GSA coexistence with Zscaler
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5735703 · +54 −22 lines · also on GitHub
11
---
22
title: Configure Microsoft and Zscaler for a Unified SASE Solution
3
−description: "Learn how to configure Microsoft and Zscaler SSE for unified SASE solutions to enhance security and connectivity in your organization."
3
+description: "Learn how to deploy Microsoft Global Secure Access alongside Zscaler Private Access and Internet Access. Covers four integration scenarios with step-by-step configuration, verification, and traffic testing procedures."
44
#customer intent: As a network administrator, I want to configure Microsoft and Zscaler SSE for unified SASE solutions so that I can enhance security and connectivity in my organization.
55
ms.topic: how-to
6
−ms.date: 03/13/2026
6
+ms.date: 03/18/2026
77
ms.subservice: entra-private-access
88
ms.reviewer: shkhalid
99
ai-usage: ai-assisted
⋯ 33 unchanged lines
4343
- Set up Zscaler Private Access and Internet Access
4444
- Configure the Global Secure Access FQDN and IP bypasses
4545
46
−### Microsoft Global Secure Access
46
+### Prerequisites for Microsoft Global Secure Access
4747
48
−To set up Microsoft Entra Global Secure Access and test all scenarios in this documentation:
48
+To set up Microsoft Entra Global Secure Access and test all four scenarios described in this article:
4949
- Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md).
5050
- Install and configure the Microsoft Entra private network connector. For information on how to install and configure the connector, see [How to configure connectors](how-to-configure-connectors.md).
5151
> [!NOTE]
⋯ 1 unchanged line
5353
- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. For information on how to configure Quick Access, see [How to configure Quick Access](how-to-configure-quick-access.md).
5454
- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](concept-clients.md). For information on how to install the Windows client, see [Global Secure Access client for Windows](how-to-install-windows-client.md). For macOS, see [Global Secure Access Client for macOS](how-to-install-macos-client.md).
5555
56
−### Zscaler Private Access and Internet Access
56
+### Prerequisites for Zscaler Private Access and Internet Access
5757
58
−To integrate Zscaler Private Access and Zscaler Internet Access with Microsoft Global Secure Access, make sure you complete the following prerequisites. These steps ensure smooth integration, better traffic management, and improved security.
58
+To integrate ZscalerPrivate Access and Zscaler Internet Access with Microsoft Global Secure Access, make sure you complete the following prerequisites. These steps ensure smooth integration, better traffic management, and improved security.
5959
- Configure Zscaler Internet Access. For more information about configuring Zscaler, see [Step-by-Step Configuration Guide for ZIA](https://help.zscaler.com/zia/step-step-configuration-guide-zia).
6060
- Configure Zscaler Private Access. For more information about configuring Zscaler, see [Step-by-Step Configuration Guide for ZPA](https://help.zscaler.com/zpa/step-step-configuration-guide-zpa).
6161
- Set up and configure Zscaler Client Connector forwarding profiles. For more information about configuring Zscaler, see [Configuring Forwarding Profiles for Zscaler Client Connector](https://help.zscaler.com/zscaler-client-connector/configuring-forwarding-profiles-zscaler-client-connector).
⋯ 14 unchanged lines
7676
7777
In this scenario, Microsoft Entra Private Access handles private application traffic, while Zscaler Internet Access manages Internet traffic. The Zscaler Private Access module is disabled in the Zscaler portal. To configure Microsoft Entra Private Access, you need to complete several steps. First, enable the forwarding profile. Next, install the Private Network Connector. After that, set up Quick Access and configure Private DNS. Finally, install the Global Secure Access client. For Zscaler Internet Access, the configuration involves creating a forwarding profile and app profile, adding bypass rules for Microsoft Entra services, and installing the Zscaler Client Connector. Finally, the configurations are verified, and traffic flow are tested to ensure proper handling of private and Internet traffic by the respective solutions.
7878
79
−### Microsoft Entra Private Access configuration
79
+### Configure Microsoft Entra Private Access
8080
81
−For this scenario you need to:
81
+To configure Microsoft Entra Private Access for this scenario:
8282
- [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
8383
- Install a [Private Network Connector](how-to-configure-connectors.md) for Microsoft Entra Private Access.
8484
- Configure [Quick Access and set up Private DNS](how-to-configure-quick-access.md).
8585
- Install and configure the [Global Secure Access client for Windows](how-to-install-windows-client.md) or [macOS](how-to-install-macos-client.md).
8686
87
−### Zscaler Internet Access configuration
87
+### Configure Zscaler Internet Access
8888
89
−Perform in the Zscaler portal:
89
+Complete the following steps in the Zscaler portal:
9090
- Set up and configure [Zscaler Internet Access](https://help.zscaler.com/zia/step-step-configuration-guide-zia).
9191
- Create a forwarding profile.
9292
- Create an app profile.
9393
- Install the Zscaler Client Connector
9494
95
+#### Add a forwarding profile
96
+
9597
Add Forwarding Profile from the Client Connector Portal:
9698
1. Navigate to **Zscaler Client Connector admin portal** > **Administration** > **Forwarding Profile** > **Add Forwarding Profile**.
9799
1. Add a **Profile Name** such as `ZIA Only`.
⋯ 2 unchanged lines
100102
1. Scroll down to **Forwarding profile action for ZPA**.
101103
1. Select **None** for all options in this section.
102104
105
+#### Add an app profile
106
+
103107
Add App Profile from the Client Connector Portal:
104108
1. Navigate to **Zscaler Client Connector admin portal** > **App Profiles** > **Windows (or macOS)** > **Add Windows Policy (or macOS)**.
105109
1. Add **Name**, set **Rule Order** such as **1**, select **Enable**, select **User(s)** to apply this policy, and select the **Forwarding Profile**. For example, select **ZIA Only**.
106110
1. Scroll down and add the Microsoft SSE service Internet Protocol (IP) addresses and Fully Qualified Domain Names (FQDNs) in the [Global Secure Access service FQDNs and IPs bypasses section](#global-secure-access-service-fqdns-and-ips-bypasses), to “**HOSTNAME OR IP ADDRESS BYPASS FOR VPN GATEWAY**” field.
107111
112
+#### Verify client configurations
113
+
108114
Go to the system tray to check that Global Secure Access and Zscaler clients are enabled.
109115
110116
Verify configurations for clients:
⋯ 6 unchanged lines
117123
> [!NOTE]
118124
> For information troubleshooting health check failures, see [Troubleshoot the Global Secure Access client diagnostics - Health check](troubleshoot-global-secure-access-client-diagnostics-health-check.md).
119125
120
− Test traffic flow:
126
+#### Test traffic flow
127
+
128
+Test traffic flow:
121129
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
122130
1. Access these websites from the browser: `bing.com`, `salesforce.com`, `Instagram.com`.
123131
1. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** > **Traffic** tab.
⋯ 11 unchanged lines
135143
136144
In this scenario, both clients handle traffic for separate private applications. Global Secure Access handles private applications in Microsoft Entra Private Access. Private applications in Zscaler use the Zscaler Private Access module. Zscaler Internet Access handles Internet traffic.
137145
138
−### Microsoft Entra Private Access configuration
146
+### Configure Microsoft Entra Private Access
139147
140
−For this scenario, you need to:
148
+To configure Microsoft Entra Private Access for this scenario:
141149
- [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
142150
- Install a [Private Network Connector](how-to-configure-connectors.md) for Microsoft Entra Private Access.
143151
- Configure [Quick Access and set up Private DNS](how-to-configure-quick-access.md).
144152
- Install and configure the [Global Secure Access client for Windows](how-to-install-windows-client.md) or [macOS](how-to-install-macos-client.md).
145153
146
−### Zscaler Private Access and Zscaler Internet Access configuration
154
+### Configure Zscaler Private Access and Internet Access
147155
148
−Perform the steps in the Zscaler portal:
156
+Complete the following steps in the Zscaler portal:
149157
- Set up and configure both Zscaler Internet Access and Zscaler Private Access.
150158
- Create a forwarding profile.
151159
- Create an app profile.
152160
- Install the Zscaler Client Connector.
153161
162
+#### Add a forwarding profile
163
+
154164
Add Forwarding Profile from the Client Connector Portal:
155165
1. Navigate to **Zscaler Client Connector admin portal** > **Administration** > **Forwarding Profile** > **Add Forwarding Profile**.
156166
1. Add a **Profile Name** such as `ZIA and ZPA`.
⋯ 2 unchanged lines
159169
1. Scroll down to **Forwarding profile action for ZPA**.
160170
1. Select Tunnel for all options in this section.
161171
172
+#### Add an app profile
173
+
162174
Add App Profile from the Client Connector Portal:
163175
1. Navigate to **Zscaler Client Connector admin portal** > **App Profiles** > **Windows (or macOS)** > **Add Windows Policy (or macOS)**.
164176
1. Add **Name**, set **Rule Order** such as **1**, select **Enable**, select **User(s)** to apply this policy, and select the **Forwarding Profile**. For example, select **ZIA and ZPA**.
165177
1. Scroll down and add the Microsoft SSE service Internet Protocol (IP) addresses and Fully Qualified Domain Names (FQDNs) in the [Global Secure Access service FQDNs and IPs bypasses section](#global-secure-access-service-fqdns-and-ips-bypasses), to “**HOSTNAME OR IP ADDRESS BYPASS FOR VPN GATEWAY**” field.
166178
179
+#### Verify client configurations
180
+
167181
Go to the system tray to check that Global Secure Access and Zscaler clients are enabled.
168182
169183
Verify configurations for clients:
⋯ 6 unchanged lines
176190
> [!NOTE]
177191
> For information troubleshooting health check failures, see [Troubleshoot the Global Secure Access client diagnostics - Health check](troubleshoot-global-secure-access-client-diagnostics-health-check.md).
178192
193
+#### Test traffic flow
194
+
179195
Test traffic flow:
180196
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
181197
1. Access these websites from the browser: `bing.com`, `salesforce.com`, `Instagram.com`.
⋯ 14 unchanged lines
196212
197213
In this scenario, Global Secure Access handles all Microsoft 365 traffic. Zscaler Private Access handles Private application traffic and Zscaler Internet Access handles Internet traffic.
198214
199
−### Microsoft Entra Microsoft Access
215
+### Configure Microsoft Entra Microsoft Access
200216
201
−For this scenario, you need to:
217
+To configure Microsoft Entra Microsoft Access for this scenario:
202218
- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile).
203219
- Install and configure the [Global Secure Access client for Windows](how-to-install-windows-client.md) or [macOS](how-to-install-macos-client.md).
204220
205
−### Zscaler Private Access and Zscaler Internet Access
221
+### Configure Zscaler Private Access and Internet Access
206222
207
−Perform in the Zscaler portal:
223
+Complete the following steps in the Zscaler portal:
208224
- Set up and configure Zscaler Private Access.
209225
- Create a forwarding profile.
210226
- Create an app profile.
211227
- Install the Zscaler Client Connector.
212228
229
+#### Add a forwarding profile
230
+
213231
Add Forwarding Profile from the Client Connector Portal:
214232
1. Navigate to **Zscaler Client Connector admin portal** > **Administration** > **Forwarding Profile** > **Add Forwarding Profile**.
215233
1. Add a **Profile Name** such as `ZIA and ZPA`.
⋯ 2 unchanged lines
218236
1. Scroll down to **Forwarding profile action for ZPA**.
219237
1. Select Tunnel for all options in this section.
220238
239
+#### Add an app profile
240
+
221241
Add App Profile from the Client Connector Portal:
222242
1. Navigate to **Zscaler Client Connector admin portal** > **App Profiles** > **Windows (or macOS)** > **Add Windows Policy (or macOS)**.
223243
1. Add **Name**, set **Rule Order** such as **1**, select **Enable**, select **User(s)** to apply this policy, and select the **Forwarding Profile**. For example, select **ZIA and ZPA**.
224244
1. Scroll down and add the Microsoft SSE service Internet Protocol (IP) addresses and Fully Qualified Domain Names (FQDNs) in the [Global Secure Access service FQDNs and IPs bypasses section](#global-secure-access-service-fqdns-and-ips-bypasses), to “**HOSTNAME OR IP ADDRESS BYPASS FOR VPN GATEWAY**” field.
225245
246
+#### Verify client configurations
247
+
226248
Go to the system tray to check that Global Secure Access and Zscaler clients are enabled.
227249
228250
Verify configurations for clients:
⋯ 6 unchanged lines
235257
> [!NOTE]
236258
> For information troubleshooting health check failures, see [Troubleshoot the Global Secure Access client diagnostics - Health check](troubleshoot-global-secure-access-client-diagnostics-health-check.md).
237259
260
+#### Test traffic flow
261
+
238262
Test traffic flow:
239263
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
240264
1. Access these websites from the browser: `bing.com`, `salesforce.com`, `Instagram.com`.
⋯ 16 unchanged lines
257281
258282
In this scenario, Global Secure Access handles Internet and Microsoft 365 traffic. Zscaler only captures private application traffic. Therefore, the Zscaler Internet Access module is disabled from the Zscaler portal.
259283
260
−### Microsoft Entra Internet and Microsoft Access
284
+### Configure Microsoft Entra Internet and Microsoft Access
261285
262286
For this scenario, you need to configure:
263287
- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).
⋯ 6 unchanged lines
270294
1. Leave destination type `FQDN` and in **Destination** enter `*.prod.zpath.net`.
271295
1. Select **Save**.
272296
273
−### Zscaler Private Access
297
+### Configure Zscaler Private Access
274298
275
−Perform the procedure in the Zscaler portal:
299
+Complete the following steps in the Zscaler portal:
276300
- Set up and configure Zscaler Private Access.
277301
- Create a forwarding profile.
278302
- Create an app profile.
279303
- Install the Zscaler Client Connector.
280304
305
+#### Add a forwarding profile
306
+
281307
Add Forwarding Profile from the Client Connector Portal:
282308
1. Navigate to the **Zscaler Client Connector admin portal** > **Administration** > **Forwarding Profile** > **Add Forwarding Profile**.
283309
1. Add a **Profile Name** such as `ZPA Only`.
⋯ 2 unchanged lines
286312
1. Scroll down to **Forwarding profile action for ZPA**.
287313
1. Select Tunnel for all options in this section.
288314
315
+#### Add an app profile
316
+
289317
Add App Profile from the Client Connector Portal:
290318
1. Navigate to **Zscaler Client Connector admin portal** > **App Profiles** > **Windows (or macOS)** > **Add Windows Policy (or macOS)**.
291319
1. Add **Name**, set **Rule Order** such as **1**, select **Enable**, select **User(s)** to apply this policy, and select the **Forwarding Profile**. For example, select **ZPA Only**.
292320
1. Scroll down and add the Microsoft SSE service Internet Protocol (IP) addresses and Fully Qualified Domain Names (FQDNs) in the [Global Secure Access service FQDNs and IPs bypasses section](#global-secure-access-service-fqdns-and-ips-bypasses), to “**HOSTNAME OR IP ADDRESS BYPASS FOR VPN GATEWAY**” field.
293321
322
+#### Verify client configurations
323
+
294324
Open the system tray to check that Global Secure Access and Zscaler clients are enabled.
295325
296326
Verify configurations for clients:
⋯ 6 unchanged lines
303333
304334
> [!NOTE]
305335
> For information troubleshooting health check failures, see [Troubleshoot the Global Secure Access client diagnostics - Health check](troubleshoot-global-secure-access-client-diagnostics-health-check.md).
336
+
337
+#### Test traffic flow
306338
307339
Test traffic flow:
308340
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
⋯ 7 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.