Zscaler Private Access (ZPA)

Import your Zscaler Private Access app segments, browser access apps, servers, App Connectors, and sign-in domains into Guard.

The Zscaler Private Access (ZPA) integration imports the applications and infrastructure you publish through ZPA into the Praetorian Guard Platform (PGP). Guard reads your application segments, application servers, App Connectors, and authentication domains through Zscaler OneAPI and adds the domains, IP addresses, ports, and web applications they describe as assets. This guide walks you through creating a OneAPI client and connecting it to Guard.

What the integration does

Each time the integration runs, Guard signs in to Zscaler OneAPI and reads:

Application segments: the domain names, IP addresses, and IP ranges of each enabled segment. Disabled segments and wildcard entries, such as *.example.com, are skipped. Guard does not import the port ranges configured on a segment.
Browser access applications in enabled segments: each application's domain (or its CNAME when there is no domain) and its external domain. Guard adds the default port for the application's protocol, for example 443 for HTTPS, 22 for SSH, or 3389 for RDP. Guard uses the protocol's default port, not the port configured on the application. For HTTP and HTTPS applications, Guard also adds a web application, such as https://app.example.com.
Application servers: the address and name of each enabled server, recorded together on one asset when one is a hostname and the other an IP address. Otherwise Guard adds the address, or the name if the address is not a domain or IP address. Disabled servers are skipped.
App Connectors: each connector's public and private IP addresses and the IP addresses and ranges in its IP ACL.
Authentication domains: the domains your users sign in with.

Guard also drops assets it should not scan:

Loopback, link-local, multicast, and unspecified addresses.
IP addresses in public cloud provider ranges, and domains that resolve to a public cloud provider.
Private IP addresses, such as 10.0.0.0/8 or 192.168.0.0/16, and domains that do not resolve in public DNS.
Any single IP address, public or private, that does not answer a single ping within half a second. IP ranges are not pinged.

ZPA segment domains, servers, and connector addresses are often internal, so this filter drops them by default. To import private and non-responding assets, contact Praetorian support.

The integration only reads from Zscaler. It does not change segments, policies, or settings.

Prerequisites

A ZPA tenant that signs in through Zidentity. Guard connects through Zscaler OneAPI, which requires Zidentity. Legacy ZPA API keys are not supported.
A Zidentity administrator account that can create API clients.
The Zidentity vanity domain for your tenant: the acme part of acme.zslogin.net.
Your ZPA customer ID.
Permission to add integrations in Guard.

Step 1: Create a OneAPI client in Zidentity

In the Zidentity admin portal, create an API client.
On the client's Resources tab, assign a read-only ZPA API role.
Save the client, then copy the Client ID and Client Secret and store them safely.
In the ZPA admin portal, go to Configuration & Control → Public API and copy your Customer ID.

One API client can serve several Zscaler products. To also import ZIA, EASM, or ZDX data through the same integration, assign an API role for each of those products too.

Step 2: Connect Zscaler in Guard

In Guard, go to Integrations and open Cyber Asset Attack Surface Management → Zscaler.
Enter:
- Client ID: the OneAPI client ID from step 1.
- Client Secret: the OneAPI client secret from step 1.
- Vanity Domain: your Zidentity hostname prefix, for example acme. You can also enter the full host, acme.zslogin.net.
- Customer ID: your ZPA customer ID from step 1.
Select ZPA (Private Access). It is not selected by default. EASM, ZIA, and ZDX are selected by default. Clear any product your API client has no role for.
Click Connect.

Before saving, Guard requests an access token from Zidentity and reads one application segment from ZPA. Guard checks every product you selected, and stops at the first one that fails, shows the error, and does not save the integration. Guard repeats these checks at the start of every run, so if the client later loses access to one selected product, no product imports until you restore the access or clear that product.

You can add more than one Zscaler integration, for example one per tenant.

Verify the integration

After the first run, go to Assets and search for the domain of an enabled application segment that resolves in public DNS. It should appear as an asset. For a browser access application that uses HTTPS, the web application should also appear.

Troubleshooting

Message	What to do
Missing Module Selection	Select at least one Zscaler product.
Missing Required Field for `customer_id`	Enter your ZPA customer ID from Configuration & Control → Public API.
Invalid Format: vanity_domain must be a hostname prefix (acme) or a Zidentity host (acme.zslogin.net)	Enter only the prefix, such as `acme`, or the host `acme.zslogin.net`.
Connection Failed: Could not reach the Zscaler API	Guard could not connect to Zidentity. Check the vanity domain, and try again in case of a network problem.
Validation Failed: Zscaler returned HTTP 400 or 404 during validation	Check the vanity domain, client ID, and client secret.
Authentication Failed	Check the client ID, client secret, and vanity domain. If Zidentity issued a token but OneAPI rejected it, confirm your tenant uses Zidentity and OneAPI.
Insufficient Permissions: authenticated but cannot read ZPA inventory	Assign a ZPA API role to the API client in Zidentity, and check the customer ID.
License Required: the Zscaler ZPA module is not licensed or unavailable	Check the customer ID. If it is correct, your tenant does not have ZPA. Clear ZPA (Private Access).
An error names a different product, such as EASM or ZDX	That product is selected but your client cannot read it. Clear it, or assign its API role.
Segments, servers, or connectors are missing from Assets	Their domains may not resolve in public DNS, or their addresses may be private. See What the integration does.

If you need help with this integration, contact support@praetorian.com.