending on the implementation, changes in identity risk, device compliance or session conditions can trigger additional verification or access revocation.

Key Components of ZTNA

These components may be implemented differently across products. They do not necessarily exist as separate physical servers.

ZTNA vs Traditional VPN

A traditional VPN establishes an encrypted connection between a remote user and a network or network segment. Depending on its configuration, it may provide access to several internal resources.

ZTNA generally focuses on application-specific access rather than broad network-level connectivity.

ZTNA does not automatically make every VPN obsolete. VPNs remain useful for site-to-site connectivity, network-level access and other requirements. Some organizations operate both technologies together.

Where ZTNA Is Used

• Remote access to private enterprise applications.
• Access to applications hosted in corporate data centres.
• Secure access to cloud-hosted business resources.
• Remote employee and contractor access.
• Third-party vendor access to selected applications.
• Restricting access to sensitive applications based on job roles.
• Reducing unnecessary exposure of internal services.

Common ZTNA Problems and Troubleshooting

ZTNA Implementation Best Practices

• Identify and classify applications before deployment.
• Integrate ZTNA with a centralized identity provider where supported.
• Enforce MFA for sensitive application access.
• Define access policies based on job responsibilities.
• Integrate device posture assessment where appropriate.
• Avoid granting unnecessary access to internal services.
• Monitor access requests and denied connections.
• Test policies before organization-wide deployment.
• Maintain documented emergency-access procedures.

3. NAC (Network Access Control)

What Is NAC?

Network Access Control (NAC) is a network security technology that controls which users and devices are permitted to connect to an organization's wired or wireless network and determines the level of access they receive.

NAC helps prevent unauthorized devices from connecting to internal infrastructure and allows organizations to enforce network access policies.

For example, when an employee connects a laptop to an office Ethernet port or corporate Wi-Fi, NAC can authenticate the user or device, evaluate applicable security requirements and assign an appropriate network access policy.

A non-compliant or unauthorized device may be denied access, placed in a restricted network segment or redirected to a remediation process, depending on the NAC implementation.

How NAC Works

1. Device connection: A laptop, desktop, smartphone, printer or other endpoint connects to a switch, wireless access point or supported network gateway.
2. Identification: The system identifies the connecting device and, where applicable, the associated user.
3. Authentication: Credentials are verified using an appropriate authentication mechanism.
4. Policy evaluation: NAC evaluates access permissions and available device compliance information.
5. Access decision: The device is authorized, denied or assigned restricted access.
6. Network enforcement: The switch, wireless controller or another supported network device applies the access policy.
7. Monitoring: Network access activity is logged and monitored.

Key NAC Technologies and Components

Understanding IEEE 802.1X Authentication

IEEE 802.1X is a standard used for port-based network access control. It regulates communication through a controlled network port until the required authentication process succeeds.

A typical 802.1X architecture contains three main components:

• Supplicant: The endpoint requesting network access, such as a laptop or desktop computer.
• Authenticator: The switch or wireless access point that controls the connection.
• Authentication Server: A backend service, commonly a RADIUS server, that validates authentication requests.

How 802.1X Authentication Works

1. The endpoint connects to a supported wired or wireless network.
2. The supplicant initiates authentication using EAP over LAN (EAPOL), where applicable.
3. The switch or wireless access point communicates with the authentication server.
4. The authentication server evaluates the credentials.
5. The server returns an authorization decision and applicable policy information.
6. The network device allows or denies network communication according to the result.

Depending on the implementation, additional authorization attributes can assign VLANs or other network restrictions.

Understanding RADIUS in NAC

RADIUS (Remote Authentication Dial-In User Service) is a client-server protocol used to centralize authentication, authorization and accounting for network access.

In a typical enterprise deployment:

• The switch or wireless access point acts as a RADIUS client.
• The RADIUS server receives authentication and authorization requests.
• The server checks credentials against an appropriate identity source or authentication configuration.
• The server returns an access acceptance or rejection decision.
• Applicable authorization attributes can provide additional network-access instructions.
• Accounting information can be recorded for monitoring and auditing.

Microsoft Network Policy Server (NPS) is an example of a RADIUS server implementation that supports centralized network access authentication and authorization.

Common NAC Enforcement Methods

Types of NAC Deployment

Pre-Admission NAC

Pre-admission NAC evaluates a device or user before granting normal network access. It can authenticate the connection and apply an appropriate policy before the endpoint communicates with protected internal resources.

Post-Admission NAC

Post-admission NAC monitors devices after network access has been granted. If a device violates security requirements or its authorization changes, the system may restrict access or move the device into a controlled network segment.

Agent-Based NAC

Agent-based NAC uses endpoint software to collect device information, report security status or support compliance assessments. It provides additional visibility but requires installation, maintenance and operating-system compatibility.

Agentless NAC

Agentless NAC identifies or assesses devices using available network information, authentication records and integrations without requiring a dedicated endpoint agent. However, the available endpoint security information may be more limited.

Where NAC Is Used

• Corporate wired Ethernet networks.
• Enterprise Wi-Fi networks.
• Employee laptops and desktop computers.
• Guest network access.
• BYOD environments.
• Printers, IP phones and IoT devices.
• Data centre and departmental network segmentation.
• Contractor and third-party device access.
• Quarantine and remediation of non-compliant endpoints.

Common NAC Problems and Troubleshooting

NAC Implementation Best Practices

• Inventory wired, wireless and unmanaged devices before deployment.
• Verify switch, access point and endpoint compatibility.
• Use certificate-based 802.1X authentication where appropriate.
• Maintain secure and redundant RADIUS services where required.
• Separate employee, guest, printer and IoT devices into appropriate network segments.
• Apply restricted access to devices that cannot support stronger authentication.
• Test policies before organization-wide enforcement.
• Maintain documented exceptions for legacy equipment.
• Monitor authentication failures and unauthorized connections.
• Prepare rollback procedures before changing network-wide policies.

4. MFA vs ZTNA vs NAC: Key Differences

Although all three technologies contribute to identity and access security, they operate at different stages and control different types of access.

5. How MFA, ZTNA and NAC Work Together

Organizations can combine these three technologies to create multiple layers of identity and access protection.

Consider an employee who works remotely and needs access to an internal business application.

1. NAC controls network admission: When the employee connects to the corporate office network, NAC can authenticate the endpoint and assign an appropriate network access policy.
2. MFA verifies the user: When the employee signs in to the organization's identity provider, MFA requires additional authentication beyond the password.
3. ZTNA evaluates resource access: The ZTNA platform evaluates the authenticated identity, device posture and applicable access policies.
4. Access is restricted: The employee receives access only to authorized resources rather than automatically receiving unrestricted access to the internal network.
5. Security monitoring continues: Authentication records, device information and access events can be monitored for suspicious activity.

These controls are complementary rather than interchangeable. NAC does not replace MFA, and MFA alone does not determine which applications a user should access. Similarly, ZTNA does not replace all network admission and segmentation controls.

Example Enterprise Security Architecture

• Identity Provider: Centralizes user identities, authentication and MFA.
• NAC Platform: Controls access to wired and wireless network infrastructure.
• RADIUS Server: Processes supported network authentication and authorization requests.
• Endpoint Management: Maintains device registration and security compliance information.
• ZTNA Platform: Enforces controlled access to private applications.
• Firewall and Network Segmentation: Restrict communication between network segments and protected resources.
• SIEM Platform: Collects and correlates authentication, endpoint and network security events.

The exact architecture depends on organizational requirements, infrastructure, product compatibility and security policies.

6. Implementation Strategy for Organizations

Organizations planning to implement MFA, ZTNA and NAC should use a phased deployment approach. Implementing all access controls simultaneously without testing can cause authentication failures, network outages and business disruption.

Step 1: Assess Existing Infrastructure

• Identify existing user directories and identity providers.
• Inventory applications, servers and network resources.
• Identify wired and wireless network infrastructure.
• Review existing VPN, firewall and remote-access configurations.
• Inventory managed, unmanaged and legacy endpoints.
• Identify privileged accounts and sensitive applications.

Step 2: Establish Identity Protection

• Enable MFA for user accounts and administrative access.
• Prioritize phishing-resistant authentication methods.
• Define account recovery and lost-device procedures.
• Review authentication policies and session requirements.
• Monitor suspicious sign-in activity.

Step 3: Implement Network Access Control

• Verify switch, access point and RADIUS compatibility.
• Configure authentication methods and network access policies.
• Introduce 802.1X in a controlled pilot environment.
• Define separate policies for employees, guests and unmanaged devices.
• Test printers, IP phones and IoT devices.
• Establish controlled exceptions and recovery procedures.

Step 4: Deploy Zero Trust Network Access

• Identify applications requiring controlled remote access.
• Integrate ZTNA with the identity provider.
• Configure application-specific access policies.
• Integrate device posture information where supported.
• Test access from approved and non-approved devices.
• Review VPN dependencies before migration.

Step 5: Monitor and Optimize

• Centralize authentication and network access logs.
• Monitor denied access requests and repeated authentication failures.
• Review policy exceptions regularly.
• Test emergency access and disaster recovery procedures.
• Update access permissions when employees change roles or leave the organization.
• Periodically assess security controls and their effectiveness.

7. Security Considerations and Common Mistakes

Even when MFA, ZTNA and NAC are deployed, incorrect configuration and poor access-management practices can weaken the overall security architecture.

Common Implementation Mistakes

• Relying only on SMS-based MFA: SMS verification can be vulnerable to SIM swapping and other attacks. Prefer phishing-resistant methods where supported.
• Allowing unrestricted MFA exceptions: Excessive exclusions can leave important accounts insufficiently protected.
• Assuming MFA provides authorization: Successful authentication does not automatically grant permission to access every application or network resource.
• Granting excessive ZTNA permissions: Users should receive only the access required for their responsibilities.
• Ignoring unmanaged devices: Personal and unmanaged devices can introduce risks if their access is not appropriately restricted.
• Using MAC addresses as strong device identities: MAC addresses can be spoofed and should not be treated as strong authentication credentials.
• Deploying NAC without device inventory: Printers, IP phones and IoT devices may lose connectivity if authentication requirements are not planned correctly.
• Ignoring certificate lifecycle management: Expired certificates can interrupt 802.1X and other certificate-based authentication.
• Failing to monitor authentication logs: Security events must be reviewed to identify suspicious access attempts.
• Implementing policies without testing: Incorrect policies can lock out legitimate users or expose sensitive resources.

Recovery and Business Continuity Considerations

Before enforcing organization-wide authentication and network access policies, IT administrators should:

• Maintain documented emergency-access procedures.
• Protect alternative administrative access methods.
• Maintain redundant authentication services where required.
• Test access policies on pilot devices and representative user groups.
• Document configuration changes and previous policy settings.
• Establish procedures for lost authenticators and expired device certificates.
• Ensure security exceptions are approved and periodically reviewed.

8. Frequently Asked Questions

What is the main difference between MFA, ZTNA and NAC?

MFA verifies user identity through multiple authentication factors. ZTNA controls access to specific applications based on identity and security policies. NAC controls which users and devices can connect to an organization's network and what network access they receive.

Is MFA part of Zero Trust security?

Yes. MFA is an important identity-verification control used in many Zero Trust architectures. However, Zero Trust also considers authorization, device security, resource access policies and contextual information. MFA alone does not implement a complete Zero Trust architecture.

Does ZTNA replace a traditional VPN?

Not necessarily. ZTNA can replace or reduce the need for traditional remote-access VPN connectivity when users only require access to specific private applications. VPNs may still be required for network-level access and site-to-site connectivity.

Is NAC the same as a firewall?

No. NAC controls network admission and access authorization for users and devices. A firewall primarily controls network traffic according to configured security rules. Both technologies can work together to enforce network security.

Does NAC require IEEE 802.1X?

No. IEEE 802.1X is widely used for port-based network access control, but NAC platforms may also support other identification and enforcement methods. Capabilities depend on the NAC solution and network infrastructure.

Can NAC authenticate printers and IoT devices?

Yes, depending on device capabilities and NAC implementation. Devices that support 802.1X can use compatible authentication methods. Devices without suitable authentication support may require controlled alternatives, such as restricted VLAN assignment.

Can MFA be used with ZTNA?

Yes. MFA can be integrated with a ZTNA platform through an identity provider. The user completes the required authentication before the ZTNA system evaluates whether access to the requested resource should be granted.

Are MFA, ZTNA and NAC suitable for small businesses?

Yes. Small businesses can implement these controls according to their security requirements and infrastructure. MFA is generally a practical starting point. ZTNA can help secure remote application access, while NAC is useful when controlling wired, wireless and unmanaged device connections.

Sources

• NIST SP 800-63B-4 – Digital Identity Guidelines: Authentication and Authenticator Management
• NIST SP 800-207 – Zero Trust Architecture
• IEEE 802.1X – Port-Based Network Access Control
• Microsoft Learn – Network Policy Server Overview
• Microsoft Learn – Deploy 802.1X Authenticated Wireless Access
• Microsoft Learn – Deploy Network Policy Server