I assume you mean the 'ziti admin console' (ZAC). Sure, you can. There are numerous posts on the forum and videos that cover "splitting the api". You want to split your api onto two ports (and possibly two ips, but that's up to you). Leave the "client-api" and "oidc" on the public port and move the fabric, edge and zac to the private port. Example thread/post: Unable to configure Controller with split API - #5 by control_joe