Platform selection is the easy part. Sequencing is the discipline.

SASE is the architecture. Zero Trust is the access model. Both depend on identity readiness — and that is what most SASE deployments underestimate. SASE brings network access and security controls together around the user, device, application and session, but it is not a single product purchase. The right deployment usually starts with identity cleanup and application dependency mapping, then a staged transition from VPN to ZTNA and Secure Web Gateway before broader controls are added.

See the staged deployment phases
The model

SASE is not one product; it is one access and security model. It converges up to five capabilities — SD-WAN, Zero Trust Network Access, Secure Web Gateway, CASB and Firewall as a Service — into a consistent policy model for distributed users, branch sites, SaaS and cloud applications. Most organisations do not activate every capability on day one. ZTNA and Secure Web Gateway usually come first; CASB follows as SaaS and AI-tool governance matures; SD-WAN is often already in place.

SASE architecture

SASE converges five capabilities into one policy model.

The practical value is architectural: it brings networking and security controls closer to users, devices, applications and sessions, rather than assuming traffic will always pass through an office, datacentre or perimeter firewall. For many Australian organisations the first visible value is not only VPN replacement — it is visibility into SaaS, browser-based work and AI-tool usage that was previously outside policy and reporting.

Pillar 1 · Network

SD-WAN

Application-aware connectivity across sites and users, with intelligent routing, multi-link failover and direct cloud breakout. In SASE it is the network foundation branch access and cloud performance depend on — and it is often already in place before the program begins.

Pillar 2 · Access

ZTNA

Identity-based application access. Users authenticate with MFA and device compliance, then reach only the specific applications they need, not the underlying network — replacing the legacy VPN model where one connection grants broad network access. Usually the first capability to deploy.

Pillar 3 · Web

Secure Web Gateway

Inspects and filters internet-bound traffic, enforcing application allow-listing, threat prevention and data-loss policy regardless of where the user works — giving remote and hybrid users the same posture as office users without backhauling all traffic.

Pillar 4 · SaaS

CASB

Visibility and control over SaaS applications and cloud data — identifying shadow IT, unsanctioned SaaS, risky AI-tool usage and data movement. Becomes more important as governance matures and SaaS usage expands outside centrally managed platforms.

Pillar 5 · Firewall

Firewall as a Service

Cloud-delivered network firewall policy enforcement, giving consistent network-level security for branch and remote users without deploying hardware at every location. Relevant when distributed inspection is needed without increasing appliance complexity.

Readiness signals

SASE is strong when the access model is ready. It is risky when the foundation is not.

Not every organisation is ready to deploy SASE today, and the cost of deploying before the foundation is right is operational, not just technical. The signals below separate "the right next conversation" from "preparation work needs to happen first."

Best fit when
SASE is the right conversation
  • VPN is the primary remote-access model and ZTNA migration is overdue
  • SaaS and AI-tool usage is outside policy and visibility
  • Essential Eight or cyber insurance is driving Zero Trust and MFA
  • Microsoft 365 or Fortinet SD-WAN is already the foundation
  • Consistent policy is needed across office, remote, hybrid and contractor access
  • Access decisions must weigh identity, device posture, application sensitivity and session context
Not ready when
Preparation work comes first
  • Entra ID has stale accounts, orphaned groups or inconsistent MFA
  • Application inventory is incomplete and VPN access patterns undocumented
  • Device management is not in place and compliance cannot be assessed
  • No one owns Conditional Access, ZTNA entitlements and CASB rules ongoing
  • A platform is being selected before the access model and dependency map are understood
  • The business expects instant VPN replacement without pilot, rollback or staged decommission

Where the situation sits in not ready, preparation — identity cleanup, application mapping, Conditional Access remediation — needs to happen before any SASE platform decision is committed to.

Platform fit

Platform selection should follow the existing identity and edge stack.

Two platform paths cover many Australian SASE deployments. The right choice should follow the existing identity stack, network edge, operating model, sovereignty requirements and application dependency map — not vendor preference. In larger environments the two can coexist.

Microsoft's Security Service Edge, delivered through Entra Internet Access and Entra Private Access (Global Secure Access).

Built on the same identity platform as Microsoft 365 and Conditional Access, it requires no new branch-edge hardware. For organisations already standardised on Microsoft, this is often the most natural SASE or SSE path.

Best fit: organisations already on Microsoft 365 and Entra ID with Conditional Access in use, where the primary use case is user access to SaaS, internet and cloud applications.

Fortinet's SASE capability, delivered through FortiOS and Fortinet cloud services.

For organisations with Fortinet SD-WAN already deployed, SASE capabilities activate on the same FortiGate hardware without a network redesign — particularly relevant where Fortinet already handles both networking and security at the branch edge.

Best fit: organisations with Fortinet SD-WAN deployed, FortiGate managing both network and security at the edge, and multi-site environments where hardware consistency and Fortinet operating depth matter.

SSE vs SASE — start with the right scope. Security Service Edge covers the user-access and internet-security layer (ZTNA, SWG, CASB) without the networking layer. SASE includes SSE plus networking, most commonly SD-WAN. Start with SSE when the problem is remote access, internet security and SaaS visibility; move to full SASE when branch networking and access security are modernised together.
Identity prerequisites

SASE enforces the identity model you bring to it.

Conditional Access and ZTNA policies applied to a disorganised identity estate will either miss users or block access unexpectedly. The assessment and cleanup phase is not optional — most failed SASE rollouts are identity problems before they become technology problems.

Resolve first · Stale accounts and orphaned groups

Accounts for former staff still active in Entra ID create unnecessary exposure. Groups with no current owner, no clear purpose or inaccurate membership create unreliable policy targeting — Conditional Access and ZTNA policies applied to them produce unpredictable outcomes.

Resolve first · Inconsistent MFA enforcement

SASE assumes MFA is a reliable signal. If enrolment is inconsistent — some on authenticator apps, some on SMS, some without coverage — device compliance and identity verification cannot be enforced uniformly. Exceptions must be documented, minimised and reviewed before rollout.

Resolve first · Undocumented application access

ZTNA grants access to specific applications. If inventories are incomplete, the migration will block legitimate access that was implicit in the old VPN model. A full dependency map is required before policy is written.

The required foundation before SASE policy is deployed:

Conditional Access baseline

The more mature the existing estate — device compliance, named locations, sign-in risk, group hygiene — the more effective the SASE policy layer is from day one.

Device management baseline

Device-posture checks require devices enrolled in Intune or compatible MDM. Unmanaged devices using VPN today need a compliance pathway before ZTNA can enforce device health.

Application inventory and classification

Every application accessed through VPN catalogued — owner, user groups, authentication method, internal dependencies and legacy access constraints. This is the map ZTNA policy is written against.

Deployment methodology

SASE transitions fail when policies are applied before identities, applications and dependencies are understood.

Deployment starts with discovery and cleanup so Conditional Access and ZTNA policies land on a clean foundation. A structured transition typically runs 8 to 16 weeks from identity audit to full VPN decommission. The critical path is identity and dependency mapping, not technical configuration.

01
Discover — identity and access mappingweeks 1–3

Every user group, application, VPN tunnel and legacy access control list is catalogued before any policy is written. Access patterns are mapped per group, shadow IT identified, MFA and device-compliance status reviewed. Output: a dependency map of who needs which applications and what breaks if VPN is removed too early.

02
Clean — identity cleanup before policyweeks 2–4

Stale accounts and groups removed or resolved, duplicate and conflicting identities merged, Conditional Access prerequisites confirmed across all groups, device-compliance baselines established. This phase determines whether policy deployment is clean or chaotic.

03
Pilot — ZTNA and SWG with a controlled groupweeks 3–7

ZTNA and Secure Web Gateway policies deployed to a representative segment while the legacy VPN stays operational. The pilot validates access, performance, policy coverage, device compliance, support paths and user experience under production conditions. Rollback remains available until cutover is confirmed.

04
Deploy — progressive rollout and legacy decommissionweeks 6–14

Validated policies rolled out progressively by user group, not through a hard cutover. The legacy VPN is decommissioned only after the new environment is confirmed for each group. CASB and FWaaS are activated as governance requirements mature, with continuous compliance reporting aligned from day one.

Running SASE alongside VPN without a migration plan means users revert to VPN when they hit friction — and the security gaps SASE was deployed to close remain open.

Australian data residency

Sovereignty is a design decision, not a default.

Both Microsoft Entra SSE and Fortinet FortiSASE can support Australian traffic inspection, but residency should not be assumed from the platform name alone. For organisations with Privacy Act obligations, regulated-industry requirements or government-aligned policy, sovereignty is decided at the architecture stage. The design should document precisely:

  • Where traffic is processed
  • Where logs are retained
  • Where management data resides
  • Who has administrative access
  • Which support personnel can access management data
  • Which data types may cross borders
  • Which controls and contractual settings apply
Microsoft Entra SSE

Identity-led residency

Supports Australian points of presence for Global Secure Access. Traffic can be designed to use Australian infrastructure where available; management and policy data should be reviewed against Microsoft's Australian residency commitments and the tenancy configuration.

Fortinet FortiSASE

Edge-led residency

Supports Australian management and inspection architecture when designed accordingly. Where in-country management is required, review FortiManager, FortiAnalyzer, FortiSASE points of presence and log handling explicitly — particularly where Fortinet already manages the branch edge.

OAIC APP 8

Cross-border accountability

Where SASE telemetry, access logs or identity events are processed by a management plane outside Australia, APP 8 creates accountability obligations for cross-border disclosure. Document where each data type is processed and confirm handling before deployment.

The output should be an auditable residency record, not only a vendor assurance. Local traffic inspection can reduce cross-border data-transfer exposure under the Australian Privacy Principles when designed correctly.

Compliance alignment

SASE can support Essential Eight controls, but architecture alone does not deliver compliance.

SASE addresses several of the most operationally difficult Essential Eight controls in a distributed environment. Correct configuration, operational discipline and documented evidence still determine the outcome.

  • Restrict Administrative Privileges — ZTNA can enforce just-in-time, application-level access for privileged connections; administrators hold no standing network-level access, and access is scoped, verified at connection and logged
  • Multi-Factor Authentication — Conditional Access enforces MFA for remote access, privileged operations, internet and application access from one control plane; value depends on coverage and exception control
  • Application Control — Secure Web Gateway supports application allow-listing, web filtering and policy enforcement regardless of user location, especially for SaaS, browser-based tools and AI services
  • Patch Management and device compliance — Conditional Access can enforce device compliance including patch status as a condition of access, with a continuous (not point-in-time) posture signal
  • Audit evidence — a continuous record of who accessed what application, from which device, when, under which policy and with what compliance status — the evidence perimeter-led stacks cannot capture consistently for a distributed workforce
Failure modes

Most SASE deployment failures are identity, sequencing and ownership failures.

These are the specific failure modes that appear consistently in deployments that did not start with the right foundation — each with the fix that prevents it.

01
Identity not cleaned up before policy deployment

Policies applied to a disorganised identity estate produce unpredictable outcomes. Stale groups grant access to the wrong users; orphaned accounts create gaps; MFA exceptions become permanent access exceptions. Fix: complete identity and access mapping before any policy is deployed.

02
Application dependencies not mapped before VPN replacement

VPN often provides implicit access to services no one has documented — legacy applications, file shares, printers, RDP paths, service accounts and protocol dependencies. When ZTNA replaces VPN without mapping these, legitimate access breaks. Fix: complete an application dependency map before pilot rollout.

03
SASE deployed as a vendor product, not an access architecture

A platform is purchased before access policy, identity readiness, support ownership or application scope is understood. The result is a technically deployed product that does not change the risk model. Fix: define the access architecture, identity prerequisites and operating model before platform selection.

04
VPN kept indefinitely as a fallback

Parallel running can be necessary during migration, but keeping VPN indefinitely undermines the control model — users and support teams revert to the legacy path when friction appears. Fix: define staged VPN decommission criteria before rollout begins.

05
No owner for ongoing access policy

Policy does not stay clean without ownership. Groups change, users move roles, new SaaS tools appear, contractors come and go. Without a defined owner for Conditional Access, ZTNA entitlements, CASB rules and exception review, drift begins quickly. Fix: assign policy ownership and review cadence as part of deployment scope.

Example context

What a staged SASE transition can look like.

As an illustration of the pattern rather than a specific engagement: a Microsoft 365-heavy, multi-site branch-operations group was running legacy VPN for remote users and branch-to-application access. Users reported Teams degradation on VPN, and contractors had network-level access to systems they had no business reason to reach. The identity review found 34 stale accounts, inconsistent MFA enforcement and multiple contractor accounts with broad access.

The transition started with identity cleanup and application dependency mapping before any ZTNA policy was deployed. A controlled pilot validated access to key applications while the legacy VPN remained available; ZTNA and Secure Web Gateway policies were then rolled out progressively by user group. The VPN was decommissioned only after each group was validated against the new access model. That is the difference between deploying a SASE product and sequencing an access transition.

Inlight IT view

SASE is not a product decision. It is an operating-model decision about trust.

The most common mistake is treating SASE as a replacement for VPN rather than a redesign of access. VPN asks whether a user can reach the network. SASE asks whether this user, on this device, in this context, should access this application now — and that difference is the whole point. For Australian organisations the best architecture usually follows one of three paths, and the right one depends on the existing identity stack, edge architecture, data-residency position and operating model:

  • Microsoft-led — where Entra ID, Microsoft 365 and Conditional Access are already the control plane
  • Fortinet-led — where Fortinet SD-WAN and FortiGate already form the network and security edge
  • Combined — where Microsoft handles identity-led access and SaaS visibility while Fortinet handles branch edge and SD-WAN
Do not choose Entra SSE just because the organisation uses Microsoft 365 — first confirm the identity estate is mature enough to carry the policy model. Do not choose FortiSASE just because FortiGate is at the edge — first confirm FortiOS, FortiManager, FortiAnalyzer, policy ownership and patch governance are properly operated. Do not run SASE and VPN indefinitely as two parallel access models — transitional coexistence is normal; permanent coexistence weakens the control model.

Inlight IT helps Australian organisations assess, design and transition SASE architecture across Microsoft, Fortinet and combined environments — usually starting with current access architecture, identity readiness, application dependencies, VPN usage, data-residency requirements and Essential Eight alignment. The recommendation follows the environment, not a default vendor preference: platform fit, sovereignty and management-plane requirements are designed in rather than retrofitted under audit pressure, deployment is sequenced as a defined engagement, and access policy, exception review, logging and evidence continue after deployment with named ownership.

The discipline is not technical. It is sequencing identity, applications and ownership before platform.

Before the platform

Sequencing beats platform choice: the deployments that stall are the ones that bought the stack before mapping identity and applications.

Sequence it first →
Common questions

Questions that come up before a SASE deployment.

What are the five pillars of SASE?
SD-WAN, Zero Trust Network Access, Secure Web Gateway, Cloud Access Security Broker and Firewall as a Service. SD-WAN provides application-aware connectivity; ZTNA provides identity-based application access rather than network access; Secure Web Gateway inspects and filters internet-bound traffic; CASB provides visibility and control over SaaS and cloud data; Firewall as a Service provides cloud-delivered firewall policy. Most organisations activate ZTNA and SWG first, then add CASB as governance matures; SD-WAN is often already in place.
How long does a SASE deployment take?
A structured deployment typically runs 8 to 16 weeks from identity audit to full VPN decommission. Assessment and identity cleanup takes 2 to 4 weeks; the controlled pilot 3 to 6 weeks; full rollout and decommission completes in the following 4 to 8 weeks. The critical path is identity and dependency mapping, not technical configuration — organisations that skip identity cleanup often extend the timeline when access problems emerge during rollout.
What is the difference between Microsoft Entra SSE and Fortinet FortiSASE?
Entra SSE is usually right for organisations already on Microsoft 365 and Entra ID with Conditional Access in use — it integrates natively with existing Microsoft identity controls and needs no new branch-edge hardware. FortiSASE is usually right for organisations with Fortinet SD-WAN already deployed, where SASE activates on the same FortiGate hardware without a redesign. Both support Australian infrastructure and can coexist in larger environments.
Does SASE keep Australian data in Australia?
It can, but it depends on the platform, tenant configuration, points of presence, log retention and management access model. Both platforms can support Australian points of presence. For Privacy Act or government-aligned requirements, the architecture should be designed to keep traffic processing, log retention and management access aligned to the organisation's obligations — explicit design decisions, not default behaviour. Where logs or identity events are processed offshore, OAIC APP 8 cross-border obligations should be assessed before deployment.
How does SASE support Essential Eight compliance?
ZTNA supports Restrict Administrative Privileges via just-in-time, application-level privileged access; Conditional Access supports MFA on remote access, privileged operations and application access; Secure Web Gateway supports Application Control regardless of location; device-compliance signals can support patch-related access decisions. SASE supports Essential Eight alignment but does not deliver compliance on its own — configuration and operational discipline determine the outcome.
Can SASE be deployed without SD-WAN?
Yes. SASE and SD-WAN are complementary but independent. Organisations with a primarily remote or hybrid workforce but no multi-site WAN can deploy SSE — ZTNA, Secure Web Gateway and CASB — without SD-WAN. Organisations with both requirements typically deploy them together as a converged architecture.
What is the difference between SSE and SASE?
Security Service Edge covers the identity-based access and internet-security layer: ZTNA, Secure Web Gateway and CASB. SASE includes SSE plus the networking layer, most commonly SD-WAN. For organisations starting with remote access and SaaS visibility, SSE is often the first step; for those modernising branch networking at the same time, SASE is the broader target. Entra Internet Access and Private Access deliver SSE; FortiSASE delivers converged SASE where Fortinet SD-WAN is already in place.
Should we choose single-vendor SASE or a combined architecture?
A single-vendor model can simplify policy, visibility and support. A combined architecture is often the better fit where Entra SSE already handles identity-led access and Fortinet remains the edge platform for branch networking. Most Australian organisations arrive at one of three positions — Microsoft-led, Fortinet-led or combined — and the right choice depends on the existing identity stack, edge architecture, data-residency requirements and operational model.
Does SASE require replacing our existing identity platform?
No. In most Australian environments SASE should build on the identity platform already in place, usually Microsoft Entra ID. The work is not replacing identity; it is cleaning the estate, improving Conditional Access, confirming MFA coverage, validating device compliance and then applying SASE policy on top. If the identity platform is not mature enough, that is fixed before SASE policy is deployed.
Will SASE disrupt users during migration?
It should not when deployed in stages. The existing VPN remains available during discovery, cleanup and pilot; ZTNA and Secure Web Gateway policies are validated with a controlled group first; only after access, performance and support paths are confirmed does rollout expand. The legacy VPN is decommissioned only after the new model is validated for each user group.
What evidence does SASE provide for auditors and insurers?
Evidence of who accessed which application, from which device, at what time, under which policy and with what compliance status — plus MFA enforcement, Conditional Access decisions, user-risk signals, device compliance, web access, SaaS usage and blocked activity. For Essential Eight reviews, insurer scrutiny and internal audit, this creates evidence a legacy VPN and perimeter model usually cannot provide consistently for a distributed workforce.
Practical next step

Start with the identity estate, not the platform shortlist.

A practical conversation about remote-access architecture, Microsoft Entra ID readiness, VPN transition, SASE platform fit, Australian sovereignty and deployment sequencing, so the access model is designed before a platform is chosen.

Discuss SASE and Zero Trust