Zero Trust Access Profile Deletion Causing User Access Loss

Available Languages

Download Options

  • PDF     (4.6 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (81.2 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (65.5 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:August 25, 2026
Document ID:226290

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Issue

After deleting a Zero Trust Access (ZTA) profile that was believed to be unused, all users with the ZTNA module experienced complete loss of access to both private resources and internet navigation. The deletion of this profile resulted in immediate service disruption for all ZTNA users, preventing them from accessing any resources through the Zero Trust Network Access infrastructure.

The affected users were unable to establish connections to:

  • Private internal resources

  • Internet navigation through the ZTNA module

Environment

  • Secure Access (Zero Trust Network Access)

  • ZTNA module deployed with multiple user profiles

  • Default policy configured with ZTNA control

  • Multiple ZTA profiles configured for user access management

Resolution

Understand ZTA Profile Matching Logic

Zero Trust Access profiles are applied based on a specific matching order and logic:

  • Profile Matching Order: ZTA profiles are evaluated in order based on user and destination matching criteria

  • Default Profile Behavior: When no specific profile matches the user or destination criteria, the system falls back to the default profile

  • Profile Dependencies: Deleting a profile that serves as the effective default can cause service disruption even if it appears unused

The deleted profile was likely functioning as the effective default profile for user matching, despite appearing unused in the configuration interface. When this profile was removed, users lost their primary access path through the ZTNA infrastructure.

Validation Steps

To prevent similar issues in the future, this validation approach needs to be implemented:

1.- Review all configured ZTA profiles and their matching criteria before deletion.

2.- Identify which profile serves as the effective default for user access.

3.- Verify user-to-profile mapping through configuration screenshots and policy review.

4.- Test profile changes in a controlled manner before applying to production.

Cause

The root cause was the deletion of a ZTA profile that was functioning as the effective default profile for ZTNA user access, despite appearing unused in the configuration interface. When this profile was removed, the system lost the primary matching criteria for user access, causing all ZTNA users to lose connectivity to both private resources and internet navigation. The profile matching logic depends on having a valid default profile available for fallback when specific user or destination criteria are not met by other configured profiles.

Related Content

Revision History

Revision Publish Date Comments
1.0
25-Aug-2026
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Amit Arora
    Technical Consulting Engineering Technical Leader

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products