Direct answer: Layots Technologies designed a Zero Trust SASE architecture that replaced broad third-party VPN access with identity-verified, application-specific access. The design combined federated identity, multi-factor authentication, device posture, ZTNA, cloud-delivered threat and data controls, and centralized session visibility.
In brief
Third-party access is essential—and difficult to control
Modern enterprises depend on partners, contractors, vendors, and service providers. These users often need rapid access to selected business applications, but they may work from unmanaged devices or networks outside the organization's direct control.
For one client, traditional VPN access had become the default solution. It provided connectivity, but it also created challenges: broad network visibility, complex onboarding, inconsistent device assurance, and limited context when investigating activity.
The client wanted a more precise model—one that enabled collaboration without extending unnecessary trust.
Defining access around business need
We first mapped third-party personas to the applications and tasks they actually required. A support vendor, implementation partner, temporary contractor, and business-process provider did not need the same access.
This persona-based discovery helped establish three principles:
The high-level architecture
Federated identity and strong authentication
Where appropriate, trusted partners used federated identity. Other external users followed a controlled guest identity process. Multi-factor authentication and conditional access provided a consistent verification layer.
Application-level Zero Trust access
Zero Trust Network Access replaced broad VPN connectivity for selected use cases. Private application connectors allowed the platform to broker connections without exposing internal applications directly to the internet. Policy determined which application each persona could reach.
Device-aware controls
Managed partner devices could be evaluated using device posture signals. For unmanaged or higher-risk endpoints, the design allowed stricter controls, including browser-based access patterns, download restrictions, or isolation where supported and appropriate.
Cloud-delivered threat and data protection
Traffic passed through relevant SASE controls such as secure web gateway, firewall-as-a-service, threat prevention, and data protection policies. The level of inspection was aligned with the application, data type, and session risk.
Central visibility and governance
Authentication, access, policy, and session events were centralized for monitoring and investigation. Access reviews and expiry dates were connected to the onboarding process so temporary access did not silently become permanent.
Designing the operating model
Technology was only part of the solution. We also defined ownership across business sponsors, identity teams, application owners, network teams, and security operations.
The lifecycle included:
This operating model made the architecture easier to govern and audit.
The resulting business value
The client gained a cleaner way to enable external collaboration while reducing reliance on broad network access. Onboarding became more consistent, policies were easier to understand, and security teams gained more useful context for monitoring third-party activity.
The solution also established a reusable pattern. As new vendors and partners were introduced, the client could map them to defined personas and access policies instead of building a one-off connection each time.
Rethink third-party access with Zero Trust
If partner and contractor access still depends on broad VPN connectivity, it may be time to redesign the experience around applications, identity, and risk.
Book a Zero Trust and third-party access assessment with Layots. We will help you identify priority use cases, define the target SASE architecture, and build a phased migration plan.
Frequently asked questions
How can SASE improve third-party access?
SASE can replace broad VPN connectivity with identity-aware access to specific applications. Security policy can also consider device posture, application sensitivity and session risk before permitting access.
Can contractors use unmanaged devices?
Where the selected platform and application support it, organizations can apply stricter browser-based controls, isolation, restricted downloads or step-up authentication to higher-risk unmanaged-device sessions.
What should a third-party access assessment include?
A useful assessment maps partner personas, required applications, identity methods, device ownership, data sensitivity, approval workflows, monitoring requirements and access-expiry processes.
About Layots Technologies
Layots Technologies Pvt Ltd helps enterprises design secure access models for employees, partners, vendors and contractors. Layots combines Zero Trust, SASE, networking and hybrid-cloud expertise to create practical transformation roadmaps. The company operates from Chennai, Bengaluru and Hyderabad. Request a free IT assessment at Layots.com.