T Techclick ← All lessons
Zscaler · Batch 11 · Lesson 5 · URL Filtering + Cloud App

URL Filtering + Cloud App Control — category vs app, then prove it

The ticket is never “policy is broken.” It is “YouTube still uploads,” “the CEO is blocked from a site we allowed,” or “personal OneDrive is leaking.” Forwarding and auth already happened. This lesson is the two engines that decide what the user can do — a URL category versus a recognised cloud app — then the Web Insights columns that close the ticket.

~18 min read · L2 primary · Quiz at end

⚡ Quick Answer

ZIA URL Filtering vs Cloud App Control: pick category or app, first-match + cascading, Caution and Allow Override, then prove the hit in Web Insights Logs.

After this page you can

Quick answer (say this out loud)

URL Filtering is the default access-control space: it matches a site’s class / category (Legal Liability, Social Networking, Newly Registered Domains). Cloud App Control matches a known SaaS app and its actions — allow YouTube view, block YouTube upload. In the web module, Cloud App Control runs before URL Control. An explicit Cloud App Allow skips URL Filtering unless you enable Allow Cascading to URL Filtering. Inside each policy, rules evaluate in ascending order and stop at the first match. Caution shows an EUN then lets the user continue. Block + Allow Override carves named users/groups out of that Block. Prove it in Web Insights: URL Category, Cloud Application, Blocked Policy Name.

1. Why two engines exist

Auth told ZIA who is on the wire. Forwarding got the session to a Public Service Edge. Neither answers “can Marketing open Facebook?” or “can Engineering upload source to a personal GitHub?” Those are two different questions, so ZIA has two engines.

URL Filtering answers what kind of site is this? It uses Zscaler’s URL taxonomy — predefined classes that contain categories. You cannot add a class. You can add a custom category (URLs, IPs, keywords, IP ranges) and write a rule against it.

Cloud App Control answers which known application, and which action? That is why you can leave YouTube reachable and still stop the upload, or allow Microsoft 365 and still refuse a personal tenant. Official leading practice: use Cloud App Control for the known list; leave the unknown to URL Filtering.

Hero · two doors after the proxy
User traffic through a cloud proxy splitting to a Category door and a Cloud App door
Notice: one request, two questions. Category = what kind of site. Cloud App = which recognised SaaS and which action.
Interview line

If someone says “just block youtube.com,” answer with the engine, not the domain. A URL rule can only see a category or a custom URL. View-versus-upload is Cloud App Control, and it needs enough visibility (usually SSL inspection) to identify the application.

2. Mental model — category vs cloud app

Memorise four named objects before you open the Admin Portal. Every “why didn’t my rule fire?” ticket maps back to these.

URL class + category

Zscaler groups sites into classes (Legal Liability, Privacy Risk, Productivity Loss, and the rest). A class contains categories. Recommended baseline: Block the Legal Liability class. You cannot create a new class.

Custom URL category

Your exception list. URLs, IPs, keywords, or IP ranges. The allowlist pattern is official: put the URL in a custom category, then write an Allow rule whose order is higher (lower number) than the Block.

Cloud application

A recognised SaaS object (YouTube, GitHub, OneDrive, Salesforce). Rules live under the Cloud App category in the left menu — Social Networking, IT Services, File Sharing, System Development, Webmail, and so on.

Tenant profile

Restricts personal vs business (or named) accounts for supported apps. You create the profile, then attach it to a Cloud App Control rule. One rule can carry up to 16 tenant profiles.

Flow 1 · pick the engine first
One request · two engines · pick before you write a rule User request already authed + forwarded Known app + action needed? NO → URL Filtering Class / category / custom URL Allow · Caution · Block · Isolate Optional daily time / bandwidth quota YES → Cloud App Control App + action (view / upload / share) Optional tenant profile Evaluated before URL Control Default: a Cloud App Allow does not then hit URL Filtering Enable Allow Cascading to URL Filtering if an Allow must still be judged by a URL rule.

Read the diamond first. If you only need “this class of site is off,” stay on the left. If you need a named app or a tenant, go right.

Say this out loud

A category rule can allow, caution, or block a website. A Cloud App rule can leave the website up and still stop the risky action. First-match is inside each policy. Cascading is the switch between the two policies.

Hard words before the runbook

TermMeaning on a ticket
Class / categoryZscaler’s taxonomy. Classes are predefined. Categories live under a class. Older training may say “super-category” — the Admin UI and Help say class.
First-matchInside URL Filtering (and inside Cloud App Control), rules evaluate in ascending order. The first match applies and evaluation stops.
CautionAction that shows an End User Notification, then lets the user continue. Optional Redirect URL instead of the default EUN.
Allow OverrideOn a Block action: named users or groups may still reach that blocked content. Different from a separate Allow rule above the Block.
Identity-based Block OverrideAdvanced Policy Setting. An authorised user re-authenticates (SAML force-reauth) to temporarily pass a Block. Off by default; hosted-DB override applies if you leave it off.
Allow Cascading to URL FilteringAdvanced Settings. If on, a Cloud App Allow is still judged by URL Filtering. A Cloud App Block still wins even when cascading is on.
Daily Time QuotaOn an Allow: 15–600 minutes per day on the matched categories. Idle time is ignored. Known location resets at midnight in the location TZ; roaming uses the org TZ.
Tenant profileRestricts personal vs business (or listed) accounts on supported cloud apps. Attach it to the Cloud App rule — do not try to do this with a custom URL list.
Blocked Policy NameWeb Insights column: the policy that took the action. Pair it with URL Category and Cloud Application.

3. Policy order — CAC, then URL, first-match

Do not start the whiteboard with menus. Start with the request. The Public Service Edge web module applies policies in a documented order. Cloud App Control sits above URL Control. If a web policy already violates, later engines in that chain are not applied.

Path · request → cloud app → category → action
Four-step journey: Request, Cloud App, URL Category, Action
Notice: Cloud App is the second panel, URL Category the third. That is the web-module order, not the order of your ticket queue.
Flow 2 · evaluation (flowchart first)
Web module (after Firewall + SSL + ATP + AV) · first violation stops 1 · Request 2 · Cloud App first-match in CAC 3 · URL Control only if still in play 4 · File Type · DLP · Sandbox later web engines CAC match? known app CAC Block STOP · URL never runs CAC Allow cascade on? Cascade OFF skip URL Filtering URL first-match Order 1, 2, 3… then stop Allow / quota Caution · EUN then go Block · or Isolate URL rule order pattern (inside URL Filtering only) 1–n Allow exceptions (custom category / VIP / partner) → group or time Blocks → Caution on grey classes → Block Legal Liability / Security Risk → default Allow at the bottom An Allow at Order 60 never saves you from a Block at Order 50 that already matched.

Two first-matches, not one. Cloud App Control can finish the story before URL Filtering starts. Cascading is the only way an Allow on the right still walks the URL list.

Decision · Path A vs Path B
Diamond decision node splitting into Path A and Path B
Path A = URL category (site class). Path B = Cloud App (named SaaS + action). Caption in this lesson is the truth; the image is the feel.
Classic miss

You Allow Facebook in Cloud App Control and Block Social Networking in URL Filtering. Users still reach Facebook. That is documented default behaviour, not a bug: the Cloud App Allow never cascaded. Turn on Allow Cascading to URL Filtering, or do not write a CAC Allow you do not mean.

4. How to choose — action + engine

Pick the engine first, then the action. Mixing them is how you get a 40-rule tenant that nobody can debug.

You needEngineActionWhy
Adult / gambling / illegal off for everyoneURL FilteringBlock the Legal Liability classOfficial recommended URL policy starts here.
Grey-area sites (Newly Registered Domains)URL FilteringCautionEUN lets a real user click through; a phish victim usually pauses. Isolate is heavier.
One VIP or partner URL that sits in a blocked categoryURL FilteringCustom category + Allow above the BlockOfficial allowlist pattern. Do not put the Allow below the Block.
Help-desk carve-out on an existing BlockURL FilteringBlock + Allow Override (users/groups)Same rule, named exceptions. Different from a new Allow rule.
Teacher temporarily unlocks a Block for a classAdvanced Policy Settings + BlockIdentity-based Block OverrideSAML force-reauth. IdP must support it (Okta: do not disable Force Authentication).
Watch YouTube, no uploadCloud App ControlAllow view / block upload on YouTubeURL Filtering cannot split actions on one hostname.
GitHub browse, no pushCloud App ControlSystem Development category ruleOfficial example in the Policy Leading Practices guide.
Corporate M365 only — no personal OneDriveCloud App Control + Tenant ProfileRestrict to the corporate tenantA custom URL list cannot tell tenants apart.
Streaming allowed, but not all dayURL Filtering AllowDaily Time Quota 15–600 minQuota is per rule, per user. Categories in the same rule share the pool.
Quota numbers (official)

Daily Time Quota: minimum 15 minutes, maximum 600. Daily Bandwidth Quota: 10–100,000 MB. Use Surrogate IP so the quota binds to a user, not a shared egress IP. For mixed groups, put a catch-all “any user” quota only for unidentified users — do not use “any” to mean “everyone else.”

5. Runbook Side A → B → C

Lab tenant. One Marketing user, one Engineering user, one executive. You will ship a URL baseline, one Cloud App action rule, then prove both in Web Insights. Source for each side is named under the mock.

Side A — URL Filtering baseline

  1. Open the policy

    Policies → Access Control → Internet & SaaS → URL Filtering → Create (or Duplicate an existing rule). Older tenants may still show Policy → URL & Cloud App Control. Trust the current Help path.

  2. Allow exceptions first

    Create a custom URL category (Administration → URL Categories) for partner / VIP hosts. Enter URLs in lowercase ASCII. Write rule order 10, action Allow, criteria = that custom category. This is the official allowlist: the Allow must sit above any Block that would otherwise match.

  3. Block Legal Liability

    Rule order 50, action Block, URL Categories = all categories in the Legal Liability class. That is the recommended starting policy, not a Techclick invention.

  4. Caution the grey class

    Rule order 40 (above the universal Block, below exceptions): action Caution on Newly Registered Domains (or whatever grey class your org accepted). Leave the default EUN unless you have a hosted Redirect URL.

  5. Group / time / quota last among the business rules

    Example: Marketing, Social Networking, Mon–Fri 09:00–18:00, action Block. Or Engineering Streaming Media, action Allow, Daily Time Quota 30 minutes. Do not put a broad Block above a later Allow for the same category.

admin.zscaler.net · Policies → Access Control → Internet & SaaS → URL Filtering → Create
Training mock · not live

Policies / Access Control / Internet & SaaS / URL Filtering / Add URL Filtering Rule

Add URL Filtering Rule

40
7
Caution-NRD-All
Enabled
Newly Registered Domains
Any
Caution
Default EUN · no Redirect URL

Source: Zscaler Help — Configuring the URL Filtering Policy (Policies → Access Control → Internet & SaaS → URL Filtering). Caution displays an EUN, then allows the site. Activate after Save.

Side B — Cloud App Control + tenant

  1. Open the app category, not a generic “add rule”

    Policies → Access Control → Internet & SaaS → Cloud App Control. Left menu: pick the Cloud App category (Social Networking, System Development, File Sharing, IT Services…). Then Add Rule. GitHub view-not-upload lives under System Development. YouTube actions live under the Social / streaming app category your tenant shows.

  2. Write the action, not the domain

    Select the application (YouTube, GitHub). Set the action the product exposes for that app — typically Allow / Block / Isolate, plus per-activity controls where the app supports them (view vs upload). Scope users or groups. Save. This is the official “known list” pattern from the Policy Leading Practices guide.

  3. Tenant profile for Microsoft 365 / Google

    Create the Tenant Profile first (restrict personal, allow listed business tenant IDs). Then attach it to the Cloud App Control rule. Official limit: up to 16 tenant profiles on one rule. Test one user before you Activate for the org — a wrong tenant ID locks everyone out of M365.

  4. Decide cascading on purpose

    Policies → Common Configuration → Advanced → Advanced Settings (some tenants still show Administration → Advanced Settings). Allow Cascading to URL Filtering: enable only if a Cloud App Allow must still be judged by URL Filtering. Leave it off if Cloud App is the source of truth for that app. A Cloud App Block still wins either way.

admin.zscaler.net · Policies → Access Control → Internet & SaaS → Cloud App Control → System Development
Training mock · not live

Policies / Access Control / Internet & SaaS / Cloud App Control / System Development / Add Rule

Add Cloud App Control Rule

20
Eng-GitHub-View-NoUpload
GitHub
Group · Engineering
Allow view · Block upload
None on this rule · attach on M365 / Google rules
Advanced Settings · Allow Cascading to URL Filtering = Off

Source: Zscaler Help — Adding rules to Cloud App Control (Policies → Access Control → Internet & SaaS → Cloud App Control → category → Add Rule) and ZIA Policy Leading Practices (GitHub view, block upload). Training values only.

Side C — prove it in Web Insights

  1. Activate, then generate one transaction

    Save is not live. Activate. From the pilot user, hit (a) a Legal Liability site you expect to Block, (b) an NRD you expect to Caution, (c) GitHub view vs a test upload, (d) personal vs corporate Microsoft sign-in if you attached a tenant profile.

  2. Open the log, not the policy editor

    Analytics → Insights Logs → Web (label in Help: Web Insights Logs). Filter user + time + URL or Cloud Application. Do not disable rules one-by-one.

  3. Read three columns

    URL Category — which class/category Zscaler assigned. Cloud Application (and Cloud Application Class) — whether the session was a recognised app. Blocked Policy Name — which policy took the action. NSS web feeds also expose Cloud Application Policy Name. If those three are empty or “none,” you are looking at the wrong transaction or SSL inspection never identified the app.

  4. Close the ticket with the name, not a screenshot of the site

    Green success: the log row shows the rule name you wrote, the expected category or cloud app, and the action (block / caution / allow). If the CEO is still blocked, the Blocked Policy Name is almost always the broader rule above your Allow — not “Zscaler is broken.”

admin.zscaler.net · Analytics → Insights Logs → Web
Training mock · not live

Analytics / Insights Logs / Web

Web Insights Logs

alex@lab.example
Last 15 minutes
Newly Registered Domains
GitHub
Caution-NRD-All · (caution row) / Eng-GitHub-View-NoUpload · (upload block)

Source: Zscaler Help — About Insights Logs and Web Insights Logs: Columns (URL Category, Cloud Application, Cloud Application Class, Blocked Policy Name). Lab identities only.

Green success on the pilot

Three rows, three names. Caution row: action caution, policy Caution-NRD-All, category Newly Registered Domains. GitHub view: Cloud Application = GitHub, not blocked. GitHub upload: Blocked Policy Name = Eng-GitHub-View-NoUpload. If you only see the URL category and no cloud application, SSL inspection (or an M365 One Click bypass) never gave the engine the app identity.

6. Runtime path after Activate

Once Side A/B/C is live, the path is short. Use it as the first five minutes of every “policy didn’t fire” Sev-2.

  1. Is the user authenticated and forwarded? Unknown user + no Surrogate IP means group criteria and quotas will not bind. That is an auth/forwarding ticket, not this lesson.
  2. Did Cloud App Control already decide? If the log shows a Cloud Application and a Cloud App policy name, stop reading URL rules until you know whether cascading is on.
  3. If you are in URL Filtering, walk order from the top. The first matching rule wins. Your Allow at 60 is dead if a Block at 50 already matched that user + category.
  4. What can the engine see? Without SSL inspection, later policy is often limited to the domain / SNI. CDN hosts (video, static) will not look like the front-page hostname.
  5. Write the three columns in the ticket. URL Category, Cloud Application, Blocked Policy Name. Then change one rule. Then Activate again.

7. Traps + Web Insights proof

Proof · Insights is the cockpit
Operations desk with a monitor showing abstract green verification checks
Notice: the proof is a named policy in a log row, not a screenshot of the blocked web page.
SymptomLikely causeFirst check
CEO still blocked after you added an AllowAllow sits below a broader Block (first-match)Web Insights → Blocked Policy Name. Move the Allow above the Block, or use Allow Override on the Block.
URL Block of Social never hits FacebookCloud App Allow, cascading offAdvanced Settings → Allow Cascading to URL Filtering, or remove the CAC Allow.
YouTube “blocked” but video still playsURL rule on youtube.com only; video on a CDN; or no SSL inspection so Cloud App never identified the appLog: Cloud Application empty? Enable inspection / write a Cloud App rule for YouTube, not a single hostname.
Personal OneDrive still worksNo tenant profile on the M365 / File Sharing Cloud App ruleTenant Profiles attached? SSL inspection not bypassed by Microsoft One Click “Bypass Other Policies”?
Custom list hit verybadreddit.comSuffix wildcard *reddit.com (no dot)Use a dotted subdomain form (*.reddit.com) and re-test. URLs in lowercase ASCII only.
Quota burned after 15 min YouTube + 15 min NetflixBoth categories in one Allow-with-quota ruleQuota is per user per rule. Split categories if you want two pools.
M365 One Click allow ignores your URL BlockPredefined Cloud App allows; cascading does not apply to those One Click rulesWrite a higher-rank Cloud App rule of your own, or change Evaluate / Bypass Other Policies on the SSL exemption.
Pilot checklist

Knowledge check

Six judgment items. Map each one back to a promise bullet. Check answers, then Reset if you missed the order or the Insights columns.

Q1

You Block Streaming Media at Order 50 for Any user. You Allow Streaming Media for the CEO group at Order 60. The CEO is still blocked. What is the first fix?

Correct: b. URL Filtering is first-match, ascending order. Order 50 already matched the CEO. Cascading is a Cloud App → URL switch, not an intra-URL override. Re-read §3 and Side A.
Q2

Engineering must watch YouTube training videos but must not upload. Which control is the right engine?

Correct: c. URL Filtering matches a category or URL, not view-versus-upload. Official leading practice: Cloud App Control when you must control aspects of a known app. Re-read §2 and Side B.
Q3

Cloud App Control Allows Facebook. URL Filtering Blocks Social Networking. Allow Cascading to URL Filtering is off. What happens?

Correct: a. Default: Cloud App Control takes precedence. An explicit Allow skips URL Filtering unless cascading is enabled. A Cloud App Block would still win even with cascading on. Re-read §3.
Q4

Newly Registered Domains hosts both phishing and brand-new SaaS your teams need. What is the production first action?

Correct: b. Caution is the documented grey-area action: EUN, then continue. Allow Override is for named users on a Block, not for a whole class. NRD is a URL category, not a cloud app. Re-read §4 and Side A.
Q5

A user says “I’m blocked from a site I should have.” Which Web Insights set actually proves which engine fired?

Correct: c. Official Web Insights columns. Firewall Insights can still say Allowed if the firewall module passed the session and a later web policy blocked it. Re-read Side C and §7.
Q6

An employee opens portal.office.com on a corporate laptop and signs into a personal Microsoft account. Data lands in personal OneDrive. What is the ZIA control?

Correct: b. Tenant restriction is a Cloud App + Tenant Profile problem. Blocking the hostname also kills the corporate tenant. Quota and Caution do not distinguish tenants. Re-read §2 and Side B.

Sources

Related: Lesson 4 · Authentication & deployment · Zscaler authentication · Lesson 6 · SSL Inspection & file type · Lesson 7 · Threat protection · Lesson 3 · Traffic forwarding