Microtunnel
termcloudnetworking
ZPA's per-application, per-user-session thread riding inside the TLS connections from client and App Connector, stitched at a Service Edge.
The granularity is the security model: three apps, three Microtunnels.
A Microtunnel establishes an encrypted path to a single application rather than to a network, which is the mechanical expression of per-application access. Three applications means three tunnels, and each one is independently authorized, so reaching one grants nothing toward the others.
That granularity is the security model rather than an implementation detail. A conventional tunnel is a pipe onto a segment, and everything reachable through it is reachable by whoever holds the session. Splitting per application means a compromised session yields exactly one destination, and the segment those applications sit on remains invisible because it was never the thing being connected to.
The operational trade is the same one every per-application model carries: the inventory becomes the system. Each application must be defined, published and maintained, and anything nobody onboarded simply does not work, which surfaces forgotten dependencies during migration. That is genuinely painful and genuinely valuable, since the applications nobody remembered are also the ones nobody was patching.
Also known as: m-tunnel