# Zscaler Authentication — identity before policy Source: https://ai.techclick.in/blog_zscaler_authentication Markdown: https://ai.techclick.in/blog_zscaler_authentication.md Publisher: Techclick Infosec Pvt Ltd Best-practice ZIA authentication lesson: why identity matters, decision flow, method choice, full Microsoft Entra ID (Azure AD) SAML+SCIM runbook, PAC… ⚡ Quick answer (say this out loud) Zscaler authentication is two parts : first provision users (prefer SCIM from Entra), then authenticate with SAML when traffic hits a Public Service Edge. Known locations can fall back to location policy; unknown locations refuse if auth fails. For Azure: ZIA gallery app, Entity ID + ACS, PEM cert, Add IdP, SCIM Base URL + token, exempt Microsoft login hosts, assign users, prove with web logs that show the username. ## 1. Why identity matters ZIA can block malware without knowing your name. It cannot fairly split Finance from Interns, write clean audit reports, or control SaaS by group unless the Public Service Edge knows who is on the wire. Location-only policy is one door for everyone on a GRE/IPSec path — fast to deploy, blind in logs. User authentication is the production standard: email-format username on a registered domain, up to 128 groups, one department, secure cookie (or Kerberos ticket). Visual 2 — known vs unknown Known locations can still enforce something without a login; unknown locations must authenticate or get refused. #### Auth frequency Daily · Session · Custom (1–180 days) · Only once. Controls how often the cookie renews. #### Force reauthentication Invalidates cookies org-wide. Use after method changes or compromise — not at 10:00 Monday casually. ## 2. Mental model: provision → authenticate → policy Most “SAML is broken” tickets are provisioning gaps. Memorize this order. Flow 2 — Provision first, then authenticate - Two-part model (never skip step 1) 1 Provision Users / groups / depts into Zscaler CA Prefer SCIM from Entra 2 Authenticate SAML / LDAP / password / Kerberos at the ZEN Prefer SAML + Entra 3 Policy + logs User + group + dept + location controls Web log shows username Username = email on a registered domain Up to 128 groups · one department · auth frequency: Daily / Session / Custom / Once If the user is missing from Zscaler CA, Entra password success still fails at ZIA. Visual 3 — SCIM pipeline SCIM keeps users and groups near real-time without opening inbound firewall to AD. 💡 Operator tip Entra login green, ZIA red? Open Administration → Users first. If the person is not provisioned, no SAML assertion can invent them (unless auto-provision is correctly enabled — SCIM is still preferred). ## 3. Decision flow at the Public Service Edge Draw this on a whiteboard before you touch Admin Console. Flow 1 — Public Service Edge decision tree Traffic hits ZIA Public Service Edge (ZEN) Is location known? YES NO GRE / IPSec / static / dedicated port Home / hotel / unknown IP Auth enabled on location? Must authenticate Location policy only User auth OK user + location Refused User policy Surrogate IP (known location + XFF): user policy without a browser cookie Always start here in interviews and tickets: known location or not? ## 4. How to choose methods Situation Prefer Notes Normal enterprise with Entra/Okta SCIM + SAML Help Portal default modern design Tiny lab / :443/sfc_sso Entity ID usually matches cloud name · multi-org → org-specific entity ID from Zscaler UI Do Entra SAML first, then Zscaler IdP + SCIM, then exemptions and pilot. ### Prerequisites Entra tenant (Premium recommended for SCIM/group features) - Zscaler cloud name from your admin URL - Admin on both sides - Plan PAC/tunnel exemptions before forcing all web traffic through ZIA ### Side A — Microsoft Entra admin center - #### Add Zscaler Internet Access from the gallery Identity → Applications → Enterprise applications → New application . Search zscaler internet access . Pick the app that matches your cloud name (example: ZSBeta app when admin is on admin.zscalerbeta.net ). Create it. - #### Configure SAML App → Single sign-on → SAML → Basic SAML Configuration : Identifier (Entity ID) — usually cloud name (e.g. zscalerbeta.net ). Multi-org same cloud → use org-specific entity ID from Zscaler IdP UI. - Reply URL (ACS) — https://login. :443/sfc_sso . Add IPv6 ACS if enabled: https://login6. .net/sfc_sso . - Sign on URL — same as ACS. Relay State / Logout blank unless designed otherwise. - #### Attributes & claims Group claim: Groups assigned to the application. Source = cloud display names, or sAMAccountName for synced AD groups. - New claim: Name Department (case sensitive), source user.department . - NameID must map to the email-style username Zscaler expects. - #### Certificate + Login URL Download Certificate (Base64) . Rename to a single-dot .pem (example Entra.pem ). Copy Login URL (optional seamless: append ?whr= ). ### Side B — Zscaler Admin Console - #### Add IdP Administration → Identity → Internet & SaaS → Internet Authentication Settings → Identity Providers → Add IdP . SAML Portal URL = Entra Login URL - Login Name Attribute = NameID - Upload Entra.pem - Vendor = Microsoft Entra ID - Map domains (and locations if this is not the only IdP) - #### Default Settings → Authentication Type = SAML Set authentication frequency, Save & Activate. - #### Enable SCIM on that IdP SCIM Provisioning = ON. SAML Auto-Provisioning = OFF when SCIM is used. Copy Base URL + Bearer Token. Save & Activate. ### Side C — Entra provisioning + assign - #### Provisioning blade Mode Automatic → paste Base URL + token → Test connection → Scope Sync only assigned users and groups → Status On → Save. Watch the first cycle. - #### Users and groups Assign pilot groups to the enterprise app (required for group claims / meaningful SCIM scope). 🚫 Do not ship with these mistakes - Wrong gallery cloud app - Cert not single-dot .pem - SCIM and SAML auto-provision both ON - Nobody assigned to the app - Department claim not exactly Department ## 6. Runtime SAML + SCIM flows Visual 5 — SAML journey After go-live the browser carries the trust — redirect, Entra, assertion, cookie. Flow 4 — Runtime SAML after go-live - User → ZEN → Entra → ACS → cookie → original site Browser ZIA ZEN Entra IdP SAML assert Cookie + policy 1 User opens site → traffic steered to nearest Public Service Edge 2 Identity required → redirect to Zscaler auth → Entra Login URL 3 Entra authenticates (password / MFA / Conditional Access) 4 Signed assertion POSTed to ACS: login. :443/sfc_sso 5 Zscaler checks PEM trust + NameID → user exists in CA → sets secure cookie 6 Return to original URL → user/group/dept + location policy + named logs Loop trap: ACS or Entra forced through ZIA before the user is authorized Fix: Authentication Exemptions + PAC DIRECT for Microsoft login hosts Browser carries the assertion. Entra and Zscaler need no direct network path for SAML. Flow 5 — SCIM near real-time provisioning Entra SCIM client → Zscaler SCIM server → CA database Microsoft Entra Assigned users/groups SCIM 2.0 Bearer token Zscaler CA Users · groups · depts Operator settings that must match Zscaler: SCIM = ON · SAML Auto-Provisioning = OFF · copy Base URL + token Entra: Provisioning Automatic · Scope = assigned users/groups · Status = On Turn SCIM on and SAML auto-provision off for the same IdP. ## 7. Exemptions, PAC, Surrogate IP, and proof Unauthenticated browsers cannot complete SAML if Entra or ACS is forced through ZIA first. #### Authentication Exemptions (known locations) Policies → Common Configuration → Advanced → Advanced Settings → Authentication Exemptions — add at least: login.windows.net - login.microsoftonline.com - .windowsazure.com - aadcdn.msauth.net - aadcdn.msftauth.net Also exempt your cloud’s Zscaler login/ACS hosts. PAC DIRECT sample if (shExpMatch(host, "login.windows.net") || shExpMatch(host, "login.microsoftonline.com") || shExpMatch(host, "*.windowsazure.com") || shExpMatch(host, "aadcdn.msauth.net") || shExpMatch(host, "aadcdn.msftauth.net")) return "DIRECT"; GRE/IPSec: send IdP destinations direct to internet at the edge router — do not hairpin SAML into the tunnel. Surrogate IP: known location + XFF maps authenticated user to private IP for non-cookie/non-HTTP traffic. Optional enforce-for-known-browsers avoids multi-browser re-auth on one PC. ✅ Proof the change worked - Entra provisioning cycle healthy - User visible in Zscaler Users with groups/department - Pilot from known location: web log shows username - Hotspot (unknown location) still completes SAML - Allow/block matches user/group policy - Entra sign-in log aligns with ZIA timestamps Symptom Likely cause First check Redirect loop / blank auth PAC/tunnel hairpin Exemptions + DIRECT + ACS path Entra OK, ZIA SAML error PEM / NameID / Entity ID Cert, NameID, cloud app match Auth OK, wrong policy Groups / SCIM lag App assignment, SCIM logs, re-auth Remote refused Unknown loc + auth fail Provisioned? Domain → IdP map? Thick app ignores user policy No Surrogate IP Known loc + XFF + Surrogate IP Interview close: “Entra gallery ZIA app, SAML ACS and PEM trust, SCIM Base URL and bearer token, Microsoft login exemptions, pilot groups assigned, web logs prove the username.” ## Quick check — 6 questions Q1 Best modern Entra + ZIA design? Hosted passwords only SCIM provision + SAML authenticate Kerberos without provisioning Location auth forever Correct: b . Q2 ACS Reply URL shape? https://admin.<cloud>/login https://login.<cloud>:443/sfc_sso https://scim.<cloud>/Users https://gateway.<cloud>:8800 Correct: b . Q3 IdP certificate upload format? Any .jpg screenshot Base64 cert as single-dot .pem No cert needed .zip of metadata only Correct: b . Q4 When SCIM is on for an IdP: Keep SAML auto-provision ON too Turn SAML auto-provision OFF Delete Default Settings Disable SAML entirely Correct: b . Q5 Unknown location + auth fails? Location policy only Connection refused Always allowed Only DLP runs Correct: b . Q6 First fix for SAML redirect loop? Force reauth for whole org Exempt Entra + ACS from PAC/tunnel hairpin Delete GRE permanently Disable all URL filtering Correct: b . Check answers Reset ## Sources - Zscaler Help — Configuring SAML / SAML & SCIM for Microsoft Entra ID - Zscaler Help — Choosing Provisioning and Authentication Methods - ZCCA-IA Authentication Student Guide 5.6 - Techclick Zscaler Authentication handout Related: ZIA traffic flow · Zscaler interview hub --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt