Who is on the wire — auth + ZCC deploy

Hero · who talks to whom

1. Why identity is the ticket

ZIA can block malware without a name. It cannot fairly split Finance from Interns, write a clean audit, or apply SaaS controls by group unless the Public Service Edge knows who is on the wire.

Location-only policy is one door for everyone on a GRE/IPSec path — fast to deploy, blind in logs. User authentication is the production standard: email-format username on a registered domain, up to 128 groups, one department, a secure cookie (or a Kerberos ticket).

Help is explicit: provisioning must be done first. Upload users, groups, and departments. Then enable authentication so the service can enforce user/group/department policy and write named logs. Unknown locations always require auth. Known locations can fall back to location policy if you leave auth off — and then every report is “Pune-HQ,” never “priya@example.com.”

Feel · three paths

2. Mental model — three parts only

Pre-train these before you open Default Settings.

1. Directory object — user ID is an email-style string on a domain you registered. Groups drive policy (max 128). Department is one, because reports and admin scope break if a person is counted twice.
2. Authentication Type — on Administration → Identity → Internet & SaaS → Internet Authentication Settings → Default Settings. Form-Based (hosted passwords) or SAML. Kerberos is enabled on the same page and needs a PAC that uses FQDNs.
3. Client Connector — the agent that enrolls the device to that same identity, then downloads an App Profile (who + OS) that names one Forwarding Profile (how). Identity and forwarding are different objects. Do not merge them in your head.

3. Decision flow — pick the method first

4. How to choose — SAML vs Form-Based vs Kerberos

Help lists five provisioning methods (SCIM, SAML auto-provision, Hosted User Database, directory sync, ZAB) and seven authentication methods. In production interviews you defend three authentication choices. LDAP BIND is the leftover for “we have AD, no SAML yet.”

5. Mini runbook — Default Settings, then ZCC

Goal: Authentication Type matches the choose table, then every managed laptop enrolls to that identity and pulls one App Profile. Source for Side A/B: Help Choosing Provisioning and Authentication Methods + About Authentication Default Settings. Source for Side C: Help Configuring Zscaler Client Connector App Profiles + Supported Parameters for Windows.

Feel · install → enroll → profile

Side A — Identity provider (when / why only)

1. Decide the pair before you click

   If Entra or Okta already owns SSO, the pair is SCIM + SAML. If you have no IdP and fewer than ~100 people, the pair is Hosted DB + Form-Based. If cookie-hostile apps will fail, add Kerberos on top of a provisioned directory — do not replace SAML with it.

2. If the answer is Entra SAML + SCIM, leave this page

   Do the gold runbook: gallery ZIA app that matches your cloud name → Entity ID + ACS → Department / groups claims → PEM → Add IdP → Authentication Type = SAML → SCIM ON / SAML auto-provision OFF → assign pilot groups. Return here for ZCC.

3. Exempt the IdP before you force traffic

   PAC DIRECT (or a GRE/IPSec exception at the edge router) for the IdP and the ACS. An unauthenticated browser cannot complete SAML if login.microsoftonline.com hairpins through ZIA. Details and host list: gold auth lesson, Exemptions section.

Side B — ZIA Default Settings + IdP object

1. Open Default Settings

   Administration → Identity → Internet & SaaS → Internet Authentication Settings → Default Settings. Newer tenants may show a thinner page because Authentication Service owns more of the profile — still start here, then follow the live labels.

2. Set Authentication Type

   SAML for the enterprise path. Form-Based only for Hosted DB passwords (Help: Configuring the Hosted User Database). If you enable Kerberos, leave users pre-provisioned and plan the PAC in the same change window.

3. Set Authentication Frequency, then Save & Activate

   Daily / Session / Custom (1–180 days) / Only once. Session plus a captive-portal café is how “I keep getting the login page” tickets are born. Activate — a saved-but-not-activated profile is still the old method.

4. Add the IdP only if Type is SAML

   … → Identity Providers → Add IdP. SAML Portal URL, Login Name Attribute = NameID, upload the IdP PEM, map domains. Do not paste ACS strings from memory — copy them from the gold lesson or the live IdP UI.

Side C — ZCC install + App Profile

Identity without an agent still works for PAC/GRE browsers. Production laptops need Client Connector so the same username follows the user off the office GRE.

1. Build the App Profile before the MSI

   Infrastructure → Connectors → Client → Windows → App Profiles → Add Windows Policy (macOS / Linux / iOS / Android each have their own tab — the OS is the tab, not a field). Set Name, Rule Order (ascending — lowest number wins), Status = Enabled, and one Forwarding Profile. Scope users/groups. A VIP rule at order 3 never matches if Default-Win sits at 1.

2. Copy the policy token for that profile

   POLICYTOKEN is the pre-enroll profile. After the user enrolls, the group-matched App Profile supersedes it. That replacement is expected, not a bug.

3. Silent Windows install (Intune / SCCM / GPO)

   Documented MSI properties. STRICTENFORCEMENT=1 requires CLOUDNAME and POLICYTOKEN. USERDOMAIN must match the SAML NameID domain so ZCC skips the “type your domain” screen and goes to SSO.

4. Lock the agent

   ENABLEANTITAMPERING=1 stops users killing services. Silent uninstall uses UNINSTALLPASSWORDCMDLINE (ZCC 4.2.1+), which must match the portal uninstall password — not a homemade LOGINPASSWORD flag. App Profile also has Exit or Uninstall Password for fail-close.

msiexec /i Zscaler-windows-4.x.msi /qn ^
  CLOUDNAME=zscalerthree.net ^
  USERDOMAIN=example.com ^
  POLICYTOKEN=00000000-lab-policy-token ^
  STRICTENFORCEMENT=1 ^
  ENABLEANTITAMPERING=1 ^
  HIDEAPPUIONLAUNCH=1

function FindProxyForURL(url, host) {
  if (isPlainHostName(host) ||
      shExpMatch(host, "login.microsoftonline.com"))
    return "DIRECT";
  return "PROXY ${GATEWAY_HOST}:80";
}

6. Runtime — browser cookie vs ZCC enroll

After go-live there are two identity paths. They must name the same user.

7. Traps + how to prove who is on the wire

Three production failures show up in every Batch 11 lab. Learn the evidence, not the folklore.

Feel · proof cockpit

Sources

• Zscaler Help — Choosing Provisioning and Authentication Methods (Help export 01 Aug 2026)
• Zscaler Help — Understanding User Provisioning and Authentication
• Zscaler Help — Configuring the Default Authentication Profile · Configuring the Hosted User Database
• Zscaler Help — About Kerberos Authentication · Adding Identity Providers
• Zscaler Help — SAML & SCIM Configuration Guide for Microsoft Entra ID (full click-path is in the gold lesson)
• Zscaler Help — Configuring Zscaler Client Connector App Profiles · About Zscaler Client Connector App Profiles
• Zscaler Help — Supported Parameters for Zscaler Client Connector for Windows · Customizing Install Options for MSI
• ZCCA-IA Authentication Student Guide 5.6 · Techclick Zscaler Authentication handout (Aug 2026)

Related: Gold · Zscaler Authentication (Entra SAML + SCIM runbook) · Batch 11 · Lesson 3 — traffic forwarding · ZCC App & Forwarding Profiles · ZIA traffic flow