GSA coexistence with Zscaler

This page's changes and edits · All guidance changes

Microsoft's edit · 27 May 01:15 UTC

AI Readiness Phase B: high-confidence structure fixes across 10 files

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 872a549 · +10 ~~−10~~ lines · also on GitHub

⋯ 2 unchanged lines

33 description: "Learn how to deploy Microsoft Global Secure Access alongside Zscaler Private Access and Internet Access. Covers four integration scenarios with step-by-step configuration, verification, and traffic testing procedures."

44 #customer intent: As a network administrator, I want to configure Microsoft and Zscaler SSE for unified SASE solutions so that I can enhance security and connectivity in my organization.

55 ms.topic: how-to

6 −ms.date: 03/25/2026

6 +ms.date: 05/26/2026

77 ms.subservice: entra-private-access

88 ms.reviewer: shkhalid

99 ai-usage: ai-assisted

⋯ 20 unchanged lines

3030 In this scenario, both clients handle traffic for separate private applications. Global Secure Access handles private applications in Microsoft Entra Private Access. Private applications in Zscaler use the Zscaler Private Access module. Zscaler Internet Access handles Internet traffic.

3131

3232

33 −3. [**Microsoft Entra Microsoft Access with Zscaler Private Access and Zscaler Internet Access**](#microsoft-entra-microsoft-access-with-zscaler-private-access-and-zscaler-internet-access)

33 +3. [**Microsoft traffic with Zscaler Private Access and Zscaler Internet Access**](#microsoft-traffic-with-zscaler-private-access-and-zscaler-internet-access)

3434

3535 In this scenario, Global Secure Access handles all Microsoft 365 traffic. Zscaler Private Access handles Private application traffic and Zscaler Internet Access handles Internet traffic.

3636

37 −4. [**Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Zscaler Private Access**](#microsoft-entra-internet-access-and-microsoft-entra-microsoft-access-and-with-zscaler-private-access)

37 +4. [**Microsoft Entra Internet Access and Microsoft traffic with Zscaler Private Access**](#microsoft-entra-internet-access-and-microsoft-traffic-with-zscaler-private-access)

3838

3939 In this scenario, Global Secure Access handles Internet and Microsoft 365 traffic. Zscaler only captures Private application traffic. Therefore, the Zscaler Internet Access module is disabled from the Zscaler portal.

4040

⋯ 169 unchanged lines

210210 1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.

211211 1. Scroll to confirm the Global Secure Access client handled private application traffic for the SMB file share and didn't handle the RDP session traffic.

212212

213 −## Microsoft Entra Microsoft Access with Zscaler Private Access and Zscaler Internet Access

213 +## Microsoft traffic with Zscaler Private Access and Zscaler Internet Access

214214

215215 In this scenario, Global Secure Access handles all Microsoft 365 traffic. Zscaler Private Access handles Private application traffic and Zscaler Internet Access handles Internet traffic.

216216

217 −### Configure Microsoft Entra Microsoft Access

217 +### Configure Microsoft traffic

218218

219 −To configure Microsoft Entra Microsoft Access for this scenario:

220 −- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile).

219 +To configure Microsoft traffic for this scenario:

220 +- [Enable Microsoft traffic forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile).

221221 - Install and configure the [Global Secure Access client for Windows](how-to-install-windows-client.md) or [macOS](how-to-install-macos-client.md).

222222

223223 ### Configure Zscaler Private Access and Internet Access

⋯ 62 unchanged lines

286286 1. You can also validate that the traffic is captured in the Global Secure Access traffic logs. In the Microsoft Entra admin center, navigate to **Global Secure Access** > **Monitor** > **Traffic logs**.

287287 1. Validate traffic related to Outlook Online and SharePoint Online is missing from Zscaler Internet Access logs in **Analytics** > **Web Insights** > **Logs**.

288288

289 −## Microsoft Entra Internet Access and Microsoft Entra Microsoft Access and with Zscaler Private Access

289 +## Microsoft Entra Internet Access and Microsoft traffic with Zscaler Private Access

290290

291291 In this scenario, Global Secure Access handles Internet and Microsoft 365 traffic. Zscaler only captures private application traffic. Therefore, the Zscaler Internet Access module is disabled from the Zscaler portal.

292292

293 −### Configure Microsoft Entra Internet and Microsoft Access

293 +### Configure Microsoft Entra Internet Access and Microsoft traffic

294294

295295 For this scenario, you need to configure:

296 −- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).

296 +- [Enable Microsoft traffic forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).

297297 - Install and configure the [Global Secure Access client for Windows](how-to-install-windows-client.md) or [macOS](how-to-install-macos-client.md).

298298 - Add an [Microsoft Entra Internet Access traffic forwarding profile policy custom bypass](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#internet-access-traffic-forwarding-profile-policies) to exclude ZPA service.

299299

⋯ 57 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.