Not necessary. Direct access can be enabled for each of the users. The user credential data ( SAML Assertion) will be shared with the application server ( SAML SP) by the ZTA Controller. The gateway can help to whitelist the access for a particular domain where we can lock down the access to the ZTA agent. This configuration ensures that the users have to go through Zero Trust validations before accessing the public SaaS application over the organization's domain