SOURCINGBLOX DEMake an appointment
Menu
Services SolutionsZero Trust ConsultingManaged SecurityPQC ReadinessBranch & MPLSIoT/OT & CellularSovereign Security HostingZscaler × CrowdStrike Lexicon Blog Tools Make an appointment
Home›Lexicon›Zero Trust Microsegmentation
For Cloud Platform, Data Center, Security Architecture, and Workload Owner

Zero Trust Microsegmentation: Limit workload communication.

Flat data center and cloud networks facilitate lateral movement. Microsegmentation reduces achievable paths between workloads—it only becomes effective with resilient inventory, observed flows, and a controlled policy lifecycle.

Short answer · Technical practical relevance · Walkthrough · Source: 25 July 2026
Briefly explained

What is Zero Trust Microsegmentation?

Microsegmentation divides resources or workloads into small, separately protected areas and enforces communication rules close to those resources. In a Zero Trust architecture, identity, tags, and context can be factored into the decision, in addition to IP and network segments.

The Problem: Known Applications Have Unknown East-West Dependencies

Application teams often document frontend, backend, and database, but not all monitoring, update, directory, or batch connections. An immediately restrictive policy can therefore interrupt productive processes.

If microsegmentation remains permanently in observation mode, the risk does not decrease either. The transition requires prioritized applications, responsible owners, verified flows, and a controlled enforcement step.

Typical scenario

A mission-critical application consists of multiple workloads in two cloud environments. Before segmentation, real communication flows are observed, technical service identities are assigned and only the necessary relationships are formulated as a policy.

Segmentation starts with resources and relationships

VLANs or subnets alone rarely provide the desired granularity.

Inventory

Capture workloads, services, owner, environment, and criticality as you go.

Discovery

Observe actual communication flows and time-dependent processes.

Identity & Tags

Use stable properties instead of ephemeral IP addresses for policies.

Policy

Define allowed relationships, direction, port, protocol, and exception.

Enforcement

Enable rules close to workload or gateway in stages.

Lifecycle

Check for changes, drift, new dependencies, and orphaned rules regularly.

Zscaler Branch Connector and /32 On-Site Micro-Segmentation

Zscaler documents Branch Connector as the basis for east-west segmentation and for limiting lateral movement. Instead of giving devices blanket access to a site or data center network, ZIA, ZPA and branch policies can control the required targets and applications.

If devices or sources are deliberately modeled as individual host addresses, each IPv4 address corresponds to a /32prefix and can become its own policy unit. For example, branch modernization can provide micro-segmentation without first building new VLANs or firewall zones.

The benefit does not automatically come from the appliance. Reliable device-to-IP mapping, defined target relationships, a suitable DHCP/addressing concept, negative tests and a lifecycle for exceptions are required. The specific /32 behavior must therefore be verified in the branch design and pilot.

View Zscaler Branch and MPLS Modernization →

What needs to be checked before making a decision?

  • What workloads and service owners are in scope?
  • What flows were observed over a representative period of time?
  • Which tags or identities are stable and trustworthy?
  • What are the batch, backup, and emergency paths?
  • How are policy changes tested and rolled back?
  • How are new workloads and drift detected?

Definition: Microsegmentation does not replace secure workload configuration, vulnerability remediation, or identity control. It limits communication paths and thus potential movement possibilities.

How SourcingBlox Adopts Microsegmentation at Low Risk

We bring discovery, policy and enforcement together in controlled application waves.

01

Workload Discovery

Capture inventory, owner, criticality, and real-world communication relationships.

02

Policy Modeling

Model target relationships, clarify deviations and check rules in observation mode.

03

Controlled Enforcement

Activate gradually, measure impact and practice policy hygiene permanently.

Typical mistakes

  • Segment IP addresses without workload and owner context.
  • Use only a short observation period.
  • Start directly with all applications at the same time.
  • Do not conduct drift and rule reviews after the introduction.

Frequently Asked Questions

Is microsegmentation the same as VLAN segmentation?

No. VLANs can be part of segmentation, but microsegmentation targets much more granular resource and workload relationships.

Does Zscaler Branch Connector automatically generate micro-segmentation?

No. Branch Connector builds a strong foundation with east-west segmentation and application-centric policies. A host-accurate /32 model also requires clean IP mapping, appropriate rules, tests, and an exception process.

How long should Discovery run?

So long that normal, periodic and infrequent business processes are recorded. The required period depends on the application.

Can microsegmentation work in multi-cloud environments?

Yes, if inventory, identities or tags, policy enforcement, and operational processes are made consistent across the environments involved.

Concrete next step

Prepare an application for microsegmentation in a controlled manner.

We connect flow discovery, workload context, policy model, and enforcement plan.

View Segmentation Assessment

Related Content

Zscaler Branch and MPLS modernization →Zero Trust Architecture →SASE vs. SSE →ZIA vs. ZPA →

Sources and further information

The technical design must be tested against addressing, branch and workload platform, supported enforcement points, and application dependencies.