The best cybersecurity platform for cloud-native enterprises with a zero-trust program

Microsoft Entra Private Access publishes private applications as Entra enterprise applications, so user assignment and Conditional Access policy for each one are set in Entra ID. Microsoft is our pick for cloud-native enterprises with a zero-trust program already using Entra ID, provided the order confirms supported Windows access clients and revocation behavior, multicloud CNAPP entitlements, policy ownership, branch connectivity, and full license and usage charges. For that buyer, access policy and Defender for Cloud, which Microsoft describes as a CNAPP, come from the vendor whose directory already signs its users in.

Palo Alto Networks suits the enterprise that runs its firewalls and puts a security policy shared between those firewalls and Prisma Access and branch connectivity first, with Cortex Cloud entitlements confirmed as a separate line. Zscaler suits the enterprise that keeps a configured SAML identity provider with SCIM and puts Zscaler internet and private access first, along with its branch options and clientless privileged remote access.

What should a cloud-native enterprise weigh in a zero-trust platform?

NIST SP 800-207A covers identity-based access controls for cloud-native applications in multicloud and hybrid environments, with policy that holds wherever the service or application runs. Have the quote name the access product, license and user coverage for internet and SaaS traffic and for private applications in your cloud accounts.

NIST's zero trust architecture publication, SP 800-207, treats authentication and authorization of both subject and device as discrete functions. When you read a vendor's timing for a disabled user, separate the network tunnel that is already open from a session an application issued itself, because Microsoft documents them on different pages with different intervals.

The SANS 2025 multicloud survey asks organizations to name their primary challenges in managing security across multiple clouds, and its discussion covers complexity, visibility, policy consistency, integration and skills. Microsoft's Defender for Cloud pricing and Palo Alto Networks' Cortex Cloud license plans each divide a CNAPP into separately licensed parts. Have the quote map posture, agentless scanning, runtime protection, code scanning and entitlement analysis to the licensed plan for each cloud.

The CNCF's report on its 2024 survey of cloud-native developers says "Security policies and controls are typically designed for a particular system." The order should name who owns the mapping between access rules and workload findings, and who enforces it, because a shared directory or a shared console does not by that fact make them one policy.

Microsoft's remote networks connect a branch through an IPsec tunnel with no client on its devices and carry Microsoft and internet traffic, with Private Access marked not supported on them. An enterprise with offices should put the same questions to every vendor: what a site tunnel carries and how it is licensed, and whether users behind it get identity-aware policy without a client.

Microsoft, Palo Alto Networks and Zscaler on access, identity, CNAPP, policy and branch

Microsoft: access policy in Entra ID and CNAPP plans in Defender for Cloud

Microsoft's Global Secure Access overview describes Entra Internet Access as an identity-based secure web gateway for internet and SaaS apps and Entra Private Access as a zero-trust network access service that replaces a VPN, and lists both as generally available. Both are included in the Entra Suite license and sold standalone, and users need Entra ID P1 or P2 for either. Microsoft's US pricing page lists Entra ID P1 from $7.00, the Entra Suite from $12.00 with Entra ID P1 or a package that includes it as a prerequisite, and each access product from $5.00 standalone, all per user per month, paid yearly.

Conditional Access applies to the Internet Access and Microsoft traffic profiles, and each Private Access enterprise application is targeted on its own. Defender for Cloud has its own security policy, a set of standards that produces recommendations across Azure, AWS and GCP.

Disabling a user invalidates refresh tokens at once, Microsoft's Universal Continuous Access Evaluation page says, and a Global Secure Access access token stays valid for 60 to 90 minutes. Universal CAE answers a disable event with a re-authentication prompt: if the user does not re-authenticate within 2 minutes of the prompt, all Global Secure Access tunnels are disconnected. The page adds that enforcement is not guaranteed unless the optional Strict Enforcement mode is configured in Conditional Access.

Only the Windows client at version 1.8.239.0 or later supports Universal CAE, Microsoft's known-limitations page says, and other platforms use regular tokens. That page describes the Windows flow from signal to disconnect as taking approximately ten minutes.

Microsoft's guide to revoking access says an app using access tokens loses access when the token expires, one hour by default. Entra ID cannot revoke a session token an app issued itself, the guide says, so the revocation terms for your own applications belong in the order beside the supported client versions.

Defender for Cloud's CSPM page lists a free Foundational CSPM plan and a paid Defender CSPM plan, and says pull request annotations, code-to-cloud mapping, attack path analysis and the security explorer require the paid one. Agentless machine scanning comes with Defender CSPM and with Defender for Servers Plan 2 for Azure VMs, AWS EC2 and GCP compute instances, and CIEM sits inside Defender CSPM for Entra ID, AWS IAM and Google Cloud IAM identities.

Defender for Containers lists runtime threat protection for Kubernetes with sensor-based binary drift detection and blocking, and DevOps security reports code, secrets, dependency and infrastructure-as-code findings from Azure DevOps, GitHub and GitLab. Microsoft's multicloud support matrix marks Defender CSPM, Defender for Servers, Defender for Containers and Defender for DevOps as generally available on both AWS and GCP at the plan level. Billing is per resource, the first 30 days are free and enabling the service enrolls every resource unless you opt out, so the quote should list each plan by cloud with the resources it will bill, and confirm per-feature status on AWS and GCP.

Microsoft's remote-network page points to Azure Virtual WAN for connections between one remote network and another. The overview page sets a combined minimum of 50 licenses across Entra ID P1 and Internet Access to turn remote networks on, and the known-limitations page caps a tenant at 200 remote networks with 25 device links each unless Microsoft Support raises the limit. Have the order state which license covers internet traffic from a branch and which users there need the client, because branch users without the client get the baseline security profile.

Microsoft's customer story on cellcentric, a cloud-first automotive joint venture, says it published engineering applications and file shares to corporate devices through Private Access and has Internet Access in a pilot. Simplex, an IT services firm for financial institutions with development environments on AWS, Azure and Google Cloud, adopted Defender for Cloud alongside Microsoft 365 E5 and moved configuration checks from annual audits to daily.

Palo Alto Networks: one policy set for firewalls and Prisma Access

Palo Alto Networks documents a security policy shared across its firewalls and Prisma Access in Strata Cloud Manager, with a global scope and folders for mobile users and remote networks. Have Palo Alto Networks confirm how the order applies that shared policy to the firewalls, remote users and branches you run.

The Prisma Access license page lists editions for secure internet browsing, for private applications and for all applications, and says configuration that uses an unlicensed capability is removed until the license is upgraded. Private applications hosted in AWS, GCP or Azure connect through the ZTNA Connector, which needs service version 5.0 or later. The base ZTNA or Enterprise license includes 10 connectors, a private-app add-on raises the ceiling to 200, and each connector carries up to 2 Gbps.

The Cloud Identity Engine gives Prisma Access read-only directory information for policy from on-premises Active Directory or OpenLDAP, Entra ID, Okta and Google. Directory changes sync about every five minutes by default for directories other than Google. An administrator sets the agent's re-authentication frequency between 10 hours and 30 days, with a default of 7 days and a separate gateway session timeout, and the timers feature is activated through the account representative. Those are sync and timer settings, so what happens to a live tunnel when a user is disabled in your directory, and how fast, is a term to get in writing.

Cortex Cloud is an annual subscription by protected-workload count and type, with usage averaged over 90 days, its license-plans page says. The base Posture license lists CSPM, CIEM, ASPM, DSPM, AI-SPM, attack-surface management, KSPM, CI/CD posture and agentless workload scanning, and the Runtime license includes Posture and adds workload protection with web and API protection. Application security for infrastructure as code, software composition analysis and secrets is an add-on priced per developer, and the data loss prevention add-on is labelled beta.

Palo Alto Networks' product pages describe agentless visibility across AWS, Azure, Google Cloud, OCI and Alibaba Cloud and effective-permissions analysis across AWS, Azure, Google Cloud and OCI. Cortex Cloud is documented and licensed apart from the firewall and Prisma Access policy set, so its entitlements are a separate line on the order.

Remote networks connect a branch from a Palo Alto Networks firewall or any third-party IPsec-compliant device, SD-WAN included, and the license page measures remote-network licensing in 1 Mbps units. Prisma SD-WAN is the company's own branch product, and the ZTNA Connector gives branch users private-app access over automatically managed tunnels.

Tipti's case study describes a fully cloud-native environment on AWS and Google Cloud that moved to Cortex Cloud from Palo Alto Networks' earlier cloud security product. The Puntos Colombia case study lists Cortex Cloud, Prisma Access and the firewalls in one deployment and describes a move to a zero-trust network access model.

Zscaler: access and branch services around the identity provider you keep

Zscaler Private Access requires a SAML 2.0-compliant identity provider with Zscaler registered as a service provider, and its SCIM documentation says ZPA supports SCIM 2.0 through an identity provider partnered with Zscaler for SCIM. That page maps the attribute active=false to deleting the user and presents directory disablement or deletion as a way to quickly remove users from Private Access. Ask what that removal does to a session already open, and how long it takes.

Zscaler also documents an Authentication Service with a hosted user database, MFA and provisioning through SAML JIT or SCIM. Its Adaptive Access Engine evaluates user, device and security-context signals at ZIA and ZPA enforcement points, and its prerequisites include Authentication Service for end users, enabled or migrated to. An enterprise that keeps its own provider should confirm how that prerequisite sits with its existing SAML and SCIM setup.

Zscaler's plans page lists Secure Internet Access for internet and SaaS traffic and ZPA for private applications. Its Essentials plan names ZPA Standard for 5% of users and its Zscaler Platform plan names ZPA Platform, so the private-access allowance for the whole workforce depends on the plan. The page also lists browser-based private access for third parties and users on unmanaged devices.

Privileged Remote Access gives browser-based access to RDP, SSH and VNC systems with time limits and session monitoring. The plans page says PRA Standard is included with platform purchases above 500 users and covers up to 10 systems with up to 1 GB of pooled data a month.

Zero Trust SD-WAN forwards branch traffic to the Zscaler platform over broadband from a physical or virtual Zscaler Edge appliance. Zero Trust Branch, on the plans page, comes in throughput bands from Small at up to 200 Mbps to X Large at up to 10 Gbps and forwards traffic to ZIA, ZPA, routed tunnels or directly to the internet.

Zscaler's DSPM covers discovery, classification, inventory and posture-risk analysis for sensitive data in hybrid and multicloud stores, and identifies the users, roles and resources with access to them. Zero Trust Cloud covers workload traffic across ingress, egress and east-west flows with microsegmentation. Zscaler's lifecycle notice for Posture Control announced end of sale on March 15, 2025 and end of life on March 15, 2026, and proposed replacing the remaining subscription term with DSPM at no extra charge. If your CNAPP list includes agentless posture scanning, runtime detection or code scanning, have Zscaler name the license that carries each one.

Zscaler's case study on Upland, which has more than 1,000 employees in 42 countries, says about 500 developers moved from VPN to ZPA in just over two months for direct access to AWS private apps, repositories, APIs and third-party tools. A later phase put ZIA in front of a 1,250-user global remote population. On Gartner Peer Insights, the Zscaler Platform holds a 4.5 overall rating from 104 ratings.

Which platform should a cloud-native enterprise with a zero-trust program choose?

Microsoft is our pick for cloud-native enterprises with a zero-trust program already using Entra ID, provided the order confirms supported Windows access clients and revocation behavior, multicloud CNAPP entitlements, policy ownership, branch connectivity, and full license and usage charges. We weight the Entra workflow for this buyer: private applications are assigned and given Conditional Access policy in the directory the enterprise already runs, and the Defender for Cloud plans for posture, runtime, code and entitlements are sold by the same vendor for Azure, AWS and GCP. Microsoft documents the prompt-to-disconnect interval and the Windows signal-to-disconnect flow separately, and Private Access does not travel over a remote-network tunnel. Defender for Cloud bills per resource under separately priced plans, so the full charges come from a quote that lists them.

Palo Alto Networks leads on shared policy: it documents a single security policy across its firewalls and Prisma Access, and Microsoft sets Conditional Access by traffic profile and by private application. We still put the Entra workflow first for an enterprise whose users and Conditional Access policies already live in Entra ID. An enterprise that runs Palo Alto Networks firewalls and puts that shared policy and branch connectivity first should choose Palo Alto Networks, with Cortex Cloud entitlements confirmed as their own line.

Zscaler is the better pick for an enterprise that keeps a configured SAML identity provider with SCIM and puts the access services first, with Zscaler branch appliances and browser-based privileged remote access on the same order. Its SCIM link to that provider deletes a deactivated user from Private Access, and its Privileged Remote Access reaches RDP, SSH and VNC systems from a browser.

Other cybersecurity platforms