Zscaler Client Connector Portal: Device Posture, App/Forwarding Bypass & Update Policy

Six words to lock before we start

These six terms carry the whole lesson. Tap each card, say the meaning out loud, then read on. The retrieval is the point.

Why this matters — the guard, the VIP lane, and the family phones

Picture a metro-station gate. The scanner checks your bag — is the laptop encrypted, is AV running, is it domain-joined? But the scan alone never stops anyone. Only the guard at the boarding gate, who looks at your pass and decides, actually blocks you. A Device Posture profile with no access policy referencing it is exactly a scanner with nobody at the gate. Everyone walks through.

Now picture a toll plaza. A normal car passes the booth where the camera and officer can see it — that's traffic going through Zscaler: inspected and logged. A tunnel bypass is the unmanned side gate. The car never passes the booth, so there's no record it came through at all. Open that gate too wide and anything slips by unseen.

And the family phones. "Auto-update everything tonight" sometimes ships a buggy build and every phone breaks at once — that's Mass Rollout on Latest. The careful person updates their own phone first, confirms it works, then updates Mummy-Papa's — and on a critical phone they stay on the version they know works. That is a Phased Rollout plus a pinned version. Three controls, three everyday instincts.

① Device Posture profiles

You build posture in the Client Connector Portal (the admin UI at mobile.zscaler.net, once called the Mobile Admin Portal). Go to Administration → Device Posture and click Add Device Posture. Each profile is a single check with a posture type from a drop-down.

The real type options include OS Version, Full Disk Encryption (it detects BitLocker on Windows / FileVault on macOS), Antivirus, Firewall, AD/Azure-AD Domain Joined, Client Certificate, File Path, Registry Key, a Process check, plus EDR detections — Detect CrowdStrike, Detect Carbon Black, Detect SentinelOne, Detect Defender — and CrowdStrike ZTA score gates. For Antivirus you fill an AV Name field and can tick Check if AV Definitions Are Up-to-Date. Every type has a Frequency (In Minutes) setting — how often ZCC re-evaluates (minimum 2, default ceiling 15).

Here is the part that trips up every new admin: a posture profile by itself does nothing. ZCC computes pass/fail and sends only that boolean up. Access is gated only when an access policy references the profile. In ZPA you go to Policy → Access Policies, edit a rule, and under Conditions add a Client Connector Posture Profile condition set; the operator is VERIFIED or VERIFICATION FAILED. Profiles in one set default to OR (click the operator to switch to AND); separate sets are AND-joined, max 10 sets per rule. ZIA consumes the same posture inside URL Filtering / Firewall / SSL rules.

② App & Forwarding Bypass

There are several different bypass surfaces, and mixing them up is the number-one student mistake. The Forwarding Profile (Administration → Forwarding Profile) decides if traffic enters the tunnel at all — modes like Tunnel (Z-Tunnel 1.0 / 2.0), Tunnel With Local Proxy, Enforce Proxy or None, per network state (On/Off Trusted Network, VPN Trusted Network). It also holds the VPN Gateway Bypass field. The App Profile decides where in the tunnel, via Destination Exclusions and Destination Inclusion (port-based syntax like 192.168.1.0/24:80). And Application Bypass (Z-Tunnel 2.0 only, Windows/macOS) adds IP-Based or Process-Based applications. None of these is the same as an SSL-inspection bypass, which lives in ZIA and only skips decryption — the traffic stays inspected and logged.

③ Update & Version policy

ZCC version control lives in the App Store. Open the Update Settings tab and click Add App Store Group Policy. You set a per-OS Version to Install for Windows, macOS and Linux, each accepting Disable (no auto-update), Latest (auto-update to newest) or a specific version. You target it with a User Groups drop-down, and choose a rollout style: Mass Rollout (all groups at once) or Phased Rollout (gradual, lets you test a build before deploying to everyone — you can pause and modify version or schedule mid-rollout).

④ Putting it together: trust + exceptions + lifecycle

These three controls are one operating model. Trust (posture) decides which devices are healthy. Exceptions (bypass) decide what is allowed to skip inspection — and how blind that makes you. Lifecycle (updates) decides which ZCC build runs the other two. A weak link anywhere undoes the rest: perfect posture means nothing if the access policy never references it; tight policy means nothing if a wide tunnel bypass routes traffic around it; and a great config means nothing if an auto-pushed build breaks the agent that enforces it.

Synacktiv's August 2025 research sharpens this: posture is computed client-side (in config.dat and ZSATrayManager.exe). The endpoint reports a boolean it computed itself. That is convenient, but it means your real strength is the server-side access policy — never treat client-side posture as a standalone control. Document every bypass (why, what destination, who approved), test exceptions in a controlled environment first, and keep DNS monitored even when you bypass traffic.

Verify from the agent, not the screen

The config screen tells you what you intended. The agent tells you what is true. Use ZSACLI / ZSATray diagnostics on the endpoint to confirm posture, tunnel mode and version. One verified fact: ZCC packet capture cannot be triggered from ZSACLI — use the ZSATray Export logs / packet-capture UI for that. Never claim ZSACLI starts a pcap.

ZSACLI.exe -version
ZSACLI.exe -posture
ZSACLI.exe -mode

Zscaler Client Connector version: 4.7.0.141
Posture: Corp-Win-Encrypted-EDR  => VERIFIED
Posture: Domain-Joined           => VERIFICATION FAILED
Forwarding mode: Tunnel (Z-Tunnel 2.0)  state=On Trusted Network

tail -f /Applications/Zscaler/.logs/ZSATunnel.log
log show --predicate 'process == "Zscaler"' --last 5m

[posture] profile=Corp-Mac-FileVault result=PASS freq=15m
[tunnel]  ZT2 established to gw 165.225.x.x  state=trusted
[update]  current=4.8.0.115 policy=Phased pinned=true