The following changes are introduced in the ZIA Admin Portal to support firewall rules for all remote users:

• A new option, Enable Firewall for Z-Tunnel 1.0 and PAC Road Warriors, is added to the Administration > Advanced Settings page. Enabling this option automatically enables Source IP Anchoring support for Z-Tunnel 1.0 traffic. This option is enabled by default for new organizations, but disabled for existing ones.

See image.

• A new option, Road Warrior, is added under the Location criterion in the firewall and forwarding policy, exclusively for remote user traffic (i.e., Z-Tunnel 1.0, Z-Tunnel 2.0, and PAC).

See image.

To learn more, see About Advanced Settings.

The following enhancements are available for SaaS Security API.

Updates to SaaS Application Tenants

You can add Webex Teams as a SaaS Application Tenant.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to SaaS Security API Control Policies & Scan Configuration

You can configure the SaaS Security API Control policies and scan schedules for Webex Teams, a collaboration application.

To learn more, see Configuring the SaaS Security API Control Policy.

Updates to the SaaS Assets Summary Report

You can view Webex Teams (collaboration application category) in the SaaS Assets Summary Report.

To learn more, see SaaS Assets Summary Report.

Updates to the SaaS Assets Report

You can view Webex Teams (collaboration application category) in the SaaS Assets Report.

To learn more, see Saas Assets Report and SaaS Assets Report: Assets with Incidents.

Updates to SaaS Security Insights & Insights Logs

You can view Webex Teams (collaboration application category) in SaaS Security Insights and Insights Logs.

To learn more, see SaaS Security Insights and SaaS Security Insights Logs.

The following enhancements are available for SaaS Security Posture Control.

Updates to SaaS Application Tenants

You can add Microsoft 365 as a SaaS Application Tenant.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to the SaaS Security Posture Control Policy & Report

Microsoft 365 is an available application for the SaaS Security Posture Control policy and SaaS Security Posture Report.

To learn more, see Configuring the SaaS Security Posture Policy and SaaS Security Posture Report.

The following enhancements are now available for the Shadow IT feature:

Added Cloud Application Risk Profile

The cloud application risk profile feature within the ZIA Admin Portal (Administration > Risk Profiles) allows you to create risk profiles with cloud application attributes and associate them with the cloud app control rules. This feature provides granular cloud application attributes as criteria for the cloud app control rules.

You can select either the Cloud Applications or Cloud Application Risk Profile field in the Add Cloud App Control rule window.

See image.

To learn more, see About Cloud Application Risk Profile.

Updates to Administration

You can view and edit the sanctioned state (Sanctioned or Unsanctioned) of an application from the Cloud Application Status page (Administration > Cloud Application Status).

See image.

To learn more, see Shadow IT Report.

Updates to the SaaS Security Report

You can click the Edit Application Status button from the Analytics > SaaS Security Report > Applications > Application Information page for the application you select to view. You'll be redirected to the Edit Cloud Application window on the Cloud Application Status page, where you can edit the sanctioned state of that application.

See image.

To learn more, see About Cloud Application Status.

The Allow Consumer Access field is now added to the Add Tenant Profile page (Administration > Tenant Profiles > Add Tenant Profile) for Google App. The field allows consumers access to the domains in the tenant profile based on the selection.

See image.

To learn more, see Adding Tenant Profiles.

The following enhancements are now available for the one click feature:

New URL Super Category for SSL Inspection Policy

The Microsoft Office 365 super-category is added under the URL Categories field on the SSL Inspection Policy rule page (Policy > SSL Inspection > SSL Inspection Policy > Add SSL Inspection Rule). This super-category consists of the following categories:

• MS O365 Allow
• MS O365 Default
• MS O365 Optimize

See image.

To learn more, see About URL Categories.

Predefined Office 365 One Click Rule in the Cloud App Control Policy

A predefined Office 365 One Click rule is enabled on the Cloud App Control Policy page (Policy > URL & Cloud App Control > Cloud App Control Policy) for the following categories when you select the Enable Microsoft-Recommended One Click Office 365 Configuration on the Advanced Policy Settings tab (Policy > URL & Cloud App Control > Advanced Policy Settings):

• Collaboration & Online Meetings: The predefined rule in this category allows the traffic for the following cloud applications.
  • Yammer
  • SharePoint Online
  • Microsoft Teams
  • Microsoft Sway
• Productivity and CRM Tools: The predefined rule in this category allows the traffic for the following cloud applications.
  • Common Office 365 Applications
  • Microsoft Dynamics 365
  • Microsoft Delve
  • Microsoft Power BI
  • Microsoft Planner
• File Sharing: The predefined rule in this category allows the traffic for the OneDrive cloud application.
• Hosting Providers: The predefined rule in this category allows the traffic for the Microsoft Azure cloud application.
• IT Services: The predefined rule in this category allows the traffic for the following cloud applications.
  • Microsoft Azure AD
  • Microsoft Intune
• Webmail: The predefined rule in this category allows the traffic for the Outlook cloud application.

To learn more, see About Microsoft One Click Options.

Predefined UCaaS One Click Rule in the Cloud App Control Policy

A predefined UCaaS One Click rule is enabled on the Cloud App Control Policy page for the Collaboration & Online Meetings category when you select the UCaaS applications (Zoom, RingCentral, or LogMeIn) on the Advanced Policy Settings tab. This rule allows the traffic for the selected UCaaS applications.

To learn more, see Configuring Advanced URL Policy Settings.

A new option, Zscaler Client Connector Portal is now available in the Administration> Role Management > Add Administrator Role page under the Access Control (Web and Mobile) functional scope. Using this option, you can choose to enable or disable access to Zscaler Client Connector Portal for the admins.

See image.

See image.

You can now exempt specific cloud applications and URLs from DLP evaluation by adding them to the Cloud Apps & URL Exceptions for DLP list.

See image.

To learn more, see Exempting Cloud Apps and URLs from DLP Evaluation.

You can now create a cloud app control policy rule with the new Action option, Isolate. If your organization uses Cloud Browser Isolation, you will see this new option in addition to the existing Actions of Allow and Block. When the Isolate action is selected, the policy framework allows you to select one of the isolation profiles created for your organization in the Cloud Browser Isolation Portal. Any traffic matching the defined rule will be isolated as per the selected isolation profile.

The Isolate action is not applicable for the DNS Over HTTPS Services Rule for Cloud App Control.

See image

.

To use this action, you must first create isolation profiles for your organization in the Zscaler Cloud Browser Isolation Portal.

To learn more, see Adding Rules to Cloud App Control Policy.

A new Device Groups page is added to the ZIA Admin Portal under Administration.

• The Devices page displays all the devices in your organization that have the Zscaler Client Connector (formerly Zscaler App or Z App) deployed.

See image.

To learn more, see About Devices.

• The Device Groups page displays a list of predefined groups that are defined based on the OS types of the devices. The devices that have the Zscaler Client Connector (formerly Zscaler App or Z App) deployed are categorized under respective groups based on their OS type.

See image.

To learn more, see About Device Groups.

See image.

See image.

See image.

The Sandbox BAUI Report now includes the following enhancements:

• An HTTPS section under Network Packets which includes new JA3 and JA3 Digest information compared to the HTTP section.

See image.

• A new MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) tile to view the MITRE ATT&CK Techniques page and see which techniques have been hit by the corresponding color-coded number.

See image.

For applicable predefined DLP dictionaries, you can now configure custom high confidence phrases. As part of this enhancement, the dictionaries will also display all of their default high confidence phrases.

See image.

To learn more, see Editing Predefined DLP Dictionaries.

The following enhancements are now available for the SaaS Security API DLP policy.

Support for Zscaler Incident Receiver & Email Notifications

The SaaS Security API DLP policy now supports the following features for all application types:

• Zscaler Incident Receiver
• Email Notification

See image.

To learn more, see About SaaS Security API DLP.

Support for Box Classification Labels

When creating SaaS Security API DLP policy rules for your Box tenants, you can now apply classification labels defined in Box.

See image.

To learn more, see Configuring the SaaS Security API DLP Policy.

You can now enable or disable the Default Admin account using the Status option.

See image.

You can also update the account's status (i.e., disabled or enabled) using Admin & Role Management endpoints within the cloud service API.

To learn more, see About Administrators and Adding ZIA Admins.

The rule labels feature within the ZIA Admin Portal allows you to create labels and associate them with policy rules. This feature enables you to logically group your organization's policies by label.

The URL Filtering Policies resources within the cloud service API have also been updated. So you can now create rule labels for URL Filtering policy rules using POST and PUT /urlFilteringRules.

See image.

To learn more, see About Rule Labels and API Reference.

The following features are now available for SaaS Security API.

If you have Microsoft OneDrive or SharePoint tenants created prior to this release, you must reauthorize them to use these features. To learn more, see About SaaS Application Tenants.

SaaS Security Activity Alerts

With SaaS Security Activity Alerts, you can now configure alerts that allow you to track specific SaaS application activities and view the users who performed those activities. When a user performs an activity that triggers an alert, the Zscaler service logs it in the SaaS Security Activities & Alerts Report.

See image.

To learn more, see About SaaS Security Activity Alerts.

SaaS Security Activities & Alerts Report

The SaaS Security Alerts & Activities Report gives you an overview of all your users’ SaaS application activities and triggered SaaS Security activity alerts. You can also view further details about each alert and activity.

See image.

To learn more, see SaaS Security Alerts & Activities Report.

New Log Type for SaaS Security Activity

A new log type has been added to NSS Feeds for SaaS Security Activity.

To learn more, see Adding NSS Feeds for SaaS Security Activity Logs.

New SaaS Security Activity Fields for NSS Feed Outputs

The following web log fields were added to NSS Feeds for SaaS Security Activity:

• %d{intlogtime}
• %d{inteventtime}
• %d{userid}
• %d{cid}
• %d{tid}
• %d{src_id}
• %d{appid}
• %d{abstime}
• %d{objtype1}
• %d{objcnt1}
• %d{objtype2}
• %d{objcnt2}
• %s{logtime}
• %s{eventtime}
• %s{loc_name}
• %s{username}
• %s{tenant}
• %s{appname}
• %s{objnames1}
• %s{objnames2}

The following enhancements are now available for SaaS Security API.

Updates to SaaS Application Tenants

To add a Dropbox tenant, you must now enter your Dropbox Enterprise ID.

See image.

To add a Salesforce tenant, you must now choose between using your Salesforce Sandbox or Production environments. The sandbox environment allows you to test changes without affecting your users, while changes in the production environment go live for your users.

See image.

To learn more, see Add SaaS Application Tenant.

SaaS Security API Scanning Exceptions

For file sharing applications, you can now exempt specific folders from the SaaS Security API Control policy in the new Scanning Exceptions tab (Policy > SaaS Security API Control).

When you configure a scanning exception for a folder, the Zscaler service completely ignores the files within the folder, i.e., its files aren’t evaluated with the SaaS Security API DLP and Malware Detection policies.

See image.

To learn more, see Configuring SaaS Security API Scanning Exceptions.

New Column in SaaS Assets Report

A new column, Remediation Action, was added to the SaaS Assets Report: Assets with Incidents page, under File Sharing Applications.

To learn more, see SaaS Assets Report: Assets with Incidents.

You can now enforce access restrictions to the ZIA Admin Portal based on the source IP address of the admin trying to log in. 

See image.

See image.

See image.

You can now drill down the widgets on the Office 365 dashboard using the following options:

• View Logs: This shows the logs associated with the widget directly on the Insights Logs page. The logs are filtered based on the specific section of the widget that you select.
• Analyze Chart: This shows the trend charts associated with the widget directly on the Web Insights page.

See image.

To learn more, see About Dashboards.

See image.

You now can enable or disable the following types of accounts using the new Status option:

• Administrators
• Partner Administrators
• Executive Insight App Administrators
• Auditors
• Users

See image.

You can also control the account Status using Admin & Role Management endpoints within the cloud service API.

To learn more, see About Administrators, Adding Auditors, Adding Users, and API Reference.

Zscaler now supports configuring Identity Proxy for Slack cloud app from the Administration > Identity Proxy Settings page of the ZIA Admin Portal. 

See image.

To learn more, see About Identity Proxy Settings.

You can now migrate seamlessly from one SAML identity provider (IdP) to another. When you add a new IdP, the "What do you want to do?" window appears and asks if you'd like to migrate to a new IdP. You can then select the IdP and update the SAML Portal URL, IdP SAML Certificate, and Vendor.

See image.

To learn more, see Migrating to a New SAML IdP.

New SaaS Application Support

You can now configure tenants for Slack.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to SaaS Security API Policies

You can now configure the SaaS Security API Control policies and scan schedules for collaboration applications.

To learn more, see Configuring the SaaS Security API Control Policy.

Updates to the SaaS Assets Summary Report

You can now view collaboration application category in the SaaS Assets Summary Report.

To learn more, see SaaS Assets Summary Report.

Updates to the SaaS Assets Report

You can now view the collaboration application category in the SaaS Assets Report.

To learn more, see Saas Assets Report and SaaS Assets Report: Assets with Incidents.

Updates to SaaS Security Insights & Insights Logs

You can now view the collaboration application category in SaaS Security Insights and Insights Logs.

To learn more, see SaaS Security Insights and SaaS Security Insights Logs.

New Application Categories for NSS Feeds

There is a new application category in NSS feeds for SaaS Security API: SaaS Security Collaboration. These application categories provide support for Slack (Collaboration).

There is also a new tab for Collaboration in the SaaS Security Log Filters.

To learn more, see Adding NSS Feeds for SaaS Security Logs.

New SaaS Security Fields for NSS Feed Outputs

The following web log fields were added to NSS Feeds under Collaboration:

• %s{internal_recptnames}
• %s{external_recptnames}
• %s{ointernal_recptnames}
• %s{oexternal_recptnames}
• %s{sharedchannel_hostname}
• %s{osharedchannel_hostname
• %s{sender}
• %s{osender}
• %s{esender}
• %s{channel_name}
• %s{ochannel_name}

To learn more, see NSS Feed Output Format: SaaS Security Logs.

Zscaler's integration leverages Microsoft Defender for Endpoint APIs to provide endpoint detection and response (EDR) visibility for Cloud Sandbox-detected malware. Once the integration is configured, the Zscaler service calls the Microsoft Defender for Endpoint API and requests information for endpoints that have been exposed to the malicious file. Microsoft Defender for Endpoint uses the new file signature to detect compromised points throughout your organization's network.

You can view information about the affected endpoints in the Sandbox logs and reports. You can also isolate endpoints, start automated investigation and remediation (AIR), and stop malicious file executions from the ZIA Admin Portal. For further investigation and remediation, you can go to the Microsoft Defender for Endpoint portal. These automated workflows reduce the threat dwell time and remediation time.

See image.

To learn more, see About Partner Integrations.

The following enhancements are now available for SaaS Security API.

To enable Amazon S3 for your organization, contact your Zscaler Account Team.

New SaaS Application Support

You can now configure tenants for Microsoft Teams and Amazon S3.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to SaaS Security API Control Policies & Scan Configuration

You can now configure the SaaS Security API Control policies and scan schedules for public cloud storage applications. Additionally, you can configure policies and scan schedules for Microsoft Teams, a collaboration application.

To learn more, see Configuring the SaaS Security API Control Policy.

Updates to the SaaS Assets Summary Report

You can now view Microsoft Teams (collaboration application category) and Amazon S3 (public cloud storage application category) in the SaaS Assets Summary Report.

To learn more, see SaaS Assets Summary Report.

Updates to the SaaS Assets Report

You can now view Microsoft Teams (collaboration application category) and Amazon S3 (public cloud storage application category) in the SaaS Assets Report.

To learn more, see Saas Assets Report and SaaS Assets Report: Assets with Incidents.

Updates to SaaS Security Insights & Insights Logs

You can now view Microsoft Teams (collaboration application category) and Amazon S3 (public cloud storage application category) in SaaS Security Insights and Insights Logs.

To learn more, see SaaS Security Insights and SaaS Security Insights Logs.

New Application Categories for NSS Feeds

A new Public Cloud Storage application category has been added to NSS feeds for SaaS Security API. Public Cloud Storage provides support for Amazon S3.  There is also support for Microsoft Teams with the SaaS Security Collaboration application category.

To learn more, see Adding NSS Feeds for SaaS Security Logs.

New SaaS Security Fields for NSS Feed Outputs

The following web log fields were added to NSS Feeds under Public Cloud Storage:

• %d{bucketid}
• %s{bucketname}
• %s{bucketowner}
• %s{collabnames}
• %s{collabscope}
• %s{ebucketname}
• %s{ebucketowner}
• %s{ecollabname}
• %s{efilename}
• %s{efilesource}
• %s{efullurl}
• %d{ehostname}
• %s{eowner}
• %d{epochlastmodtime}
• %s{fileid}
• %s{filemd5}
• %s{filename}
• %d{filesize}
• %s{filesource}
• %s{filetypecategory}
• %s{filetypename}
• %s{fullurl}
• %s{hostname}

To learn more, see NSS Feed Output Format: SaaS Security Logs.

The following enhancements are now available for SaaS Security Posture Control.

New SaaS Application Support

You can now configure tenants for Google Workspace.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to the SaaS Security Posture Control Policy & Report

Google Workspace and GitHub are now available applications for the SaaS Security Posture Control policy and SaaS Security Posture Report.

To learn more, see Configuring the SaaS Security Posture Policy and SaaS Security Posture Report.

Zscaler now supports configuring Identity Proxy for ServiceNow cloud app from the Administration > Identity Proxy Settings page of the ZIA Admin Portal. 

See image.

To learn more, see About Identity Proxy Settings.

See image.

The following updates were made to the Backup & Restore feature: 

• You can now mark a restore point as a Golden Restore Point.
• You can now schedule the automatic creation of restore points in the new Backup Configuration tab.

See Image.

• This feature was extended to include additional configurations:
  • See the list of configurations.
    • Admin Settings
      • Administrators
      • Administrator Management Settings
      • Auditors
    • Authentication Settings
      • Authentication Bridges
      • Authentication Profile
      • Identity Providers
    • Dedicated Proxy Ports
    • Location Management
      • Locations
      • Location Groups
    • Nanolog Streaming Service
      • NSS Servers
      • NSS Feeds
    • Partner Integrations
      • Azure Virtual WAN
      • Carbon Black
      • Crowdstrike
      • Microsoft Cloud App Security 
      • SD-WAN
    • Provisioned IPs
    • Tenant Profiles
    • VPN Credentials

    Close
• You can now view all of the configuration settings along with the policies that are backed up.

See Image.

To learn more, see About Backup & Restore. 

Cloud NSS allows you to instantly stream logs from ZIA directly into a Cloud based SIEM, without the need to to deploy an NSS VM for Web or Firewall. Cloud NSS Feeds allows you to use cloud-to-cloud log streaming.

You can configure a Cloud NSS Feed that will be automatically be assigned to Cloud NSS. Also, you can use Cloud NSS Feeds to configure SIEM connectivity across cloud-based SIEMs.

See image

To learn more, see About Cloud NSS Feeds.

The following enhancements are now available for Cloud Sandbox.

Sandbox Activity Report Enhancements

You can now do the following for the Sandbox Activity Report:

• Print the report.
• Export the report as a PDF or JSON file.
• Schedule a weekly email delivery of the report to specific recipients.

See image.

To learn more, see About the Sandbox Activity Report.

Sandbox Files Found Malicious Report Enhancements

You can now do the following for the Sandbox Files Found Malicious report:

• Print the report.
• Export the report as a PDF or CSV file.
• Schedule a weekly email delivery of the report to specific recipients.

See image.

To learn more, see About the Sandbox Files Found Malicious Report.

New File Types Supported

Sandbox now supports the following file types when adding a Sandbox Policy rule:

• Visual Basic Script (.vbs)
• Windows PowerShell Script (.ps1)
• HTML Application (.hta)

To learn more, see Configuring the Sandbox Policy.

You can now choose a protocol type of UDP, TCP, or DNS over HTTPS when creating a DNS Filtering Rule. 

Logs can also now be filtered by Protocol Type in DNS Insights. Additionally, the new DNS Protocol Distribution widget in Dashboard > DNS Overview shows what protocols are in use and which rule they are associated with. 

See image.

To learn more, see Configuring the DNS Control Policy and About Dashboards.

The integration between ZIA and Cloud Browser Isolation is now enhanced for better user experience and administrative workflow. Users are no longer prompted for authentication when entering an isolation session if they have already been authenticated in ZIA or have Zscaler Client Connector running on their device. 

Admins can create a URL filtering policy rule with the new Action option, Isolate. If your organization uses Cloud Browser Isolation, you will see this new option in addition to the existing Actions of Block, Caution, and Allow. When the Isolate action is selected, the policy framework allows you to select one of the isolation profiles created for your organization in the Cloud Browser Isolation Portal. Any traffic matching the defined rule will be isolated in accordance with the selected isolation profile.

See image.

In order to use this action, you must first create isolation profiles for your organization in the Zscaler Cloud Browser Isolation Portal.

The ZIA Web Logs have been enhanced to represent the isolated traffic better without losing the context of the user's original location or IP address. 

To learn more, see Configuring ZIA for Cloud Browser Isolation. 

Added the Protocol field in the DNS Application tab (Policy > DNS Control > Add DNS Filtering Rule). You can now control the following protocol types with the DNS Control policy rules:

• DNS over HTTPS
• TCP
• UDP

See image.

To learn more, see Configuring the DNS Control Policy.

The Interactive Reports page has been redesigned to improve user experience. The redesign includes a new layout, a Search bar to locate your reports faster, and more.

See image.

To learn more, see About Interactive Reports.

You can now view the verification status of the Zscaler-hosted PAC files from the Administration > Hosted PAC Files page.

The verification status can be:

• Verified: Indicates that the PAC file is verified on the ZIA Admin Portal.
• Error-Accepted: Indicates that the PAC file has some errors and the admin has accepted and saved it with errors at the time of verification on the ZIA Admin Portal.
• Unverified (---): Indicates that the PAC file is not yet verified.

See Image.

After the Zscaler service upgrade, all the pre-existing custom PAC files will be in Unverified status until you verify it because Zscaler does not have the record of previous verification status. You must edit the contents of the file to enable the Verification button for it.

To learn more, see About Hosted PAC Files.

See image.

You can now self provision your static IP addresses or GRE tunnels to connect to the Zscaler service via the ZIA Admin Portal or the cloud service API.

• To self-provision your GRE tunnels, you can use the Add GRE Tunnel Configuration wizard from the Administration > Static IPs & GRE Tunnels > GRE Tunnels page.

See Image.

• To self-provision your static IP addresses, you can use the Add Static IP Configuration wizard from the Administration > Static IPs & GRE Tunnels > Static IP page.

See Image.

To learn more, see About GRE Tunnels and About Static IP. 

The Shadow IT Report shows the number of sanctioned and unsanctioned applications being used and their number of users. It also shows the application categories, the risk index, and the certifications for each of these applications.

See image.

To learn more, see Shadow IT Report.

Watch a feature video about the Redesigned SSL Inspection Policy

As part of the ongoing effort to simplify the adoption and ongoing operation of the ZIA service, Zscaler has redesigned the SSL inspection policy engine. The new design consolidates all the various existing SSL inspection settings into a centralized rule-based engine with a multitude of source and destination based criteria, actions, and sub-actions. Together, they enable great flexibility in implementing your organization’s SSL inspection policies based on your specific needs, such as privacy requirements, user groups, OS platform types, and more.

The following sections cover the new and deprecated SSL inspection settings and the automated migration rules implemented in your ZIA Admin Portal for backwards compatibility with the deprecated SSL inspection settings:

• What's New

  You can now define granular SSL policies using the ZIA Admin Portal to perform SSL scanning on a multitude of criteria pertaining to the source and destination of the SSL traffic. Using this, you can tailor your policies better to simplify the deployment and ongoing operations of SSL inspection and address the compliance and operational environment requirements.

  • All the previous SSL Inspection controls have been replaced with a flexible rule-based engine.
  • The policy engine supports 12 criteria and evaluates the rules in top-down order and stops at the first match.
  • Each policy action supports a variety of special settings for ensuring validity and revocation status of certificates, enforcement of minimum TLS version, and more.
  • All criteria in the rules are organized into multiple OR groups nested inside AND groups. The logical operators between the criteria are visible in the Admin Portal. If you do not select a value for a criterion which is indicated as ---, then the rule ignores the criterion for the policy evaluation. For example, if you do not select any value for the Users criterion, then the rule matches for all the users. If you select a specific user value, then the rule matches only for traffic from the specified user.

  See Image.

  

  Close

  • A new weblog field, SSL Policy Reason is now available under Analytics > Web Insights > Logs and in NSS. This field captures the following SSL inspection policy actions:
    • Blocked
    • Inspected
    • N/A
    • Not inspected because of O365 bypass
    • Not inspected because of SSL policy
    • Not inspected because of UCaaS bypass
    • Not inspected because of Zscaler best practices
    • Not inspected because SSL inspection is off for gateway
  • The Policy Action weblog field now includes the following values:
    • Access denied due to low TLS version
    • Not allowed to establish SSL connection due to policy
    • Access denied due to bad server certificate

  Close
• Deprecated SSL Settings

  All the previous SSL inspection settings have been removed:

  • The following settings were removed from the Administration > Location Management page of the ZIA Admin Portal:

  • Enable SSL Inspection: It was the global SSL inspection settings to enable SSL inspection on individual locations or sub-locations. You can now select locations, sub-locations or location-groups as criteria within an SSL inspection rule.

  See Image.

  

  Close

  • Enforce Zscaler Client Connector SSL Setting: It was used to override the location's SSL policy settings with the Zscaler Client Connector's setting if the Zscaler Client Connector traffic was forwarded from a known location.

  See Image.

  

  Close

  If you need to configure these settings, you must now use the appropriate criteria in the new SSL Inspection Policy page.

  • The following settings were removed from the Policy > SSL Inspection page of the ZIA Admin Portal:

  • If SSL Inspection Is Disabled, Block HTTPS to These Sites: This configuration blocked the specified URL categories or hosts when SSL inspection was disabled on the location or Zscaler Client Connector. This setting was used when Zscaler service had to bypass URL Filtering or Cloud App Control policies due to lack of user context at the time of SSL connection. This was required only when organizations did not use the modern authentication settings, such as Zscaler Client Connector, Surrogate IP, or Policy for Unauthenticated Traffic. You can now configure block rules assigned to these URL Categories and Destination group criteria.
  • Show Notifications for Blocked Traffic: This was a global setting on the tenant which determined whether to display End User Notification for the traffic that were blocked when not subject to SSL inspection. You can now configure the show notification settings within a Do Not Inspect or Block SSL inspection rule.

  See Image.

  

  Close

  • The following settings under the Policy For SSL Inspection section: These were global settings on the tenant to configure which destination traffic should be inspected or exempted from SSL inspection and other policies. You can now configure granular rules to inspect or exempt inspection for the traffic on the specified destination and many other criteria.
    • Inspect Sessions for These URL Categories
    • Exempt These URL Categories from Inspection & Other Policies
    • Exempt These Hosts from Inspection & Other Policies
    • Exempt These Applications from Inspection & Other Policies

  See Image.

  

  Close

  • Block Undecryptable Traffic: This was a global setting on the tenant to block undecryptable traffic, such as non-standard cipher suites. You can now configure how to handle this type of traffic within an SSL inspection rule.

  See Image.

  

  Close

  • Untrusted Server Certificates and Block Site With Revoked Server Certificate: This was a global setting on the tenant to determine how to handle untrusted or revoked certificates for traffic subject to SSL inspection. You can now configure untrusted or revoked certificate settings for both inspected and uninspected traffic within the SSL inspection rules.

  See Image.

  

  Close

  • Enable SSL Inspection for Remote Users with Kerberos: This was a global setting on the tenant to enable or disable SSL inspection for remote user traffic using Kerberos authentication. You can now configure whether to inspect remote user traffic using Kerberos authentication within an SSL inspection rule.

  See Image.

  

  Close

  • All the platform settings under the Policy for Zscaler Client Connector section: These were the global settings on the tenant to enable or disable SSL inspection for specific Zscaler Client Connector platforms. You can now configure the platforms within an SSL inspection rule.

  See Image.

  

  Close

  • The SSL Inspection setting under Administration > Proxies & Gateways > Gateway for Proxies > Add Gateway for Proxies was deprecated. This setting determined whether to disable SSL inspection for traffic forwarded to a third-party proxy service by overriding the SSL inspection settings on the location. You can now disable SSL inspection for traffic forwarded to a third-party proxy service using the Forwarding Gateway criteria within an SSL inspection rule.

  See Image.

  

  Close

  • The Override Zscaler Global SSL Exemptions List setting under Administration > Advanced Settings was deprecated. This was a global setting on the tenant that determined whether to disable the Zscaler recommended SSL exemption list. You can now choose to disable the auto-generated Zscaler Recommended Exemptions rule from the Policy > SSL Inspection page of the ZIA Admin Portal.

  See Image.

  

  Close

  • The following SSL inspection settings related resources were removed from the cloud service API:

  • The following endpoints are no longer supported. If you need to manage SSL bypass lists via API, you must use the destination group or a custom URL category:
    • GET /sslSettings/exemptedUrls
    • POST /sslSettings/exemptedUrls
  • The following Location Management parameters no longer have an effect on SSL policy. They remain supported in the API payload in order to maintain backwards compatibility with existing scripts, but will be removed in future:
    • sslScanEnabled
    • zappSSLScanEnabled

  Close
• Backwards Compatibility

  To ensure that the new rule-based policies are 100% backwards compatible with your previous policy settings, Zscaler automatically generates a set of rules, manual location groups, and destination IP and FQDN groups based on your configuration to preserve the intended behaviour. The number of rules generated ranges between 4 and 17 based on your previous configurations that were in use.

  You can now assign the destination IP addresses and FQDN to the SSL inspection policies as well. You could assign these only to the cloud firewall policies in the earlier releases.

  Ensure that you review the following sections thoroughly to understand the changes:

  • Rule Order

    The auto-generated rules are created in the following order:

    1. Special rules: Zscaler recommended exemptions rule, O365 tenant restriction inspection rules, O365/UCaaS One Click rules
    2. Block rules when SSL inspection is disabled
    3. Organization exemption rules
    4. Inspection rules
    5. Default exemption rule

    Close
  • Auto-generated Entities

    The following group entities are automatically created and assigned to the auto-generated SSL inspection rules after the ZIA service upgrade:

    • Location Groups

      Group Name	Description
      Locations_SSL	Includes locations with the following settings: Enable SSL inspection: Enabled This is applicable for migration scenarios 1, 2, 3, and 4.
      Locations_NoSSL	Includes all locations with the following settings: Enable SSL inspection: Disabled This is applicable for migration scenarios 1, 2, 3, and 4.
      Locations_CltCon_Enforce	Includes all locations with the following settings: Enforce Zscaler Client Connector SSL Setting: Enabled This is applicable for migration scenarios 3 and 4.
      Locations_SSL_CltCon_Enforce	Includes all locations with the following settings: Enable SSL inspection: Enabled Enforce Zscaler Client Connector SSL Setting: Enabled This is applicable for migration scenario 3.
      Locations_SSL_CltCon_NoEnforce	Includes all locations with the following settings: Enable SSL inspection: Enabled Enforce Zscaler Client Connector SSL Setting: Disabled This is applicable for migration scenarios 3 and 4.
      Locations_NoSSL_CltCon_Enforce	Includes all locations with the following settings: Enable SSL inspection: Disabled Enforce Zscaler Client Connector SSL Setting: Enabled This is applicable for migration scenario 2.
      Locations_NoSSL_CltCon_NoEnforce	Includes all locations with the following settings: Enable SSL inspection: Disabled Enforce Zscaler Client Connector SSL Setting: Disabled This is applicable for migration scenarios 2, 3, and 4.

      Close
    • Destination Groups

      Group Name	Description
      NoSSL_Blocked_IPs	IP address destination group to include all the IP addresses that were configured in If SSL Inspection Is Disabled, Block HTTPS to These Sites.
      NoSSL_Blocked_Domains	Domain destination group to include all the wildcard domains and FQDNs that were configured in If SSL Inspection Is Disabled, Block HTTPS to These Sites.
      NoSSL_NoOtherPolicies_IPs	IP address destination group to include all the IP addresses that were configured in Exempt These Hosts from Inspection & Other Policies.
      NoSSL_NoOtherPolicies_Domains	Domain destination group to include all the wildcard domains and FQDNs that were configured in Exempt These Hosts from Inspection & Other Policies.

      Close

    Close
  • Action Settings

    The following action settings are pre-configured in the auto-generated rules based on your previous global SSL inspection settings:

    • For Inspect action:
      • Untrusted Server Certificates, OCSP Revocation Check, Show End User Notifications, Block Undecryptable Traffic: Inherited from your previous configuration
      • Client and Server Min TLS Version: TLS 1.0
    • For Do Not Inspect & Evaluate action:
      • Untrusted Server Certificates, OCSP Revocation Check: Disabled
      • Show End User Notifications: Inherited from your previous configuration
      • Min TLS Version: TLS 1.0
    • For Block action:
      • Show End User Notifications: Inherited from your previous configuration

    Close

  Migration Scenarios and Rules

  This section covers the list of migration rules that are auto-generated for various SSL inspection configuration scenarios that existed before the ZIA service upgrade.

  Following are the descriptions of the terms used in the rule tables provided in this section:

  • CltCon: Zscaler Client Connector
  • O365-TR: Office 365 Tenant Restriction 
  • RWKRB: SSL inspection for Remote users with Kerberos authentication
  • Blocked Categories: URL categories that were configured in If SSL Inspection Is Disabled, Block HTTPS to These Sites
  • Bypassed URL Categories: URL categories that that were configured in Exempt These URL Categories from Inspection & Other Policies
  • Inclusion List Categories: URL categories that that were configured in Inspect Sessions for These URL Categories
  • Bypassed Applications: Cloud Applications that were configured in Exempt These Applications from Inspection & Other Policies

  Migration Scenario 1: Enforce Zscaler Client Connector Disabled for All Locations

  Enforce Zscaler Client Connector was disabled for all locations.

  • Rule 1: Zscaler Recommended Exemptions

    Predefined rule to automatically exempt known destinations that cannot be SSL inspected. This rule is disabled if the Override Zscaler Global SSL Exemptions setting was enabled in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Any	URL Category: Recommended SSL Exemptions	Do Not Inspect & Bypass

    Close
  • Rule 2: O365-TR Locations

    Mandatory rule to enable Office 365 Tenancy Restrictions for location traffic. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 3: O365-TR Remote Users

    Mandatory rule to enable Office 365 Tenancy Restrictions for remote user traffic. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 4: Office 365 One Click

    Predefined rule, controlled by the Microsoft-Recommended and Legacy Office 365 One Click Setting.

    Source Criteria	Destination Criteria	Action
    Any	Cloud Applications: All O365 applications [Applicable, only if Microsoft-recommended One Click is enabled] URL Category: O365 Internal Category [Applicable, if either Microsoft-recommended or legacy One Click is enabled]	Do Not Inspect & Bypass

    Close
  • Rule 5: UCaaS One Click

    Predefined rule, controlled by the UCaaS One Click Configuration.

    Source Criteria	Destination Criteria	Action
    Any	Application Service: Zoom, LogMeIn, RingCentral	Do Not Inspect & Bypass

    Close
  • Rule 6: Block No SSL Locations

    Block traffic from SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 7: Block Remote Users

    Block remote user traffic:

    • If it is from SSL inspection-disabled Zscaler Client Connector platforms.

    or

    • If it is with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 8: Organization SSL Bypass

    Whitelist from SSL inspection and other policies.

    Source Criteria	Destination Criteria	Action
    Any	URL Categories: Bypassed URL Categories Destination Group: NoSSL_NoOtherPolicies_IPs, NoSSL_NoOtherPolicies_Domains Cloud Applications: Bypassed Applications	Do Not Inspect & Bypass

    Close
  • Rule 9: Inspect Locations

    Inspect traffic from SSL inspection-enabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 10: Inspect Remote Users

    Inspect remote user traffic:

    • If it is from SSL inspection-enabled Zscaler Client Connector platforms

    or

    • If it is with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 11: Default SSL Inspection Rule

    The default SSL inspection rule takes the last rule order.

    Source Criteria	Destination Criteria	Action
    ---	---	Do Not Inspect & Evaluate

    Close

  Migration Scenario 2: Enforce Zscaler Client Connector Enabled only for SSL Inspection-Disabled Locations

  Location SSL inspecton setting is flipped from disabled to enabled for some Zscaler Client Connector platforms.

  • Rule 1: Zscaler Recommended Exemptions

    Predefined rule to automatically exempt known destinations that cannot be SSL inspected. This rule is disabled if the Override Zscaler Global SSL Exemptions setting was enabled in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Any	URL Category: Recommended SSL Exemptions	Do Not Inspect & Bypass

    Close
  • Rule 2: O365-TR CltCon on No-SSL Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for traffic from SSL inspection-enabled Zscaler Client Connector platforms on SSL inspection-disabled locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL_CltCon_NoEnforce Zscaler Client Connector: Platforms with SSL enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 3: O365-TR Locations

    Mandatory rule to enable Office 365 Tenancy Restrictions for location traffic. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 4: O365-TR Remote Users

    Mandatory rule to enable Office 365 Tenancy Restrictions for remote user traffic. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 5: Office 365 One Click

    Predefined rule, controlled by the Microsoft-Recommended and Legacy Office 365 One Click Setting.

    Source Criteria	Destination Criteria	Action
    Any	Cloud Applications: All O365 applications [Applicable, only if Microsoft-recommended One Click is enabled] URL Category: O365 Internal Category [Applicable, if either Microsoft-recommended or legacy One Click is enabled]	Do Not Inspect & Bypass

    Close
  • Rule 6: UCaaS One Click

    Predefined rule, controlled by the UCaaS One Click Configuration.

    Source Criteria	Destination Criteria	Action
    Any	Application Service: Zoom, LogMeIn, RingCentral	Do Not Inspect & Bypass

    Close
  • Rule 7: Blk CltCon on No-SSL Locs

    Block traffic from any Zscaler Client Connector platform on SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location group: Locations_NoSSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 8: Blk NoSSL CltCon on NoSSL Locs

    Block traffic from SSL inspection-disabled Zscaler Client Connector platforms on SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL_CltCon_Enforce Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 9: Blk Non-CltCon on No-SSL Locs

    Block non-Zscaler Client Connector traffic on SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL Zscaler Client Connector: No Zscaler Client Connector	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 10: Blk Remote Users

    Block remote user traffic:

    • If it is from SSL inspection-disabled Zscaler Client Connector platforms.

    or

    • If it is with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 11: SSL Bypass

    Whitelist from SSL inspection and other policies.

    Source Criteria	Destination Criteria	Action
    Any	URL Categories: Bypassed URL Categories Destination Group: NoSSL_NoOtherPolicies_IPs, NoSSL_NoOtherPolicies_Domains Cloud Applications: Bypassed Applications	Do Not Inspect & Bypass

    Close
  • Rule 12: Inspect CltCon on No-SSL Locs

    Inspect traffic from SSL inspection-enabled Zscaler Client Connector platforms on SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL_CltCon_Enforce Zscaler Client Connector Platforms with SSL enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 13: Inspect Locs

    Inspect traffic from SSL inspection-enabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 14: Inspect Remote Users

    Inspect remote user traffic, if:

    • It is from SSL inspection-enabled Zscaler Client Connector platforms.

    or

    • It is with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 15: Default SSL Inspection Rule

    The default SSL inspection rule takes the last rule order.

    Source Criteria	Destination Criteria	Action
    ---	---	Do Not Inspect & Evaluate

    Close

  Migration Scenario 3: Enforce Zscaler Client Connector Enabled only for SSL Inspection-Enabled Locations

  Location SSL inspection setting is flipped from enabled to disabled for some Zscaler Client Connector platforms.

  • Rule 1: Zscaler Recommended Exemptions

    Predefined rule to automatically exempt known destinations that cannot be SSL inspected. This rule is disabled if the Override Zscaler Global SSL Exemptions setting was enabled in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Any	URL Category: Recommended SSL Exemptions	Do Not Inspect & Bypass

    Close
  • Rule 2: O365-TR All CltCon on SSL Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for traffic from any Zscaler Client Connector platform on SSL inspection-enabled locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 3: O365-TR CltCon on SSL Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for traffic from SSL inspection-enabled Zscaler Client Connector platforms on SSL-inspection enabled locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL_CltCon_Enforce Zscaler Client Connector: Only platforms with SSL enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 4: O365-TR Non-CltCon on Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for non-Zscaler Client Connector traffic from SSL inspection-enabled locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL Zscaler Client Connector: No Zscaler Client Connector	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 5: O365-TR Remote Users

    Mandatory rule to enable Office 365 Tenancy Restrictions for remote user traffic. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 6: Office 365 One Click

    Predefined rule, controlled by the Microsoft-Recommended and Legacy Office 365 One Click Setting.

    Source Criteria	Destination Criteria	Action
    Any	Cloud Applications: All O365 applications [Applicable, only if Microsoft-recommended One Click is enabled] URL Category: O365 Internal Category [Applicable, if either Microsoft-recommended or legacy One Click is enabled]	Do Not Inspect & Bypass

    Close
  • Rule 7: UCaaS One Click

    Predefined rule, controlled by the UCaaS One Click Configuration.

    Source Criteria	Destination Criteria	Action
    Any	Application Service: Zoom, LogMeIn, RingCentral	Do Not Inspect & Bypass

    Close
  • Rule 8: Block CltCon on No-SSL Locs

    Block traffic from any Zscaler Client Connector platforms on SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location group: Locations_NoSSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 9: Block No-SSL CltCon on Locs

    Block traffic from SSL inspection-disabled Zscaler Client Connector platforms on locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_CltCon_Enforce Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 10: Block No-SSL Locs

    Block non-Zscaler Client Connector traffic from SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location group: Locations_NoSSL Zscaler Client Connector: No Zscaler Client Connector	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 11: Block Remote Users

    Block remote user traffic:

    • If it is from SSL inspection-disabled Zscaler Client Connector platforms

    or

    • If it is not with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 12: SSL Bypass

    Whitelist from SSL inspection and other policies.

    Source Criteria	Destination Criteria	Action
    Any	URL Categories: Bypassed URL Categories Destination Group: NoSSL_NoOtherPolicies_IPs, NoSSL_NoOtherPolicies_Domains Cloud Applications: Bypassed Applications	Do Not Inspect & Bypass

    Close
  • Rule 13: Inspect All CltCon on SSL Locs

    Inspect traffic from any Zscaler Client Connector platforms on SSL inspection-enabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 14: Inspect CltCon on SSL Locs

    Inspect traffic from certain Zscaler Client Connector platforms on SSL inspection-enabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL_CltCon_Enforce Zscaler Client Connector: Only platforms with SSL enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 15: Inspect Non-CltCon on Locs

    Inspect non-Zscaler Client Connector traffic from SSL inspection-enabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL Zscaler Client Connector: No Zscaler Client Connector	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 16: Inspect Remote Users

    Inspect remote user traffic:

    • If it is from SSL inspection-enabled Zscaler Client Connector platforms.

    or

    • If it is with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 17: Default SSL Inspection Rule

    The default SSL inspection rule takes the last rule order.

    Source Criteria	Destination Criteria	Action
    ---	---	Do Not Inspect & Evaluate

    Close

  Migration Scenario 4: Enforce Zscaler Client Connector Enabled for All Locations

  Enforce Zscaler Client Connector was enabled for locations with SSL disabled and for locations with SSL enabled. Location SSL is flipped from disabled to enabled or from enabled to disabled for some Zscaler Client Connector platforms:

  • Rule 1: Zscaler Recommended Exemptions

    Predefined rule to automatically exempt known destinations that cannot be SSL inspected. This rule is disabled if the Override Zscaler Global SSL Exemptions setting was enabled in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Any	URL Category: Recommended SSL Exemptions	Do Not Inspect & Bypass

    Close
  • Rule 2: O365-TR All CltCon on SSL Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for traffic from any Zscaler Client Connector platform on SSL inspection-enabled locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 3: O365-TR CltCon on Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for traffic from SSL inspection-enabled Zscaler Client Connector platforms on locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_CltCon_Enforce Zscaler Client Connector: Only platforms with SSL enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 4: O365-TR Non-CltCon on Locs

    Mandatory rule to enable Office 365 Tenancy Restrictions for non-Zscaler Client Connector traffic from SSL inspection-enabled locations. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL Zscaler Client Connector: No Zscaler Client Connector	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 5: O365-TR Remote Users

    Mandatory rule to enable Office 365 Tenancy Restrictions for remote user traffic. This rule is created only if an Office 365 tenant profile existed in your previous configuration.

    Source Criteria	Destination Criteria	Action
    Location Group: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	Cloud Application: Microsoft Login Services	Inspect

    Close
  • Rule 6: Office 365 One Click

    Predefined rule, controlled by the Microsoft-Recommended and Legacy Office 365 One Click Setting.

    Source Criteria	Destination Criteria	Action
    Any	Cloud Applications: All O365 applications [Applicable, only if Microsoft-recommended One Click is enabled] URL Category: O365 Internal Category [Applicable, if either Microsoft-recommended or legacy One Click is enabled]	Do Not Inspect & Bypass

    Close
  • Rule 7: UCaaS One Click

    Predefined rule, controlled by the UCaaS One Click Configuration.

    Source Criteria	Destination Criteria	Action
    Any	Application Service: Zoom, LogMeIn, RingCentral	Do Not Inspect & Bypass

    Close
  • Rule 8: Block CltCon on No-SSL Locs

    Block traffic from any Zscaler Client Connector platform on SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 9: Block No-SSL CltCon on Locs

    Block traffic from SSL inspection-disabled Zscaler Client Connector platforms on locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_CltCon_Enforce Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 10: Block No-SSL Locs

    Block non-Zscaler Client Connector traffic from SSL inspection-disabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_NoSSL Zscaler Client Connector: No Zscaler Client Connector	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 11: Block Remote Users

    Block remote user traffic:

    • If it is from SSL inspection-disabled Zscaler Client Connector platforms.

    or

    • If it is without Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL disabled	URL Categories: Blocked Categories Destination Group: NoSSL_Blocked_IPs, NoSSL_Blocked_Domains	Block

    Close
  • Rule 12: SSL Bypass

    Whitelist from SSL inspection and other policies.

    Source Criteria	Destination Criteria	Action
    Any	URL Categories: Bypassed URL Categories Destination Group: NoSSL_NoOtherPolicies_IPs, NoSSL_NoOtherPolicies_Domains Cloud Applications: Bypassed Applications	Do Not Inspect & Bypass

    Close
  • Rule 13: Inspect All CltCon on SSL Locs

    Inspect traffic from all Zscaler Client Connector platforms on locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL_CltCon_NoEnforce Zscaler Client Connector: Windows, MacOS, Android, iOS	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 14: Inspect CltCon on Locs

    Inspect traffic from SSL inspection-enabled Zscaler Client Connector platforms on locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_CltCon_Enforce Zscaler Client Connector: Platforms with SSL enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 15: Inspect Non-CltCon on Locs

    Inspect non-Zscaler Client Connector traffic from SSL inspection-enabled locations.

    Source Criteria	Destination Criteria	Action
    Location Group: Locations_SSL Zscaler Client Connector: No Zscaler Client Connector	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 16: Inspect Remote Users

    Inspect remote user traffic:

    • If it is from SSL inspection-enabled Zscaler Client Connector platforms.

    or

    • If it is with Kerberos authentication.

    Source Criteria	Destination Criteria	Action
    Locations: Road Warrior Zscaler Client Connector: Platforms with SSL enabled or RWKRB enabled	URL Categories: Inclusion List Categories	Inspect

    Close
  • Rule 17: Default SSL Inspection Rule

    The default SSL inspection rule takes the last rule order.

    Source Criteria	Destination Criteria	Action
    ---	---	Do Not Inspect & Evaluate

    Close

  Migration Scenario 5: Third-Party Proxy Chaining Rule

  This rule will be created only for organizations with a Forwarding Gateway that was configured to override the location SSL inspection setting. It will be added immediately after the SSL bypass rules in the scenarios above.

  Rule Name: Upstream Proxy Bypass - Bypass traffic forwarded to a third-party proxy service.

  Source Criteria	Destination Criteria	Action
  Forwarding Gateways: All with Disable SSL Inspection and Override Location	Any	Do Not Inspect & Evaluate

  Close

To learn more, see About SSL Inspection Policy.

The following updates were made to the cloud service API:

• Firewall Policies resources are now available. With this update the API now fully supports create, read, update, and delete (CRUD) for these resources.
  • POST /firewallFilteringRules
  • PUT /firewallFilteringRules/{ruleId}
  • DELETE /firewallFilteringRules/{ruleId}
  • POST /ipDestinationGroups
  • PUT /ipDestinationGroups/{ipGroupId}
  • DELETE /ipDestinationGroups/{ipGroupId}
  • POST /ipSourceGroups
  • PUT /ipSourceGroups/{ipGroupId}
  • DELETE /ipSourceGroups/{ipGroupId}
  • POST /networkServices
  • PUT /networkServices/{serviceId}
  • DELETE /networkServices/{serviceId}
  • POST /networkServiceGroups
  • PUT /networkServiceGroups/{serviceGroupId}
  • DELETE /networkServiceGroups/{serviceGroupId}

  Close
• Traffic Forwarding resources are now available. These new resources are available for self-service GRE tunnel and static IP provisioning.
  • GET /greTunnels
  • POST /greTunnels
  • GET /greTunnels/availableInternalIpRanges
  • PUT /greTunnels/{id}
  • DELETE /greTunnels/{id}
  • GET /vips/recommendedList
  • GET /staticIP
  • POST /staticIP
  • POST /staticIP/validate
  • GET /staticIP/{id}
  • PUT /staticIP/{id}
  • DELETE /staticIP/{id}

  Close
• SSL Inspection Settings resources were removed. If you need to manage SSL bypass lists via API, you must use the destination group or a custom URL category.
  • GET /sslSettings/exemptedUrls
  • POST /sslSettings/exemptedUrls

  Close
• Location Management parameters no longer have an effect on SSL policy. They remain supported in the API payload in order to maintain backwards compatibility with existing scripts, but will be removed in future.
  • sslScanEnabled
  • zappSSLScanEnabled

  Close

With this update, the base URL for the cloud services API was changed from admin.<Zscaler Cloud Name>/api/v1 to zsapi.<Zscaler Cloud Name>/api/v1. Where <Zscaler Cloud Name> is the cloud name that was provisioned for your organization (e.g., zsapi.zscalerbeta.net/api/v1). Zscaler highly recommends that you update your scripts to use the new base URL. 

To learn more, see API Reference and Configuring the Postman REST API Client.

You now can select a user agent when configuring the URL Filtering and Cloud App Control policies.

See image.

To learn more, see Configuring the URL Filtering Policy and Adding Rules to the Cloud App Control Policy.

You can now choose a personalized color theme for the ZIA Admin Portal interface. The selected theme is only applicable to your admin profile.

See image.

To learn more, see Customizing Your Admin Account Settings.

Cloud Browser Isolation now allows admins to choose if hyperlinks clicked by users in isolation are rendered in the isolation browser or the user's local browser. If this feature is enabled for an isolation profile, hyperlinks will be evaluated by the isolation session, and links leading to domains other than the one in the isolation session will be pushed outside of the isolation environment and rendered in the user's local browser. 

See image. 

To learn more, see Local Browser Rendering for Cloud Browser Isolation. 

New SaaS Application Support

You can now configure tenants for ServiceNow.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to SaaS Security API Policies

You can now configure the SaaS Security API Control policies and scan schedules for ITSM applications.

As part of this enhancement, the SaaS Security API page was renamed to SaaS Security API Control.

See image.

Additionally, the SaaS Security Posture Policy page was renamed to SaaS Security Posture Control.

See image.

To learn more, see Configuring the SaaS Security API Control Policy and Configuring the SaaS Security Posture Control Policy.

Updates to the SaaS Assets Summary Report

You can now view ITSM application categories in the SaaS Assets Summary Report.

To learn more, see SaaS Assets Summary Report.

Updates to the SaaS Assets Report

You can now view the ITSM, CRM, and source code repository application categories in the SaaS Assets Report.

To learn more, see Saas Assets Report and SaaS Assets Report: Assets with Incidents.

Updates to SaaS Security Insights & Insights Logs

You can now view the updates to the SaaS Assets Summary Report in SaaS Security Insights and Insights Logs.

To learn more, see SaaS Security Insights and SaaS Security Insights Logs.

New Application Categories for NSS Feeds

There is a new application category in NSS feeds for SaaS Security API: SaaS Security ITSM. These application categories provide support for ServiceNow (ITSM).

There is also a new tab for ITSM in the SaaS Security Log Filters.

To learn more, see Adding NSS Feeds for SaaS Security Logs.

New SaaS Security Fields for NSS Feed Outputs

The following web log fields were added to NSS Feeds under ITSM:

• %d{num_internal_collab}
• %d{num_external_collab}
• %s{objectname}
• %s{objecttype}
• %s{file_msg_id}
• %s{filetypecategory}
• %s{hostname}
• %s{ohostname}
• %s{ofullurl}
• %s{internal_collabnames}
• %s{external_collabnames}
• %s{ointernal_collabnames}
• %s{oexternal_collabnames}
• %d{filesize}
• %s{file_msg_mod_time}
• %s{filepath}
• %s{component}
• %s{sha}

To learn more, see NSS Feed Output Format: SaaS Security Logs.

The new SaaS Security Posture Report shows you the current state of your organization’s security posture for SaaS applications in relation to recommended security standards. It also allows you to see information on recommended security policies, security threats and their risk levels, and remediation activities.

See image.

With the SaaS Security Posture Policy, you can configure the number of recommended security policies that the SaaS Security Posture Report includes in its analysis of your organization’s security posture.

See image.

To learn more, see SaaS Security Posture Report and Configuring the SaaS Security Posture Policy.

New SaaS Application Support

You can now configure tenants for GitHub.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to SaaS Security API Policies & Scan Configuration

You can now configure the SaaS Security API policies and scan schedules for source code repositories.

See image.

To learn more, see Configuring SaaS Security API Policies.

Updates to the SaaS Assets Summary Report

You can now view GitHub in the SaaS Assets Summary Report.

To learn more, see SaaS Assets Summary Report.

Updates to SaaS Security Insights & Insights Logs

You can now view GitHub in SaaS Security Insights and Insights Logs.

To learn more, see SaaS Security Insights and SaaS Security Insights Logs.

New SaaS Application Support

You can now configure tenants for Citrix ShareFile.

See image.

To learn more, see Adding SaaS Application Tenants.

Updates to SaaS Security API Policies & Scan Configuration

You can now configure the SaaS Security API policies and scan schedules for ShareFile, a file sharing application.

Updates to the SaaS Assets Summary Report

You can now view ShareFile in the SaaS Assets Summary Report.

To learn more, see SaaS Assets Summary Report.

Updates to the SaaS Assets Report

You can now view ShareFile in the SaaS Assets Report.

To learn more, see SaaS Assets Report.

Updates to SaaS Security Insights & Insights Logs

You can now view ShareFile in SaaS Security Insights and Insights Logs.

To learn more, see SaaS Security Insights and SaaS Security Insights Logs.