Release Upgrade Summary (2024)

Idle Connection Timeout Update for Timeout Policy Rules

Tue, 31 Dec 2024 08:00:00 GMT

The timeout for an open TCP session was updated from Never to 2 hours when Default is selected for the Idle Connection Timeout setting in a timeout policy rule.

To learn more, see Configuring Timeout Policies.

Active Directory Controls

Wed, 18 Dec 2024 08:00:00 GMT

Private Access provides Active Directory as an AppProtection Control option. Private Access also provides Active Directory Protection inspection for protocol traffic (Kerberos, SMB, and LDAP). You can enable Active Directory Protection when configuring an application segment. After an Active Directory control is created, you can add it to an AppProtection profile. You can view the suspicious activity, errors, and violations on the Active Directory Dashboard page.

To learn more, see About Active Directory Controls, Viewing the Active Directory Protection Dashboard, Understanding Kerberos Inspection Logs, Understanding LDAP Inspection Logs, and Understanding SMB Inspection Logs.

Language Translation in Isolation for ZPA

Wed, 18 Dec 2024 08:00:00 GMT

Users can translate web pages into different languages while in an isolated session through Google Translate. They can translate the content of an entire page, or they can select specific text from the page to translate. For the duration of the session, users can click the Translate icon in the isolation bar menu or use the right-click menu to access the translation options. The default selected language depends on the user's region. This function can be enabled by admins per isolation profile. Google Translate is being used to power the translation within the application that is being isolated, and Zscaler uses Google Translate APIs in order to provide the translation service.

See image.

To learn more, see Creating Isolation Profiles for ZPA and Using the Isolation Bar in Native Browser Experience.

Active Directory Controls

Tue, 17 Dec 2024 08:00:00 GMT

ZPA provides Active Directory as an AppProtection Control option. ZPA also provides Active Directory Protection inspection for protocol traffic (Kerberos, SMB, and LDAP). You can enable Active Directory Protection when configuring an application segment. After an Active Directory control is created, you can add it to an AppProtection profile. You can view the suspicious activity, errors, and violations on the Active Directory Dashboard page.

To learn more, see About Active Directory Controls and Viewing the Active Directory Protection Dashboard.

STIG Platform Image Support on Microsoft Azure

Tue, 17 Dec 2024 08:00:00 GMT

A new Red Hat Enterprise Linux 9 App Connector image that supports Security Technical Implementation Guide (STIG) is available for Microsoft Azure.

To learn more, see App Connector Software by Platform.

Passwords for STIG-hardened images automatically expire after 60 days. If the password expires without disabling or changing its expiration, admin access to the App Connector becomes unavailable. When admin access expires, the only recovery method is to deploy a new App Connector.

To learn how to disable password expiration for STIG-hardened images, see Disabling Password Expiration for STIG-Hardened App Connector Images.

STIG Platform Image Support on Nutanix and VMware

Mon, 16 Dec 2024 08:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images that support Security Technical Implementation Guide (STIG) are available for Nutanix and VMware.

To learn more, see App Connector Software by Platform and ZPA Private Service Edge Software by Platform.

Passwords for STIG-hardened images automatically expire after 95 days (60 days + a 35-day grace period). If the password expires without disabling or changing its expiration, admin access to an App Connector or ZPA Private Service Edge becomes unavailable. When admin access expires, the only recovery method is to deploy a new App Connector or Private Service Edge.

To learn how to disable password expiration for STIG-hardened images, see Disabling Password Expiration for STIG-Hardened App Connector Images or Disabling Password Expiration for STIG-Hardened ZPA Private Service Edge Images.

Understanding Persistent State for Isolation in ZPA

Mon, 16 Dec 2024 08:00:00 GMT

Persistent State allows users to have isolation sessions automatically restored with current state data when they time out. Admins can allow this feature per user profile by enabling Cookie Persistence.

To learn more, see Creating Isolation Profiles for ZPA.

File Size Limit Increase in Isolation for PDFTron

Thu, 05 Dec 2024 08:00:00 GMT

The file size limit for viewing files in Isolation while using PDFTron is 100 MB. A strong internet connection is ideal for maximum rendering performance while using PDFTron. To learn more, see Transferring & Viewing Files in Isolation.

Primary Domain Updates

Wed, 04 Dec 2024 08:00:00 GMT

An update was released for default primary domains to include the cloud name. The new format for primary domains is -.zpa-customer.com. This applies to primary domains created after December 4, 2024.

Manager Software Updates

Mon, 02 Dec 2024 08:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9.x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. The Manager software version is 24.650.5. To learn more, see Understanding the Manager Software.

Minimum Version Control for App Connectors and ZPA Private Service Edges

Mon, 02 Dec 2024 08:00:00 GMT

An update was released to support the version check and automated upgrades of App Connectors version 24.650.5 and ZPA Private Service Edges version 24.650.5 and later during the initial connection.

To learn more, refer to the Zscaler Trust Portal.

STIG Platform Image Support

Tue, 26 Nov 2024 08:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images that support Security Technical Implementation Guide (STIG) are available for the following platforms:

Amazon Web Services (AWS)
Google Cloud Platform (GCP)

To learn more, see App Connector Software by Platform and ZPA Private Service Edge Software by Platform.

Passwords for STIG-hardened images automatically expire after 60 days. If the password expires without disabling or changing its expiration, admin access to an App Connector or ZPA Private Service Edge becomes unavailable. When admin access expires, the only recovery method is to deploy a new App Connector or ZPA Private Service Edge.

To learn how to disable password expiration for STIG-hardened images, see Disabling Password Expiration for STIG-Hardened App Connector Images or Disabling Password Expiration for STIG-Hardened ZPA Private Service Edge Images.

Updates to the PRA Portal and Privileged Consoles

Tue, 19 Nov 2024 08:00:00 GMT

When you click the Settings icon in a Privileged Remote Access (PRA) Portal, you can select a keyboard language, display resolution, display quality, and time zone for the privileged consoles assigned to that privileged portal. The display resolution Fit to Bounds is the default option, and the display quality High option is for Windows.

See image.

After you sign in to a privileged console, you can view a collapsible menu that includes the favicon, name of the privileged console, Recording icon, Participants icon, Keyboard icon, Full Screen icon, Copy icon, and Clipboard icon. The menu also includes the length of time the privileged console is active, and an End option to end the live session for that privileged console.

See image.

Enterprise RealVNC Connectivity in Privileged Remote Access (PRA)

Thu, 14 Nov 2024 08:00:00 GMT

ZPA provides the ability to configure Enterprise RealVNC targets as privileged consoles in PRA. Unlike the existing RFB-compliant VNC protocol, this uses a proprietary RealVNC protocol to provide end-to-end encryption as well as support for Enterprise username and password credentials.

To learn more, see Configuring Defined Application Segments and Configuring Privileged Consoles.

Active Apps in App Connector Details

Fri, 08 Nov 2024 08:00:00 GMT

The App Connector details for Active Apps in the Health dashboard has been updated to reflect data in the Application Reachability graph.

See image.

To learn more, see About the Health Dashboard.

Privileged Remote Access (PRA) File Transfer System

Thu, 31 Oct 2024 07:00:00 GMT

The PRA File Transfer System feature in the PRA Portal allows a user to upload files on the My Files page of a PRA Portal. An admin can assign portals policy rules to enable a user to delete uploaded files, and enable file scanning using the Zscaler Internet Access (ZIA) cloud Sandbox. This feature is only available with a license. Contact your Zscaler Account team for more information.

To learn more, see About the PRA File Transfer System and About Portals Policy.

Access Policy Updates for Require Approval

Wed, 30 Oct 2024 07:00:00 GMT

The Require Approval rule action has been replaced by the Conditional Access rule action. This rule action provides access to sensitive resources. Privileged approvals for Privileged Remote Access (PRA) require using the Conditional Access rule action with the Allow with Privileged Approval checkbox selected when configuring an access policy.

See image.

To learn more, see Configuring Access Policies.

App Connector Selection Method Updates

Wed, 30 Oct 2024 07:00:00 GMT

The App Connector Selection Method feature has moved to the Traffic Steering section in the Add Access Policy and Edit Access Policy windows when configuring an access policy. There are no changes to the existing functionality.

See image.

To learn more, see Configuring Access Policies and Editing Access Policies.

Workload Groups for Access Policy

Mon, 28 Oct 2024 07:00:00 GMT

You can select Workload Groups as a criteria for access policy. Workload groups allow you to apply security policies for your cloud workloads that are deployed on a public cloud service provider.

See image.

Contact Zscaler Support to enable this feature for your organization.

To learn more, see About Workload Groups and About Access Policy.

Manager Software Updates

Fri, 25 Oct 2024 07:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. To learn more, see Understanding the Manager Software.

Kubernetes Support for App Connector

Tue, 22 Oct 2024 07:00:00 GMT

Kubernetes support for App Connector is now available.

To learn more, see App Connector Deployment Guide for Kubernetes and ZPA App Connector Software by Platform.

Visual Differentiation for Isolated Web Pages

Thu, 17 Oct 2024 07:00:00 GMT

To make sure users can differentiate between isolated and non-isolated browsers, the following updates have been made:

An isolated web page displays a blue rectangular border surrounding it to indicate that it's in Isolation.
The favicon, or the image that represents the web page in the tab header, displays a blue rectangular border surrounding it to indicate that the tab holds an isolated web page.
Prefixing the isolated tab name is either a lock icon "🔒" when on a supported browser or a pound sign "#" when on an unsupported browser.

See image.

Turbo Mode for Isolation with ZPA

Mon, 14 Oct 2024 07:00:00 GMT

Turbo mode for Isolation leverages the GPU on the user's machine, capturing the rendering instructions from an isolated web page and replaying them in the user's browser window. This method of rendering content is faster and uses less bandwidth than pixel streaming. You can enable this feature per isolation profile.

See image.

To learn more, see Using Turbo Mode for Isolation and Creating Isolation Profiles for ZPA.

Resolved Issues

Wed, 09 Oct 2024 07:00:00 GMT

A fix was released to address an issue where the Move action appeared for applications when a Microtenant wasn't available.

To learn more, see Moving Resources from a Microtenant and About Applications.

Manager Software Updates

Thu, 26 Sep 2024 07:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. To learn more, see Understanding the Manager Software.

Introducing Zscaler Microsegmentation

Fri, 20 Sep 2024 07:00:00 GMT

Zscaler Microsegmentation is a host-based segmentation solution that extends ZPA to perform granular segmentation of private applications. This solution also enables administrators to visualize private application inventory and flows within the ZPA Admin Portal.

It is a multi-tenant software-as-a-service where the Zscaler cloud and agents work together to collect and analyze application flow and telemetry data as well as monitor system health.

If you want Microsegmentation provisioned for your organization, contact the Zscaler Account team.

See image.

To learn more, see What Is Microsegmentation?

Google Cloud Platform Image Support

Wed, 11 Sep 2024 07:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images are available for Google Cloud Platform (GCP).

To learn more, see App Connector Software by Platform and ZPA Private Service Edge Software by Platform.

Max Age for Authentication Disaster Recovery Improvements

Fri, 06 Sep 2024 07:00:00 GMT

An update was released to support a maximum value of up to 380 days for the Max Age for Authentication field on the Disaster Recovery Settings page.

To learn more, see About Disaster Recovery Settings.

ZPA Admin Account Update

Fri, 06 Sep 2024 07:00:00 GMT

The Account section of the ZPA Admin Portal has been updated so the user can update the language, time zone, and password for their ZPA Admin Portal account. They can also view their username and customer ID.

See image.

To learn more, see Accessing and Navigating the ZPA Admin Portal.

ZPA API Improvements for Segment Group

Tue, 03 Sep 2024 07:00:00 GMT

A new endpoint to update a segment group is available in the ZPA API Portal.

To learn more, see Configuring Segment Groups Using API and Segment Group Controller Reference Guide.

SAML and SCIM Attributes in Redirection Policy

Mon, 26 Aug 2024 07:00:00 GMT

ZPA redirection policy rules allow you to set criteria for preferring ZPA Private Service Edges over ZPA Public Service Edges based on SAML and SCIM attributes. You can also set this criteria via the ZPA cloud service API.

To learn more, see About Redirection Policy, Configuring Redirection Policies, and Configuring Redirection Policies Using API.

Protocol Discovery

Wed, 21 Aug 2024 07:00:00 GMT

When configuring an application segment, you can enable the Dynamic protocol which allows the application segment and its configured domains, ports, and protocols to be inspected. To use this feature, you need to generate an AppProtection enrollment (CA) certificate. After you have enabled the Dynamic protocol, you can select to inspect the application segment on the Protocol Discovery Dashboard and view the analytics on the Protocol Discovery Diagnostics page.

To learn more, see Configuring Defined Application Segments, Viewing the Protocol Discovery Dashboard, and Accessing Protocol Discovery Diagnostics.

Server-Validated Client Certificate for Posture Validation

Thu, 15 Aug 2024 07:00:00 GMT

An update was released to support server-validated client certificate for posture validation. Contact your Zscaler Account team to enable this feature for your organization.

To learn more, see Configuring Device Posture Profiles.

Manager Software Updates

Mon, 12 Aug 2024 07:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. To learn more, see Understanding the Manager Software.

OWASP Predefined Controls Update

Tue, 06 Aug 2024 07:00:00 GMT

The OWASP predefined controls have been updated to support version OWASP_CRS/3.3.5. By default, the version is set to OWASP_CRS/3.3.5 on the OWASP Predefined Controls page and the AppProtection Profiles page. The OWASP_CRS/3.3.5 version is supported on App Connector version 23.313.1 and later.

To learn more, see About AppProtection Controls.

API Protection

Mon, 05 Aug 2024 07:00:00 GMT

ZPA provides API Protection controls that allow you to designate application segments for API traffic inspection. After you have assigned application segments with API Protection, you can view the results for API transactions and violations in the API Protection Dashboard page and API Protection Diagnostics page.

Contact Zscaler Support to enable this feature for your organization.

To learn more, see About API Protection Controls, Configuring Defined Application Segments, Configuring AppProtection Profiles, Viewing the API Protection Dashboard, and Accessing API Protection Diagnostics.

Customer Support URL Resource Type Update

Thu, 01 Aug 2024 07:00:00 GMT

An update was released that changed the Customer Support URL Resource Type to Admin Configurations in the Audit Logs.

To learn more, see About Audit Logs.

International Keyboard Support for Privileged Remote Access

Wed, 31 Jul 2024 07:00:00 GMT

If you are using a privileged console with an RDP protocol for Privileged Remote Access (PRA), you can select French, German, and Spanish languages for the keyboard. English is the default language.

Additional Print Options in Isolation for ZPA

Tue, 30 Jul 2024 07:00:00 GMT

More options are available for printing web pages and documents in Isolation.

To learn more, see Transferring and Viewing Files in Isolation.

Privileged Session Control and Monitoring

Mon, 29 Jul 2024 07:00:00 GMT

The host of a live privileged session for Privileged Remote Access (PRA) can invite other users to attend and monitor the session. When an invited user is given control of a live privileged session, they receive mouse and keyboard control of the session. The original host of the live privileged session can regain control of the session at any time. During the session, the host can invite other participants or eject current participants, or disconnect the session which terminates the session for all participants.

To learn more, see Configuring Privileged Capabilities Policies and Accessing a Privileged Remote Access Portal.

User Risk Score Enhancements

Tue, 09 Jul 2024 07:00:00 GMT

An enhancement was released to let clients remain connected to ZPA Private Service Edges when the user risk feature is enabled or disabled at the admin level.

AWS and Azure Image Updates

Mon, 01 Jul 2024 07:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector images are available for AWS EC2 and Microsoft Azure. New ZPA Private Service Edge images are available in AWS EC2.

To learn more, see the App Connector Deployment Guides for AWS and Azure, and the ZPA Private Service Edge Deployment Guides for AWS.

Application Deep Linking for Isolation in ZPA

Thu, 27 Jun 2024 07:00:00 GMT

Zscaler Isolation supports the ability for ZPA users to invoke a client application from the user's end machine via an isolated session. When a user clicks on a deep link within an isolated web page, the client application is invoked on the end user's machine. Admins can enable this feature per isolation profile, and can specify the URL scheme associated with the invoked client application. This provides the organization granular control over which client applications users can invoke from the isolated web pages.

If this feature is disabled for the isolation profile, or an application invoked by the user is not added to the application list in the isolation profile, the user sees an error message explaining that the application isn't allowed by policy.

To learn more, see Creating Isolation Profiles for ZPA.

Updated ZPA Login Screen

Tue, 25 Jun 2024 07:00:00 GMT

The ZPA Admin Portal login screen has been updated. All users see the same login screen. The steps that follow vary based on your setup and access.

See image.

To learn more, see Accessing and Navigating the ZPA Admin Portal.

Docker Hub Image Updates

Mon, 24 Jun 2024 07:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector images are available for Docker. New ZPA Private Service Edge images are available in Docker.

To learn more, see the App Connector Deployment Guides for Docker, and the ZPA Private Service Edge Deployment Guides for Docker.

KVM Image Support

Mon, 24 Jun 2024 07:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images are available in the KVM qcow2 format to support Equinix Network Edge.

To learn more, see ZPA App Connector Software by Platform and ZPA Private Service Edge Software by Platform.

Manager Software Updates

Thu, 20 Jun 2024 07:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. To learn more, see Understanding the Manager Software.

MITRE ATT&CK Framework for AppProtection

Wed, 19 Jun 2024 07:00:00 GMT

You can analyze your organization's risk with the MITRE ATT&CK framework, a cybersecurity framework funded by the government that is used to detect, identify, and classify various tactics, techniques, and procedures (TTPs) used for cyber attacks by attackers. The MITRE ATT&CK page (Insights > MITRE ATT&CK) helps you assess your organization's security posture and calculate the risk of a cyber attack.

See image.

To learn more, see Analyzing Risk with MITRE ATT&CK for AppProtection.

Privileged Remote Access Privileged Session Playback

Thu, 06 Jun 2024 07:00:00 GMT

ZPA allows you to transcode privileged session recordings from a raw format to a streamable format. After a privileged session is transcoded, a user can stream it from the Privileged Sessions page. When configuring an administrator role, you can select session recordings to have full access, which allows you to download privileged session recordings from the Privileged Sessions page.

To learn more, see Accessing Privileged Sessions and Configuring Administrator Roles.

VMware Image Updates

Wed, 05 Jun 2024 07:00:00 GMT

New Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images are available for VMware.

To learn more, see App Connector Deployment Guide for VMware Platforms, App Connector Deployment Guide for Nutanix AHV, and ZPA Private Service Edge Deployment Guide for VMware Platforms.

Manager Software Updates

Tue, 04 Jun 2024 07:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. To learn more, see Understanding the Manager Software.

Red Hat Enterprise Linux 9 Support

Tue, 04 Jun 2024 07:00:00 GMT

New App Connector and ZPA Private Service Edge RPM packages are available to provide support for Red Hat Enterprise Linux 9 (RHEL 9). These RPM packages can only be deployed on Red Hat Enterprise Linux 9 platforms.

To learn more about migrating App Connectors and ZPA Private Service Edges to RHEL 9, see App Connector Red Hat Enterprise Linux 9 Migration and ZPA Private Service Edge Red Hat Enterprise Linux 9 Migration.

Public Service Edge Proximity Improvements

Mon, 03 Jun 2024 07:00:00 GMT

The Public Service Edge Proximity Override feature has been improved to consider all ZPA Private Service Edge groups and their proximity override configuration before redirecting users to the ZPA Private Service Edges.

To learn more, see Configuring ZPA Private Service Edge Groups.

Permission Group Validations for Custom Roles

Fri, 31 May 2024 07:00:00 GMT

An update was released that adds validations for missing permissions of custom roles in the Roles page of the ZPA Admin Portal, and in groups when configuring or editing a custom role.

To learn more, see About Roles and Configuring Administrator Roles.

ZPA Integration with ZIdentity Enhancements

Tue, 28 May 2024 07:00:00 GMT

For tenants subscribed to ZIdentity for users, the following enhancements were made to support the ZPA integration with ZIdentity:

The IdP Configuration page is read-only, and the Add IdP Configuration action is hidden. To learn more, see About IdP Configuration.
The SAML Attributes page is replaced by the Session Attributes page. The Add SAML Attributes, Edit, and Delete actions are hidden. To learn more, see About SAML Attributes.
The SAML and SCIM Attributes criteria are replaced with Session and User Attributes when configuring policy rules. To learn more, see Policies.
The SAML and SCIM Attributes options are replaced with Session and Group Attributes when defining a streaming policy on your log receiver. To learn more, see Configuring a Log Receiver.
The SAML Attributes field is replaced with Session Attributes in the user activity diagnostics logs. To learn more, see Accessing User Activity Diagnostics.
The SAML Attribute and SCIM Attribute resource types are replaced with the Session Attribute and User Attribute resource types in the Audit Logs. To learn more, see About Audit Logs.

User Risk Scores Enhancements

Thu, 16 May 2024 07:00:00 GMT

The following enhancements were made to user risk scores:

The ability to filter by IdP Name is supported on the User Risk Scores page of the ZPA Admin Portal.
User risk scores associated to an IdP are automatically deleted if the IdP was deleted.

To learn more, see About User Risk Scores and About IdP Configuration.

User Risk Scores Resource Type in Audit Logs

Thu, 16 May 2024 07:00:00 GMT

A new resource type for User Risk Scores was added to the Audit Logs page of the ZPA Admin Portal.

See image.

To learn more, see About Audit Logs.

CNAME Filter Available in User Status Diagnostics

Mon, 13 May 2024 07:00:00 GMT

An update was made that lets customers filter the user status by CNAME.

To learn more, see Viewing User Status Diagnostics.

Inspect ZPA Traffic with ZIA Security Services

Mon, 13 May 2024 07:00:00 GMT

Updates to ZPA and Zscaler Internet Access (ZIA) to inspect the private application traffic of a ZPA application segment include the addition of:

Optimized traffic flow from ZPA to ZIA security services including:
- TLS inspection
- Firewall Control
- Malware protection
- Advanced Threat Protection (ATP)
- URL Filtering & Cloud App Control Policy
- File Type Control
- Firewall Control
- IPS Control
- Data Protection for download
A ZIA Inspection client type filter in the ZPA User Status Diagnostics page.
ZIA Inspection filters for enablement status and transaction type in the ZPA User Activity Diagnostics page.
Session status codes for ZIA inspection.

To learn more, see Viewing User Status Diagnostics, Accessing User Activity Diagnostics, Understanding ZPA Session Status Codes, Configuring Defined Application Segments, and Configuring Forwarding Policy.

Updates to App Connector Status Diagnostics

Wed, 08 May 2024 07:00:00 GMT

The App Connector Status Diagnostics page includes a new field: App Connector Restart Reason.

To learn more, see Accessing App Connector Status Diagnostics.

Increased Privileged Consoles Limit

Thu, 02 May 2024 07:00:00 GMT

The maximum number of privileged consoles available in an account has increased to 35,000. Each Microtenant can contain up to 6,000 privileged consoles.

You need licenses to access this increased limit. Contact your account manager for more information.

To learn more, see Ranges & Limitations.

Updates to the PRA Portal

Thu, 02 May 2024 07:00:00 GMT

The Privileged Remote Access (PRA) Portal has a search bar designated for each section: Microtenants, Shared Sessions, and My Consoles. You can also filter and paginate the displayed privileged consoles.

To learn more, see Accessing a Privileged Remote Access Portal.

Events and Notifications Enhancements

Tue, 30 Apr 2024 07:00:00 GMT

The following enhancements were made to the events and notifications feature:

An update was released that provides support for ZPA Private Service Edges when configuring the Bandwidth Utilization Exceeded Limit event. The threshold limit for this event was also decreased from 350 Mbps to 250 Mbps.
An update was released that changed the labels for the SYSTEM_CONTROL_DISCONNECTED and SYSTEM_RESOURCE_CPU_STARVATION events to Control Connection Disconnected and CPU Starvation. These events are now supported in the ZPA Admin Portal when configuring notifications.

To learn more, see Configuring Notifications and Viewing and Managing Events and Notifications.

Ranges & Limitations Update

Fri, 19 Apr 2024 07:00:00 GMT

The ZPA limits for intelligent segmentation tiers have been updated. The tiers show the different ML run frequencies based on the organization's SKU for ZPA.

To learn more, see Ranges & Limitations.

Updated Filters for App Connectors and ZPA Private Service Edges

Tue, 16 Apr 2024 07:00:00 GMT

There are new filters for the App Connectors and ZPA Private Service Edges pages: Current Software Version, ID, Manager Version, and Upgrade Status. The total number of App Connectors or ZPA Private Service Edges and the amount currently displayed on the page is at the bottom of the table.

Debug Mode for Isolation in Zscaler Private Access (ZPA)

Mon, 15 Apr 2024 07:00:00 GMT

Admins can enable debug mode for isolation profiles, which allows the user to record and gather troubleshooting data for any isolation sessions they create. The recorded session generates diagnostics for basic session information, HTTP Archive format files, console logs, and network logs exported from the web browser.

See image.

To learn more, see Using Debug Mode for Isolation.

Assistant to Connector in the ZPA API

Tue, 09 Apr 2024 07:00:00 GMT

An update was released that changed the labels from assistant to connector for the following endpoints in the ZPA cloud service API:

GET /mgmtconfig/v1/admin/customers/{customerId}/assistantSchedule
POST /mgmtconfig/v1/admin/customers/{customerId}/assistantSchedule
PUT /mgmtconfig/v1/admin/customers/{customerId}/assistantSchedule/{id}

To learn more, see Configuring Auto Delete for Disconnected App Connectors Using API and the App Connector Controller.

Automated Software Updates

Mon, 01 Apr 2024 07:00:00 GMT

An update was released to enhance the automated software update mechanism for App Connectors and ZPA Private Service Edges. Failed component updates will be retried in each periodic software update until all App Connectors and ZPA Private Service Edges are upgraded.

To learn more, see Understanding App Connector Software Upgrades and Understanding ZPA Private Service Edge Software Upgrades.

Support for Title SCIM Attribute

Mon, 01 Apr 2024 07:00:00 GMT

An update was released that provides support for the Title SCIM Attribute for existing IdPs in the ZPA Admin Portal. As part of support for this functionality across ZPA, the Zscaler Operations team will perform a one-time update to the ZPA database that results in an Audit Log corresponding to the Admin ID showing [user]@root.zscaler.com. Admin audit log records are available to review in an organization’s tenant under Configuration & Control > Administration Control > Audit Logs.

To learn more, see About SCIM and About Audit Logs.

Internationalization

Thu, 28 Mar 2024 07:00:00 GMT

The ZPA Admin Portal supports the following languages, which you can select when signing into the portal: English, Spanish, French, German, Chinese, and Japanese.

To learn more, see Accessing and Navigating the ZPA Admin Portal.

AppProtection UI Wizard

Tue, 26 Mar 2024 07:00:00 GMT

You can create a dynamic rule for an AppProtection profile to inspect the traffic of domains assigned to that AppProtection profile.

To learn more, see Configuring AppProtection Dynamic Rules.

Automatic Certificate Generation

Tue, 26 Mar 2024 07:00:00 GMT

You can enable AppProtection to inspect the traffic for an application segment with AppProtection. You can then select an AppProtection enrollment (CA) certificate to enroll AppProtection-enabled application segments. You can view the data for AppProtection-enabled application segment events on the Application Protocol Diagnostics page.

To learn more, see Configuring Defined Application Segments, Generating Zscaler-Issued Enrollment (CA) Certificates, and Accessing Application Protocol Diagnostics.

Update to the Use Untrusted Certificate Option

Tue, 26 Mar 2024 07:00:00 GMT

When you are adding an application segment and you enable both Auto AppProtection and Browser Access, and if you are using an untrusted certificate, you must select Use Untrusted Certificates to access the related domain.

To learn more, Configuring Defined Application Segments.

ZPA API Improvements for Automatic Certificate Generation

Tue, 26 Mar 2024 07:00:00 GMT

The field autoAppProtectEnabled was added to the ZPA cloud service API to indicate if the application segment's traffic is inspected by AppProtection.

To learn more, see Configuring Application Segments Using API.

Alternative Cloud Domain

Mon, 18 Mar 2024 07:00:00 GMT

ZPA provides the option to select an Alternative Cloud Domain that can override the default cloud domain for a ZPA Private Service Edge group. If deployed, the minimum required ZPA Private Service Edge version is 23.191.2 or later, the minimum required ZPA Public Service Edge version is 23.191.2 or later, and the minimum required App Connector version is 23.191.4 or later.

To learn more, see Configuring ZPA Private Service Edges.

Update to Only Forward Allowed Applications Rule Action

Mon, 18 Mar 2024 07:00:00 GMT

An update was released for ZPA Public Service Edges that allows users to use the Only Forward Allowed Applications rule action with Cloud Connector client types.

To learn more, see Configuring Client Forwarding Policies.

Version Profile Update for Previous Default

Mon, 11 Mar 2024 07:00:00 GMT

The Previous Default version profile option for App Connector Groups and ZPA Private Service Edge Groups was changed to a weekly update instead of daily. The version profile is configurable when setting up an App Connector Group or a ZPA Private Service Edge Group, and it includes designating a day and time each week when updates are scheduled to occur.

To learn more, see Configuring App Connectors, Configuring ZPA Private Service Edges, and Configuring a Version Profile.

App Connector Group Limits for Access Policies

Mon, 04 Mar 2024 08:00:00 GMT

An update was released that restricts the selection count of App Connector groups to 48 when configuring an access policy. This limit applies to new or edited policy rules after March 4, 2024.

To learn more, see Configuring Access Policies and Ranges & Limitations.

Viewable Client and ZPA Private/Public Service Edge Traffic

Mon, 04 Mar 2024 08:00:00 GMT

An update was released that makes traffic between clients and ZPA Private Service Edges or ZPA Public Service Edges, and traffic between ZPA Private Service Edges and ZPA Public Service Edges, viewable in diagnostics for user status.

To learn more, see Viewing User Status Diagnostics.

Manager Software Updates

Thu, 29 Feb 2024 08:00:00 GMT

A recommended update was released that includes updated App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x and 8.x.

You can download the Manager Software for App Connectors or ZPA Private Service Edges from our repository. To learn more, see Understanding the Manager Software.

Microtenant Support for Privileged Remote Access

Wed, 28 Feb 2024 08:00:00 GMT

Role-based administration control via a Microtenant is supported for Privileged Remote Access (PRA). Additionally, the ability to enable approval-based access without an authentication domain is available when adding a Microtenant.

See image.

Contact Zscaler Support to enable this feature for your organization.

To learn more, see About Microtenants, Configuring Microtenants, Moving Resources from a Microtenant, and Privileged Remote Access Management.

Privileged Remote Access API

Wed, 28 Feb 2024 08:00:00 GMT

ZPA supports customer-facing APIs for managing privileged portals, privileged approvals, privileged consoles, privileged credentials, privileged policies, and emergency access users.

To learn more, see Understanding ZPA API, Configuring Privileged Portals Using API, Configuring Privileged Approvals Using API, Configuring Privileged Consoles Using API, Configuring Privileged Credentials Using API, Configuring Privileged Policies Using API, Configuring Emergency Access Users Using API, and the API Developer & Reference Guide.

SRA to PRA in the ZPA API

Wed, 28 Feb 2024 08:00:00 GMT

An update was released that changed the labels from SRA to PRA in the ZPA cloud service API.

To learn more, see the API Developer & Reference Guide.

ZPA API Improvements to the Policy Set Controller

Wed, 28 Feb 2024 08:00:00 GMT

The following new endpoints to create and update a policy rule are exposed in the policy set controller for the ZPA cloud service API:

POST /mgmtconfig/v2/admin/customers/{customerId}/policySet/{policySetId}/rule
PUT /mgmtconfig/v2/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}

To learn more, see the API Developer and Reference Guide and the Policy Set Controller.

ZPA Private Service Edge Deployment on Docker

Tue, 27 Feb 2024 08:00:00 GMT

ZPA Private Service Edge deployments on Docker platforms are available. To learn more, see the Private Service Edge Deployment Guide for Docker.

External Device ID

Tue, 20 Feb 2024 08:00:00 GMT

The identifier that associates an external MDM device ID with devices in the Zscaler Client Connector Portal is available in ZPA User Status Diagnostics and Live Logs.

To learn more, see Viewing User Status Diagnostics and About Live Logs.

Role-Based Administration Control Enhancements

Tue, 20 Feb 2024 08:00:00 GMT

The following enhancements were made to role-based administration control:

Dashboards, Support Information, and events and notifications are supported within a Microtenant.
The ability to filter requests by the Microtenant that belongs to the application segment, or by the Microtenant that the application segment has been shared to, is available in the User Activity Diagnostics and Live Logs.

Contact Zscaler Support to enable this feature for your organization.

To learn more, see About Microtenants, Accessing User Activity Diagnostics, About Live Logs, and About Support Information.

Disabling Print for ZPA Isolation Profiles

Wed, 07 Feb 2024 08:00:00 GMT

Disabling the printing feature for an isolation profile disables all possibility of being able to print the web page or document that is rendered in isolation. When printing is disabled on an isolation profile, you cannot see the print option from the right-click menu, or the print button in the Isolation Bar. If you try to select File > Print from the browser menu, or enter the key command CTRL/CMD+P shortcut, a message appears stating that it is disabled by policy.

To learn more, see Creating Isolation Profiles for ZPA.

Bypass During Reauthentication Disabled Depending on App Segment Configuration

Tue, 06 Feb 2024 08:00:00 GMT

If you select Always for the Bypass option when configuring a defined application segment, the option for Bypass during Reauthentication is automatically disabled.

See image.

To learn more, see Configuring Defined Application Segments.

Resolved Issues

Tue, 06 Feb 2024 08:00:00 GMT

An update was released to address an issue where some admins were prevented from logging in to the ZPA Admin Portal using single sign-on (SSO). This was due to a case mismatch between the SAML assertion from the IdPs and the user emails for the admin accounts in ZPA.

Enhancement of Client-to-Client Connectivity

Wed, 31 Jan 2024 08:00:00 GMT

An update was released that ensures client-to-client connectivity is successful when source and destination users are connected to different ZPA Private Service Edges or ZPA Public Service Edges and there is no dedicated application segment configured for client-to-client functionality. Contact Zscaler Support to enable this feature for your organization.

Server-Side Certificate Posture Validation

Wed, 31 Jan 2024 08:00:00 GMT

An update was released that provides support for server-side certificate posture validation. Contact Zscaler Support to enable this feature for your organization.

To learn more, see Configuring Device Posture Profiles.

Source IP Anchoring Dashboard

Fri, 19 Jan 2024 08:00:00 GMT

The Source IP Anchoring dashboard is available in the ZPA Admin Portal and includes tools and widgets to help you monitor the usage and metrics of your organization's Source IP Anchoring.

See image.

To learn more, see Viewing the Source IP Anchoring Dashboard.

AWS, Azure, and Docker Hub Image Updates

Wed, 17 Jan 2024 08:00:00 GMT

New App Connector images are available for AWS EC2, Microsoft Azure, and Docker to address routine security patches. New ZPA Private Service Edge images are available in AWS EC2 to address routine security patches.

To learn more, see the App Connector Deployment Guides for AWS, Azure, and Docker, and the ZPA Private Service Edge Deployment Guide for AWS.

KVM Image Support

Wed, 17 Jan 2024 08:00:00 GMT

New App Connector and ZPA Private Service Edge images are available in the KVM qcow2 format to support Equinix Network Edge.

VMware Image Updates

Wed, 17 Jan 2024 08:00:00 GMT

New App Connector and ZPA Private Service Edge images are available for VMware that address routine security patches.

To learn more, see App Connector Deployment Guide for VMware Platforms, App Connector Deployment Guide for Nutanix AHV, and ZPA Private Service Edge Deployment Guide for VMware Platforms.

Redirection Policy

Tue, 16 Jan 2024 08:00:00 GMT

ZPA supports redirection policy rules that allow you to set criteria for preferring ZPA Private Service Edges over ZPA Public Service Edges. You can configure redirection policy rules to prefer ZPA Private Service Edges based on country code and client type. You can also configure redirection to prefer ZPA Private Service Edges based on geographical proximity.

To learn more, see About Redirection Policy and Configuring Redirection Policies.

ZPA API Improvements for Bulk Updating Policy Rules

Tue, 16 Jan 2024 08:00:00 GMT

The ability to bulk update the order of all rules within a policy set is available via the cloud service API.

To learn more, see Configuring Access Policies Using API and the ZPA cloud service API Reference Guide.

File Size Limit Increase in Isolation for ZPA

Thu, 11 Jan 2024 08:00:00 GMT

The size limit for downloading and uploading files in Isolation has increased to 1 GB. End users can expect an increase of time to upload files from 9 minutes to 10 minutes. If downloading or uploading multiple files at once, the size limit is 2 GB.

To learn more, see Transferring and Viewing Files in Isolation and Limits in Isolation.

Last Known Public and Private IP Addresses

Thu, 11 Jan 2024 08:00:00 GMT

The Public IP and Private IP fields in the tables of the App Connectors and Private Service Edges pages show the last known public or private IP address when an App Connector or ZPA Private Service Edge disconnects.

To learn more, see About App Connectors and About ZPA Private Service Edges.

OS Update for App Connectors and ZPA Private Service Edges

Thu, 11 Jan 2024 08:00:00 GMT

The App Connector Platform and Private Service Edge Platform fields have been renamed to App Connector Host Platform and Private Service Edge Host Platform on the App Connector and ZPA Private Service Edge pages, respectively. The App Connector Host OS and Private Service Edge Host OS fields have a new value—the run time OS that the binary is running on for each respective feature. The previous Host OS information is displayed in the new App Connector Package OS and Private Service Edge Package OS fields on the App Connectors and ZPA Private Service Edge pages, respectively.

To learn more, see About App Connectors and About ZPA Private Service Edges.