Do we still need NAC in a Zero Trust world? It depends on how you use it

What changed

Remote work, cloud apps and personal devices have made network location a weak signal of trust. Zero Trust, as NIST and Microsoft describe it, assumes no implicit trust based on location: every access is checked against identity, device state and context.

What NAC still does well

Visibility: what’s connected to the network, including devices with no identity such as printers and cameras.
Device checks before joining the internal network.
Segmentation between kinds of devices on the network.

Where the old approach no longer works

It relies on a network edge that doesn’t exist when the employee is at home and the app is in the cloud.
Without a link to device management, NAC decides on partial information and adds one more system to maintain.
NAC alone doesn’t control access at the application level, and doesn’t stop attacks on identities and sessions.

Stopping lateral movement without the complexity

Many organizations expect NAC to stop lateral movement between computers on the network. A simpler way is private VLANs, which stop endpoints from talking to each other directly and send any traffic between them through the firewall. Together with a local firewall on every Windows and macOS machine, that’s protection that’s easy to understand and maintain, and it fits Zero Trust principles.

If you have NAC, connect it

If NAC is already in place or planned, it needs data from the systems that know the device. For example, compliance status from Intune lets NAC decide on the device’s real state, not just an address or a certificate. Without that link, NAC stays an isolated gatekeeper.

An example architecture

Architecture diagram: endpoints and apps in separate private VLANs, a central firewall inspecting all traffic, and cloud access through an identity provider and Conditional Access

Endpoints sit in their own PVLAN (VLAN 100), which blocks direct peer-to-peer traffic.
Internal apps sit in a separate PVLAN (VLAN 200), and every access to them goes through the firewall.
The central firewall inspects all traffic between the segments, and traffic out to the internet and the cloud.
Cloud and SaaS access goes through the identity provider and Conditional Access, which check identity, device state, risk and location.
Every managed computer runs a local firewall, antivirus and EDR, and a ZTNA agent, also outside the office.

The bottom line

NAC isn’t dead. It’s still useful for visibility, device checks and segmentation, especially for devices with no identity. But in a Zero Trust architecture it has to move from a static gate at the network edge to part of a system that gets data about the device and the user. And for lateral movement, PVLANs and a local firewall are usually the simpler path.

At OnCloud we design and deploy Zero Trust architecture for networks and endpoints: where NAC still fits, how to connect it to Intune and Conditional Access, and how to stop lateral movement. Want to review your architecture?