TTechclick ← All lessons
Zscaler · ZIA · Entra ID · SAML · SCIM

Zscaler Authentication — identity before policy

A ticket says “internet is broken.” Half the time ZIA is fine — the user was never authenticated, never provisioned, or SAML is looping through the tunnel. This lesson teaches the real model, then walks a full Microsoft Entra ID → Zscaler SAML + SCIM onboarding with flow charts you can reuse in class and interviews.

📅 Aug 2026·⏱ ~22 min·5 flow charts · Imagine visuals·L2-first writing

You will walk out able to

Visual 1 — trust triangle
User Entra ID and Zscaler connected
Trust triangle: user, Microsoft Entra ID (IdP), Zscaler ZIA (SP).

⚡ Quick answer (say this out loud)

Zscaler authentication is two parts: first provision users (prefer SCIM from Entra), then authenticate with SAML when traffic hits a Public Service Edge. Known locations can fall back to location policy; unknown locations refuse if auth fails. For Azure: ZIA gallery app, Entity ID + ACS, PEM cert, Add IdP, SCIM Base URL + token, exempt Microsoft login hosts, assign users, prove with web logs that show the username.

1. Why identity matters

ZIA can block malware without knowing your name. It cannot fairly split Finance from Interns, write clean audit reports, or control SaaS by group unless the Public Service Edge knows who is on the wire.

Location-only policy is one door for everyone on a GRE/IPSec path — fast to deploy, blind in logs. User authentication is the production standard: email-format username on a registered domain, up to 128 groups, one department, secure cookie (or Kerberos ticket).

Visual 2 — known vs unknown
Known office path versus unknown home path
Known locations can still enforce something without a login; unknown locations must authenticate or get refused.

Auth frequency

Daily · Session · Custom (1–180 days) · Only once. Controls how often the cookie renews.

Force reauthentication

Invalidates cookies org-wide. Use after method changes or compromise — not at 10:00 Monday casually.

2. Mental model: provision → authenticate → policy

Most “SAML is broken” tickets are provisioning gaps. Memorize this order.

Flow 2 — Provision first, then authenticate
Two-part model (never skip step 1) 1 Provision Users / groups / depts into Zscaler CA Prefer SCIM from Entra 2 Authenticate SAML / LDAP / password / Kerberos at the ZEN Prefer SAML + Entra 3 Policy + logs User + group + dept + location controls Web log shows username Username = email on a registered domain Up to 128 groups · one department · auth frequency: Daily / Session / Custom / Once
If the user is missing from Zscaler CA, Entra password success still fails at ZIA.
Visual 3 — SCIM pipeline
SCIM from Entra into Zscaler
SCIM keeps users and groups near real-time without opening inbound firewall to AD.
💡 Operator tip

Entra login green, ZIA red? Open Administration → Users first. If the person is not provisioned, no SAML assertion can invent them (unless auto-provision is correctly enabled — SCIM is still preferred).

3. Decision flow at the Public Service Edge

Draw this on a whiteboard before you touch Admin Console.

Flow 1 — Public Service Edge decision tree
Traffic hits ZIA Public Service Edge (ZEN) Is location known? YES NO GRE / IPSec / static / dedicated port Home / hotel / unknown IP Auth enabled on location? Must authenticate Location policy only User auth OK user + location Refused User policy Surrogate IP (known location + XFF): user policy without a browser cookie
Always start here in interviews and tickets: known location or not?

4. How to choose methods

SituationPreferNotes
Normal enterprise with Entra/OktaSCIM + SAMLHelp Portal default modern design
Tiny lab / <~100 usersHosted DBCSV/manual; passwords in Zscaler
On-prem AD, no SAML yetLDAP sync + BIND or ZABPasswords stay on-prem; ZAB if inbound blocked
Cookie-hostile appsKerberosNeeds PAC with FQDN; users pre-provisioned

5. Entra ID onboarding runbook (production path)

Goal: Entra = IdP, Zscaler = SP, SCIM provisions, SAML authenticates.

Visual 4 — config surfaces
Entra and Zscaler config surfaces
You will touch gallery app, SAML cert, ACS URL, SCIM token, and exemption lists.
Flow 3 — Entra ID to Zscaler onboarding (runbook map)
Side A Entra → Side B Zscaler → Side C prove 1 Gallery app ZIA + cloud name 2 SAML URLs Entity + ACS 3 Claims Groups + Dept 4 PEM + Login Base64 → .pem 5 Zscaler Add IdP Portal URL + NameID 6 Auth type SAML Default Settings 7 Enable SCIM Base URL + token 8 Entra Provisioning On Assigned users only 9 Exempt + test PAC + pilot ACS shape (copy carefully) https://login.<ZscalerCloudName>:443/sfc_sso Entity ID usually matches cloud name · multi-org → org-specific entity ID from Zscaler UI
Do Entra SAML first, then Zscaler IdP + SCIM, then exemptions and pilot.

Prerequisites

Side A — Microsoft Entra admin center

  1. Add Zscaler Internet Access from the gallery

    Identity → Applications → Enterprise applications → New application. Search zscaler internet access. Pick the app that matches your cloud name (example: ZSBeta app when admin is on admin.zscalerbeta.net). Create it.

  2. Configure SAML

    App → Single sign-on → SAML → Basic SAML Configuration:

    • Identifier (Entity ID) — usually cloud name (e.g. zscalerbeta.net). Multi-org same cloud → use org-specific entity ID from Zscaler IdP UI.
    • Reply URL (ACS) — https://login.<ZscalerCloudName>:443/sfc_sso. Add IPv6 ACS if enabled: https://login6.<cloud>.net/sfc_sso.
    • Sign on URL — same as ACS. Relay State / Logout blank unless designed otherwise.

  3. Attributes & claims

    • Group claim: Groups assigned to the application. Source = cloud display names, or sAMAccountName for synced AD groups.
    • New claim: Name Department (case sensitive), source user.department.
    • NameID must map to the email-style username Zscaler expects.

  4. Certificate + Login URL

    Download Certificate (Base64). Rename to a single-dot .pem (example Entra.pem). Copy Login URL (optional seamless: append ?whr=<domain>).

Side B — Zscaler Admin Console

  1. Add IdP

    Administration → Identity → Internet & SaaS → Internet Authentication Settings → Identity Providers → Add IdP.

    • SAML Portal URL = Entra Login URL
    • Login Name Attribute = NameID
    • Upload Entra.pem
    • Vendor = Microsoft Entra ID
    • Map domains (and locations if this is not the only IdP)

  2. Default Settings → Authentication Type = SAML

    Set authentication frequency, Save & Activate.

  3. Enable SCIM on that IdP

    SCIM Provisioning = ON. SAML Auto-Provisioning = OFF when SCIM is used. Copy Base URL + Bearer Token. Save & Activate.

Side C — Entra provisioning + assign

  1. Provisioning blade

    Mode Automatic → paste Base URL + token → Test connection → Scope Sync only assigned users and groups → Status On → Save. Watch the first cycle.

  2. Users and groups

    Assign pilot groups to the enterprise app (required for group claims / meaningful SCIM scope).

🚫 Do not ship with these mistakes

6. Runtime SAML + SCIM flows

Visual 5 — SAML journey
SAML journey panels
After go-live the browser carries the trust — redirect, Entra, assertion, cookie.
Flow 4 — Runtime SAML after go-live
User → ZEN → Entra → ACS → cookie → original site Browser ZIA ZEN Entra IdP SAML assert Cookie + policy 1 User opens site → traffic steered to nearest Public Service Edge 2 Identity required → redirect to Zscaler auth → Entra Login URL 3 Entra authenticates (password / MFA / Conditional Access) 4 Signed assertion POSTed to ACS: login.<cloud>:443/sfc_sso 5 Zscaler checks PEM trust + NameID → user exists in CA → sets secure cookie 6 Return to original URL → user/group/dept + location policy + named logs Loop trap: ACS or Entra forced through ZIA before the user is authorized Fix: Authentication Exemptions + PAC DIRECT for Microsoft login hosts
Browser carries the assertion. Entra and Zscaler need no direct network path for SAML.
Flow 5 — SCIM near real-time provisioning
Entra SCIM client → Zscaler SCIM server → CA database Microsoft Entra Assigned users/groups SCIM 2.0 Bearer token Zscaler CA Users · groups · depts Operator settings that must match Zscaler: SCIM = ON · SAML Auto-Provisioning = OFF · copy Base URL + token Entra: Provisioning Automatic · Scope = assigned users/groups · Status = On
Turn SCIM on and SAML auto-provision off for the same IdP.

7. Exemptions, PAC, Surrogate IP, and proof

Unauthenticated browsers cannot complete SAML if Entra or ACS is forced through ZIA first.

Authentication Exemptions (known locations)

Policies → Common Configuration → Advanced → Advanced Settings → Authentication Exemptions — add at least:

Also exempt your cloud’s Zscaler login/ACS hosts.

PAC DIRECT sample 
if (shExpMatch(host, "login.windows.net") ||
    shExpMatch(host, "login.microsoftonline.com") ||
    shExpMatch(host, "*.windowsazure.com") ||
    shExpMatch(host, "aadcdn.msauth.net") ||
    shExpMatch(host, "aadcdn.msftauth.net"))
    return "DIRECT";

GRE/IPSec: send IdP destinations direct to internet at the edge router — do not hairpin SAML into the tunnel.

Surrogate IP: known location + XFF maps authenticated user to private IP for non-cookie/non-HTTP traffic. Optional enforce-for-known-browsers avoids multi-browser re-auth on one PC.

✅ Proof the change worked
SymptomLikely causeFirst check
Redirect loop / blank authPAC/tunnel hairpinExemptions + DIRECT + ACS path
Entra OK, ZIA SAML errorPEM / NameID / Entity IDCert, NameID, cloud app match
Auth OK, wrong policyGroups / SCIM lagApp assignment, SCIM logs, re-auth
Remote refusedUnknown loc + auth failProvisioned? Domain → IdP map?
Thick app ignores user policyNo Surrogate IPKnown loc + XFF + Surrogate IP

Interview close: “Entra gallery ZIA app, SAML ACS and PEM trust, SCIM Base URL and bearer token, Microsoft login exemptions, pilot groups assigned, web logs prove the username.”

Quick check — 6 questions

Q1

Best modern Entra + ZIA design?

Correct: b.
Q2

ACS Reply URL shape?

Correct: b.
Q3

IdP certificate upload format?

Correct: b.
Q4

When SCIM is on for an IdP:

Correct: b.
Q5

Unknown location + auth fails?

Correct: b.
Q6

First fix for SAML redirect loop?

Correct: b.

Sources

Related: ZIA traffic flow · Zscaler interview hub