Allowing full 'network like' access for users

If users are remote from the office LAN, the user's device cannot just talk to the Domain Controller (AD). When you connect through AppGate ZTNA with limited application access then the user's device still cannot talk to AD even though they might have just signed-in using AD as the IdP. This means that 'network like' services such as users being able to change their password and pushing group policy updates to the device will not work.

As with any application, for a user's device to be able to talk to AD the right Actions need to be included in a suitable Entitlement. Once this is done correctly then the user's device should behave much the same as if it were on the office LAN even when it is connected through AppGate ZTNA. However AD was never really designed with this use case in mind so the requirements are quite extensive.

Here are the Actions you should include in your AD Entitlement:

Should be in place already in your DNS Entitlement

Likely requirement for more recent network installations

May be required in specific situations