Stage 01
Identify user and device
Each user and device is verified before access is granted. Role-based policy, BYOD, and provisioning through LDAP, RADIUS, and enterprise identity systems are supported.
Output: Verified user and device context
← Products
Xcitium offering
Universal ZTNA
Access policies for users, devices and applications. Access is granted to specific resources and can be reassessed using session, device state, location and user role.
Discuss your requirements ↗
Zero Trust access for users and devices
Verify the user and device, then grant access to the requested application
Universal ZTNA combines role- and application-based access, continuous verification, and adaptive policy for local and remote users. Access is scoped to specific resources and applications rather than the entire network.
Stage 02
Evaluate access conditions
Location, device state, application state, and session context inform adaptive policy. Policies can use MFA, geofencing, and device controls.
Output: Policy decision for the user and application
Stage 03
Grant application-specific access
Least-privilege policy limits access to the applications and resources the user needs, using application-level access instead of broad network access.
Output: Scoped access to an application
Stage 04
Continuously verify the session
User behavior, device state, and location are monitored. A change in context or state can trigger re-authentication and policy-based access adjustment.
Output: Ongoing verification, alerts, and adaptive access
Corporate device · BYODLDAP · RADIUS · enterprise identity
Location · device · app · sessionRole · MFA · geofencing · least privilege
Application-level access↓
Application AApplication B
Behavior and device monitoring↺ Re-authenticate on change
Capabilities
Capabilities with a specific purpose
Continuous user and device verification
Users and devices are checked before access, with sessions assessed through continuous authentication. A change in context can trigger re-authentication.
Role- and application-based least privilege
User- and application-specific policies limit access to assigned resources instead of granting broad network access. Temporary access can be limited to an application and duration.
Context-aware adaptive access
A change in location, device, or app state can adjust access and trigger re-authentication. Validate which device signals are collected and how risk rules work in a pilot.
Access to on-prem, cloud, and SaaS apps
Universal ZTNA provides application-focused access for local and remote users. Map the resource catalogue, identity provider, and traffic path to the selected deployment model.
Identity, device management, and visibility
Microsoft Intune and Jamf integrations, BYOD, LDAP/RADIUS provisioning, MFA, geofencing, firewall, and IPS support access and device controls. User tracking, internet usage, and alerts provide operational visibility.
Compare approaches
Application access and WAN transport
| Consideration | ZTNA | SD-WAN |
|---|---|---|
| Decision object | Which user or device can access which application. | Which WAN link carries traffic and with what priority. |
| Primary signal | Identity, role, device posture, location, and session context. | Link performance, application, bandwidth, and route. |
| Control | Least-privilege policy and continuous access checks. | Path selection, QoS, load balancing, and network security. |
| Working together | Controls which resources a user can reach. | Controls how permitted traffic is transported across the WAN. |
Before you start
Set up a user-to-app pilot
Start with one remote and one office user group, plus one on-prem and one SaaS resource. Record how role, device, location, and session changes affect policy decisions.
- 01
Which applications are published as resources, and how is the access path configured?
- 02
How do IdP, MFA, LDAP/RADIUS, Intune, and Jamf integrations work?
- 03
Which re-authentication and block rules apply when device or location changes?
- 04
What are the BYOD privacy boundary and log retention terms?
Evidence for your evaluation
In practice
BYOD access to an internal application
A remote employee needs one business application from a personal device. ZTNA evaluates user and device context and grants resource-level access instead of opening a broad network tunnel.
What your team gains
- 01
Consistent access rules for remote and local users.
- 02
Access scoped to specific applications instead of the full network.
- 03
Options for BYOD and device-management scenarios with Intune or Jamf.
Before you decide
Questions, answered
How does ZTNA restrict remote access?
Users and devices are checked before application access and during sessions; role- and application-specific policies provide least-privilege access. Validate resource and identity integrations for the deployment.
Does it support BYOD and personal devices?
Xcitium provides BYOD, access decisions using device and location context, and Intune and Jamf deployment integrations. Test management and personal-profile boundaries separately.
Which identity integrations are named?
Xcitium ZTNA supports LDAP and RADIUS provisioning and enterprise identity systems. Microsoft Intune and Jamf are device-management integrations; check compatibility with the organization’s IdP and MFA setup.
Next step
Discuss your requirements
Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.