# ZPA access policy — no match means deny Source: https://ai.techclick.in/blog_zscaler_zpa_access_policy Markdown: https://ai.techclick.in/blog_zscaler_zpa_access_policy.md Publisher: Techclick Infosec Pvt Ltd Default deny, SAML/SCIM, posture, timeout 7 days, Empty Connector. Scored quiz. ## The ticket Priya and Aditya are in the same Entra group. SAP opens for Priya. TMS is denied for Aditya. That is almost never “ZCC is broken.” It is Access Policy: TMS Segment Group has no Allow that includes Aditya (or posture/timeout killed it). Hero · allow or deny gate ZPA default is deny. No matching rule means close. There is no silent permit. Quick answer Write explicit Allow rules on Segment Groups. Criteria: SAML/SCIM groups, posture, trusted network, client type. No match = deny. Empty Connector usually means this rule never made the user eligible. ## Mental model — default deny - Who — IdP group / SCIM attributes / machine group. - What — Segment Group (OR if several are listed). - Where / how — posture, trusted network, client type, country. Flow 1 · access decision Flow 1 · access decision - User + ZCC SAML attributes Access Policy first matching allow? Connector pick mapped group App port or deny / empty If nothing allows, ZPA blocks. You will not find the answer in URL Filtering. Source: Configuring Access Policies. Say this out loud Default deny. Allow is explicit. Empty Connector is eligibility. Timeout is not Access Policy but it will feel like a deny after seven days. Hard words: Default deny means unused apps stay private. Timeout Policy forces re-auth (default 7 days). Posture profile is a Client Connector check (disk encrypt, OS) that can fail an otherwise valid Allow. ## How to write the rule Journey · Identity → Posture → Match → Allow One rule per app class (finance, contractors, break-glass). Do not one mega-allow for every segment. Pattern Use when Trap Allow IdP group → Segment Group Normal staff apps SCIM not updated, group empty Allow + posture Privileged / finance Posture missing on BYOD → surprise deny Allow + trusted network App only from office Bad Trusted Network criteria flipping roamers to deny Shorter timeout on critical apps Privileged remote access Leaving 7-day default on crown jewels Source: Configuring Access Policies and About Access Policy . Decision · allow or default deny Decision · allow or default deny Rule match? Allow Deny No matching Access Policy is deny. ZPA will not fall through to ZIA. ## Runbook — Side A / B / C ### Side A · identity #### SCIM group Aditya must be in the IdP group the rule uses. If SCIM is stale, the rule never matches. Check the IdP, not the connector ping. - #### Posture If the rule requires disk encryption, a lab VM without BitLocker will deny even with the right group. ### Side B · ZPA Access Policy - #### Add Allow Policy → Access Policy → Add. Action Allow. Segment Groups = sg-finance-apps . SAML/SCIM = grp-finance . Save. Remember: multiple segment groups on one rule are OR. - #### Timeout Policy → Timeout Policy. Default 7 days. Tighten critical apps (1 hour / 1 day) per leading practices. admin.zscaler.net · Policy → Access Policy → Add Rule Training mock · not live Policy / Access Policy / Add Access Policy Rule ### Add Access Policy Rule Rule Name Allow-Finance-TMS Action Allow Segment Groups sg-finance-apps SAML / SCIM Groups grp-finance Cancel Save Default is block until an explicit allow exists. Training mock · not live. Source: Configuring Access Policies. ### Side C · prove - #### Diagnostics User Activity for Aditya + tms FQDN. You want policy name Allow-Finance-TMS and a Connector. Empty Connector / no-policy codes mean this rule did not hit. - #### Compare Priya If Priya hits a different rule (SAP segment group), copy that structure for TMS. Do not clone SAP ports onto TMS. ## Runtime path after go-live Ops · allow vs deny board Quote the rule name in the ticket. ‘ZPA is down’ is not a root cause. Request → match Access Policy (and timeout still valid) → pick connector from mapped group → open port. Official deny is a closed session, not a ZIA EUN page. ## Traps and proof Symptom First check Do not Same AD group, one app denied Which Segment Group / which Access rule Reinstall ZCC Works in office, dies at home Trusted Network criteria on the rule Disable ZPA Worked yesterday, denied today Timeout Policy / posture flipped New connector VM first Empty Connector Allow rule + mapping Ping the app Pilot checklist - Aditya Diagnostics: Allow-Finance-TMS + named Connector. - A user outside grp-finance is denied (default deny still true). - Timeout on SAP is documented (7 days or tighter). Unsafe path One Allow-Any for all segment groups so ‘tickets stop’. You just rebuilt a VPN. ← App Connector · Troubleshooting desk → ## Knowledge check Six policy tickets. Pick the first safe move. Q1 A user matches no Access Policy rule. Result? Silent allow Deny — ZPA blocks until an explicit allow exists Falls through to ZIA URL filtering Asks the connector to decide Correct: b . Configuring Access Policies: ZPA blocks until you explicitly allow. Q2 Empty Connector + close is usually… No matching allow, or mapping never selected a connector SAP down Inspect CA GRE MTU Correct: a . Policy/mapping first. App ping later. Q3 Three segment groups on one rule are evaluated as… AND of all three Only the first OR — any of those segment groups Random Correct: c . About Access Policy example: segment group criteria are OR’d. Q4 Default Timeout Policy in leading practices? Re-auth every 30 seconds Never re-auth Only on GRE All users re-authenticate every 7 days unless you tighten critical apps Correct: d . ZPA Leading Practices: default timeout 7 days; shorten for critical apps. Q5 Posture / Trusted Network on the rule is for… Decoration SSL inspect Restricting allow to healthy devices or corp network DLP engines Correct: c . About Access Policy: posture, trusted networks, SAML/SCIM, client types. Q6 Same AD group, one app works, one denied. First? Which Access Policy rule hits each Segment Group — missing allow vs timeout vs posture Disable ZPA New inspect CA Rebuild GRE Correct: a . Policy is per segment group, not per AD group globally. Check answers Reset ## Sources - Configuring Access Policies - About Access Policy - ZPA Leading Practices Guide - Access Policy Deployment and Operations Guide Related: App Connector · App segments · Troubleshooting desk --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt