An application is a fully qualified domain name (FQDN), local domain name, or IP address that you define on a standard set of ports. Applications must be defined within an application segment.

To enable application discovery, you can define an application as an FQDN in wildcard format or as an IP subnet.

An application segment is a grouping of defined applications, based upon access type or user privileges. So, features such as double encryption, health reporting, etc. are configured per application segment.

See image.

Read about the following key configuration options available for your applications before configuring an application segment:

• Application Access
• AppProtection
• Browser Access
• Bypass
• Double Encryption
• Health Reporting
• Privileged Remote Access (PRA)

About the Defined Application Segments Page

On the Defined Application Segments page (Policies > Access Control > Private Applications > App Segments), you can do the following:

1. Validate a client hostname.

If you are using a Microtenant, this option is hidden.

2. View and add DNS search domains.

DNS search domains are unique per customer. When configuring Microtenants, DNS search domains that are added in the default tenant are inherited across Microtenants.

3. Expand all rows in the table to see more information about each application segment.
4. Set application segment configuration warnings.
5. Add an application segment.
6. Download the configuration information for the application segments to a CSV file. The file lists the application segments based on the selected table filters.
7. Go to the AI-Powered Recommendationspage to view and manage recommended application segments.
8. Go to the Settings page to add parameters to recommended application segment findings.
9. Filter the information that appears in the table. By default, no filters are applied.

If you are using a Microtenant, then the Microtenant Ownership Type filter is available. By default, the Configured within Microtenant filter option is applied to show the application segments configured within that specific Microtenant. The options for the filter are based on access type (Global, Configured with Microtenant, Shared to this Microtenant, and Share from this Microtenant). The only available operator for this filter type is Equals.

11. View a list of all application segments that were configured for your organization. For each application segment, you can see:
    • Name: The name of the application segment. When you expand the row for an application segment, you can see more information.
      • Description: (Optional) Enter a description for the application segment.
      • Segment Group: The segment group that the application segment is a member of.
      • Server Groups: The server groups that the applications are hosted on.
      • Double Encryption: Indicates whether Double Encryption is enabled or disabled for all applications. By default, if a Browser Access-enabled application was defined, Double Encryption is disabled.
      • Bypass: Indicates whether users can bypass Private Applications to access applications.
      • Zscaler Client Connector can receive CNAME: Indicates if Zscaler Client Connector receives CNAME DNS records from App Connectors.
      • Source IP Anchor: Indicates if Source IP Anchoring is enabled or disabled for all applications.
      • ICMP Access: Indicates if ICMP communication is enabled or disabled for all applications.
      • App Connector Closest to Application: Indicates if the App Connector is closest to the application (Enabled) or closest to users (Disabled).
      • Inspect Traffic with ZIA: Indicates if the traffic for the application segments is enabled to be inspected.
      • Active Directory Inspection: Indicates if the traffic for the application segment is inspected with Active Directory (AD) Protection protocols.
      • Auto App Protection: Indicates if the traffic for the application segment is inspected with AppProtection protocols.

      Close

• Applications: A list of up to three defined applications within the application segment. Browser Access enabled-applications are denoted by a; icon. Privileged Remote Access-enabled applications are denoted by a icon. All other applications are denoted by a icon. If there are more than three applications, then only the number of defined applications appears.

For all applications, there is a link to view the Application Segment details with a list of all the applications for the application segment. The details page includes:

See image.

• Status: Indicates that the application segment is enabled or disabled.
• Health Reporting: Indicates whether health reporting for the application is Continuous, On Access, or None. To learn more, see About Health Reporting.

12. See a graphical view for how the application segment connects to other ZPA configuration objects (e.g., Segment group, Server groups, etc.)

13. Copy an existing application segment.
14. Move the application segment in a Microtenant.>

The Move icon is only visible if there are one or more Microtenants available. If you are using a Microtenant, the Share icon appears. If you share an application segment with another Microtenant, it appears as Shared to when you expand the application segment.

15. Enable or disable Load Balance Server Groups.
16. Edit an existing application segment.
17. Download the configuration information for an application segment to a CSV file.
18. Delete an application segment.