SaaS

Zscaler

Connect Zscaler to Ploy to see every user in your ZIdentity directory, which ZIdentity groups they belong to, and who administers Zscaler Internet Access and Zscaler Private Access. Ploy can also create, disable, re-enable and delete ZIdentity users, set temporary passwords, and add people to or remove them from groups.

The Zscaler integration is in beta. The first step of setup asks you to agree to Ploy collecting redacted error data from Zscaler's API: when a call to Zscaler fails, Ploy keeps the error Zscaler returned, with names, emails and other personal details removed, so we can fix problems quickly.

What Ploy reads

  • ZIdentity users: everyone in your ZIdentity directory, and whether each person is active or disabled.

  • ZIdentity groups: every group, including dynamic groups, and who belongs to each.

  • Zscaler Internet Access admins (optional): each ZIA admin and auditor, their admin role and their admin scope.

  • Zscaler Private Access admins (optional): each ZPA administrator, their role and whether they have two-factor authentication turned on.

Zscaler does not report when someone last signed in, so Ploy cannot show last activity for Zscaler.

What Ploy can change

  • Create, disable, re-enable and delete ZIdentity users.

  • Set a temporary password that the person must change at their next sign-in.

  • Add people to and remove them from ZIdentity groups. Dynamic groups are set by rules in ZIdentity and cannot be changed by hand.

Ploy does not change admin roles in Internet Access or Private Access. Manage them in each product's admin console.

Before you start

You need:

  • A Zscaler tenant that uses ZIdentity, Zscaler's sign-in service at yourcompany.zslogin.net.

  • A ZIdentity admin who can create API clients.

Step 1: Create an API client in ZIdentity

  1. Sign in to ZIdentity and go to Administration, then API Configuration, OneAPI, API Clients.

  2. Click Add API Client and choose Client Secret as the authentication method.

  3. Under Resources, add ZIdentity with a role that can read and manage users and groups.

  4. If you want Ploy to read ZIA admins, also add Internet Access with a role that can read admins.

  5. If you want Ploy to read ZPA administrators, also add Private Access.

  6. Save the client and copy the Client ID and Client Secret. The secret is only shown once.

If you use Private Access, also copy your Private Access customer ID. It is shown on the Private Access resource under API Resources.

Step 2: Connect Zscaler in Ploy

  1. In Ploy, go to Integrations and choose Zscaler.

  2. Tick the beta consent box.

  3. Enter your vanity domain: the first part of your ZIdentity sign-in address. If you sign in at acme.zslogin.net, enter acme.

  4. Enter the Client ID and Client Secret.

  5. Tick Read Zscaler Internet Access admins if you added the Internet Access resource.

  6. Enter your Private Access customer ID if you use Private Access. Otherwise leave it blank.

  7. Click Test connection. Ploy checks each product you turned on and tells you which resource is missing if one is.

Limits

  • Ploy supports Zscaler's OneAPI only. Legacy per-product API keys, and the zscalergov and zscalerten clouds, are not supported.

  • ZIA and ZPA admins appear as separate accounts from ZIdentity users, linked to the person by email.

  • Zscaler records no date for when someone joined a group.

Was this helpful?
Was this helpful?