icon-unified.svg
Experience Center

Adding SaaS Application Tenants

Zscaler Data at Rest Scanning provides visibility and security for sanctioned SaaS applications used in your organization. You can authorize sanctioned SaaS applications with Zscaler by adding them as tenants. Most apps require configuration to provide Zscaler access and enable their full functionality.

To add a SaaS application tenant:

  1. Go to Policies > Common Configuration > Out-of-band CASB > SaaS Application Tenants.

  2. Click Add SaaS Application Tenant.

    The Add SaaS Application Tenant page appears.

  3. Under Choose the SaaS Application Provider, search for or choose from one of the sanctioned SaaS applications.

  4. Under Name the SaaS Application Tenant, enter a name for the SaaS application tenant. It must be unique. This name is displayed when configuring the Data at Rest Scanning DLP policy, Malware Detection policy, Workflow Automation, or Scan Configuration depending on the functionality available for that specific application.

  5. Under Onboard SaaS Application for, select the checkbox for the functionality you want to enable. You can choose from DLP and Malware scanning SaaS API, SSPM Scan, or Workflow Automation if the app supports the functionality.

  6. Complete the specific configuration steps for your chosen application:

    • To enable Amazon S3 for your organization, contact your Zscaler Account team.

      To configure Amazon S3:

      To learn more about the steps in AWS, refer to the AWS documentation.

      Close

    • To configure Bitbucket:

      1. Under Enter Bitbucket Admin Email ID, enter your admin email ID.

      1. Click Provide Admin Credentials and sign in to your Bitbucket account.

      1. Click Save.
      Close

    • To configure Box:

      Under Authorize the SaaS Application, select a SaaS Connector option. A Zscaler-defined connector grants the Zscaler service full administrator privileges to the application; whereas, a custom connector grants only necessary permissions.

        1. Under Authorize the SaaS Application, copy the Zscaler SaaS Connector. You need it for Step g when adding a custom application for Box.

        1. Click Go to Box Settings.

        The Box portal appears.

        1. Log in to Box.

        You are redirected to the Box Admin console.

        1. Go to Apps.

        1. Click the Custom Apps Manager tab.

        1. Click Add App.

        The App Authorization window appears.

        1. In the App Authorization window:
          1. Client ID: Enter Zscaler SaaS Connector value you copied in Step a.

        1. Click Next.
        2. Review the required permissions for the Zscaler service to access Box, and click Authorize.
        3. Click Okay.
        4. Go to Account & Billing.

        1. Under Account Information, copy the Enterprise ID.

        1. In the Admin Portal, under Enter the Box Enterprise ID, enter the Enterprise ID you copied from Box in the previous step.

        To learn more about the steps in Box, refer to the Box documentation.

        Close
        1. Under Authorize the SaaS Application, select Custom.

        2. Sign in to the Box Developer Console, select My Apps, and then click Create new app.

          If you don't have any apps yet, Box might directly open the next step after selecting My Apps.

        3. Select Custom App.

        4. Enter an app name with Zscaler as the prefix, and under Purpose, select Integration. Fill in the rest of the required information based on your app needs and click Next.

        5. For the Authentication Method, select Server Authentication (with JWT) and click Create App.

        6. On the Configuration tab, next to the Application Scopes section, select the following scopes:
          • Write all files and folders stored in Box
          • Manage users
          • Manage groups
          • Manage enterprise properties

        7. In the Advanced Features section, select:

          • Make API calls using the as-user header
          • Generate user access tokens

          To learn more about the required API permissions, see the following table:

          • Box PermissionsAssociated Zscaler Actions
            Content Actions > Write all files and folders stored in BoxScanning, Policy Action
            Administrative Actions > Manage UsersScanning, Policy Action
            Administrative Actions > Manage GroupsScanning
            Administrative Actions > Manage Enterprise PropertiesScanning
            Administrative Actions > Make API calls using the as-user headingScanning, Policy Action
            Close

        8. In the App Access Level section, select App + Enterprise Access and click Save Changes.

        9. In the Add and Manage Public Keys section, select Generate a Public/Private Keypair and your JSON file is downloaded.

        10. Next, you need to enable Suppress Notifications by referring to the Box documentation. You need to contact your Box support contact to request the required scopes to be enabled for your application.

        11. In the Admin Portal, under Authorize the SaaS Application, select Custom and then click Upload File to upload the JSON file you generated in a previous step.

        12. Click Authorize and then click Save.
        Close
      Close

    • To configure ChatGPT:

      1. Sign in to the OpenAI API platform with your admin credentials.
      2. Go to API Keys in the left-side navigation.
      3. Click Create new secret key.

      4. Enter a Name, under Project select Default project, and under Permissions select All. Click Create secret key.

      5. Save your key to use during onboarding. It can only be copied and viewed once. If you lose it, you need to generate a new one.
      6. Log in to ChatGPT and then go to the ChatGPT admin settings.

      7. Copy the Workspace ID and save it.

      8. To enable the necessary enterprise APIs, write an email to OpenAI support requesting them to be enabled and include your secret key name, secret key, and workspace ID. Wait for confirmation that the APIs are enabled before continuing to onboard the application.

      9. In the Admin Portal under Authorize the SaaS Application, enter your Workspace Name, Workspace ID, and Workspace Secret Key. Click Authorize.

      Close

    • To configure Confluence:

      1. Enter the Atlassian Domain Address you want to connect with Zscaler.

      1. Enter your Confluence Organization API Key. For help finding your API Key, follow the instructions on Atlassian Support.

      1. Click Provide Admin Credentials and sign in to your Confluence account.
      2. Click Save.

      For Confluence, the Data at Rest Scanning DLP rule scans all the blogs, pages, and attachments within a space. The DLP rule does not scan the overview page for any space.

      Close

    • To configure Dropbox:

      1. Under Enter the Dropbox Enterprise ID, enter your Dropbox Enterprise email address.

      Enter your Dropbox Enterprise login email ID.

      1. Under Authorize the SaaS Application, click Redirect to Dropbox.

      The Dropbox portal appears.

      1. Log in to Dropbox.
      2. For the Before you connect this app... warning, click Continue.

      1. Review the required permissions for the Zscaler service to access Dropbox and click Allow.

      The Admin Portal refreshes and adds the Dropbox Team ID under Authorize the SaaS Application.

      To learn more about the steps in Dropbox, refer to the Dropbox documentation.

      Close

    • To configure Dynamics 365:

      1. Under Enter Organization Domain Address, enter the URL used to log in to your Dynamics 365 instance.
      2. Under Authorize the SaaS Application you can click Provide Admin Credentials and log in with the Microsoft account associated with your Dynamics 365 instance.

      1. Click Save.

      To learn more about the steps in Dynamics 365, refer to the Microsoft documentation.

      Close

    • To configure GitHub:

      1. Under Enter the GitHub Admin Email ID, enter your admin email ID used to log in to the GitHub portal.

      1. Under Authorize the SaaS Application, click Provide Admin Credentials and then log in to Github.

        1. If you don't have SAML enabled for your organization, the GitHub Permissions page opens. Click Grant for all organizations you would like the scans to run for and then click Authorize.

          To learn more about enabling SAML, see About External Identity Providers and Adding SAML Identity Providers.

        2. If you do have SAML enabled, the single sign-on page opens. Click Authorize and then Continue.

        3. Click Grant on all organizations you want to provide Zscaler access to, and click Authorize.

      2. Click Save.
      Close

    • To configure GitLab:

      1. Under Enter the GitLab Admin Email ID, enter your admin email ID used to log in to GitLab.
      2. Under Authorize the SaaS Application, click Provide Admin Credentials and log in with your GitLab information.
      3. Click Save.

      To learn more about the steps in GitLab, refer to the GitLab documentation.

      Close

    • To configure Gmail:

        1. Enter your Google Admin Email ID.
        2. Under Authorize the SaaS Application, select Zscaler Defined, copy the Zscaler SaaS Connector and Google Workspace Scope. You need it for a later step when adding an API client for Google Workspace.

        1. Click Go to Google Workspace.

        The Google Workspace portal appears.

        1. Log in to Google Workspace.

        You are redirected to the Google Admin console.

        1. Go to Security.

        1. Click API controls.

        1. Under Domain wide delegation, click MANAGE DOMAIN WIDE DELEGATION.

        1. Click Add new.

        The Add a new client ID window appears.

        1. In the Add a new client ID window:
          • Client ID: Enter Zscaler SaaS Connector value you copied in a previous step.
          • Overwrite existing client ID: Deselect.
          • OAuth scopes (comma-delimited): Enter the Google Workspace scope you copied in a previous step.

        1. Click Authorize.

        The Zscaler Connector App is added as an API client.

        1. (Optional) Under (Optional) Configure External Trusted Domains & Users for the Tenant:
          • External Trusted Domains: Enter trusted email domains that are outside your organization (i.e., using a different domain). The Zscaler service views any email addresses from the added domains as trusted; internal users for Gmail. For example, if your organization's domain is safemarch.com and your organization recently acquired a company with the domain example.com, you can add example.com to this list, and the service treats any email addresses from example.com (e.g., johnsmith@example.com) as internal users from safemarch.com. You can add up to 1,000 domains.
          • External Trusted Users: Enter trusted email addresses that are outside your organization (i.e., using a different email domain). The Zscaler service views the email addresses as trusted, internal users for Gmail. For example, if your organization's email domain is safemarch.com and your organization recently contracted with someone using an external email domain (e.g., johnsmith@example.com), you can add the contractor's email to this list, and the service treats the contractor as an internal user from safemarch.com. You can add up to 1,000 email addresses.

        To learn more about the steps in the Google Admin console, refer to the Google documentation.

        Close

      • To create a custom Gmail Connector, you must first configure permissions in Google so that you can provide the Private Key JSON file for the Gmail account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Google Applications.

        Close
      Close

    • To enable Google Cloud for your organization, contact your Zscaler Account team.

          1. Enter your Google Cloud Admin Email ID.
          2. Under Authorize the SaaS Application:
            • Click Zscaler Defined.
            • Click Go to Google Cloud and sign in with your Google Cloud account credentials.
            • Enter the name of your Quarantine Bucket. If you don’t have a Quarantine Bucket configured yet, follow the instructions in Step B.
          3. Click Save to finish.
          Close
          1. From your Google Cloud Platform console, click on Cloud Storage, and then click Create Bucket.
          2. Name the bucket and click Continue.
          3. Continue configuring the bucket as needed and click Create when finished.

          1. Return to Section a., Step iii.
          Close

        • The following tasks have to be performed by an Organization Administrator of the G Suite domain:

          1. Copy the Zscaler Saas Connector ID.
          2. Go to G Suite domain’s Admin console.
          3. Select Security > Access and data control > API controls.

          1. Select Manage Domain Wide Delegation.
          2. If the Zscaler API client isn't listed, select Add new.
          3. In the Client name field enter the Zscaler Saas Connector ID you copied earlier.

          1. In the OAuth scopes field, enter the list of scopes that your application should be granted access to (copy from following list):
          https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/devstorage.full_control,https://www.googleapis.com/auth/logging.read,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/logging.write,https://www.googleapis.com/auth/logging.admin
          1. Click Authorize.
          Close
          1. Sign in to the Google Cloud Platform console.
          2. Navigate into the desired organization using the project selection drop-down menu and select the appropriate domain in the listing.

          Organization Administrator should be granted Members permissions for your GCP organization.

          1. Go to IAM & Admin > IAM on the navigation bar.
          2. Select Add.
          3. Paste the Organization Administrator email address in the New principals field.

          1. Select the following roles necessary for complete cloud storage visibility/harvesting:
            • Browser (roles/browser): Read access to browse the hierarchy for a project and IAM policy. This role doesn't include permission to view resources in the project.
            • Private Logs Viewer: To view data access logs.
            • Storage Admin (roles/storage.admin): Grants full control of objects and buckets.
          2. Click Save.
          Close

        • To access audit log configuration options in the Cloud Console, follow these steps:

          1. Go to the Audit Logs page.
          2. In the main table on the Audit Logs page, select one or more Google Cloud services from the Title column.
          3. In the Log Type tab, select the boxes by the Data Access audit log types that you want to enable and then click Save. Where you have successfully enabled audit logs, the table includes a checkmark.

          1. Select Cloud Logging API and Google Cloud Storage, and enable Admin Read, Data Write, and Data Read audit logs.

          Why should you enable the above operations?

          • Admin Read: Entries for operations that read the configuration or metadata of a project, bucket, or object.
          • Data Read: Entries for operations that read an object.
          • Data Write: Entries for operations that create or modify an object.
          Close
          • From Google Cloud Platform, go to APIs & Services > Enabled APIs & services. Ensure that for all the projects for the organization the Cloud Storage JSON API is activated. The JSON API is activated by default, and it can be used immediately.
          • To enable the JSON API in an existing project, go to the Google Cloud Storage JSON API page in the Cloud Console API Library, and click the Enable button.
          Close
        Close

      • To create a custom Google Cloud Connector, you must first configure permissions in Google so that you can provide the Organization ID, Quarantine Bucket name, and Private Key JSON file for the Google Cloud Platform account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Google Applications.

        Close
      Close

    • To configure Google Drive:

        1. Enter your Google Admin Email ID.
        2. Under Authorize the SaaS Application, click Zscaler Defined, and copy the Zscaler SaaS Connector and Google Workspace Scope. You need it for a later step when adding an API client for Google Workspace.

        1. Click Go to Google Workspace.

        The Google Workspace portal appears.

        1. Log in to Google Workspace.

        You are redirected to the Google Admin console.

        1. Go to Security.

        1. Click API controls.

        1. Under Domain wide delegation, click MANAGE DOMAIN WIDE DELEGATION.

        1. Click Add new.

        The Add a new client ID window appears.

        1. In the Add a new client ID window:
          • Client ID: Enter Zscaler SaaS Connector value you copied in a previous step.
          • Overwrite existing client ID: Deselect.
          • OAuth scopes (comma-delimited): Enter the Google Workspace scope you copied in a previous step.

        1. Click Authorize.

        The Zscaler Connector App is added as an API client.

        To learn more about the steps in the Google Admin console, refer to the Google documentation.

        Close

      • To create a custom Google Drive Connector, you must first configure permissions in Google so that you can provide the Private Key JSON file for the Google Drive account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Google Applications.

        Close
      Close

    • To configure Google Workspace:

        1. Enter the Google Admin Email ID.
        2. Under Authorize the SaaS Application, click Zscaler Defined, and copy the Zscaler SaaS Connector and Google Workspace Scope. You need it for a later step when adding an API client for Google Workspace.

        See image.

        1. Click Go to Google Workspace.

        The Google Workspace portal appears.

        1. Log in to Google Workspace.

        You are redirected to the Google Admin console.

        1. Go to Security.

        1. Click API controls.

        1. Under Domain wide delegation, click MANAGE DOMAIN WIDE DELEGATION.

        1. Click Add new.

        The Add a new client ID window appears.

        1. In the Add a new client ID window:
          • Client ID: Enter Zscaler SaaS Connector value you copied in a previous step.
          • Overwrite existing client ID: Deselect.
          • OAuth scopes (comma-delimited): Enter the Google Workspace scope you copied in a previous step.

        1. Click Authorize.

        The Zscaler Connector App is added as an API client.

        To learn more about the steps in the Google Admin console, refer to the Google documentation.

        Close

      • To create a custom Google Workspace Connector, you must first configure permissions in Google so that you can provide the Private Key JSON file for the Google Drive account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Google Applications.

        Close
      Close

    • To configure Google Workspace Marketplace:

      1. Under Authorize the SaaS Application, copy the Zscaler SaaS Connector and Google Workspace Scope. You need it for a later step when adding an API client for Google Workspace.

      1. Click Go to Google Workspace.

      The Google Workspace portal appears.

      1. Log in to Google Workspace.

      You are redirected to the Google Admin console.

      1. Go to Security.

      1. Click API controls.

      1. Under Domain wide delegation, click MANAGE DOMAIN WIDE DELEGATION.

      1. Click Add new.

      The Add a new client ID window appears.

      1. In the Add a new client ID window:
        • Client ID: Enter Zscaler SaaS Connector value you copied in a previous step.
        • Overwrite existing client ID: Deselect.
        • OAuth scopes (comma-delimited): Enter the Google Workspace scope you copied in a previous step.

      1. Click Authorize.

      The Zscaler Connector App is added as an API client.

      1. In the Admin Portal, under Enter the Google Admin Email ID, enter your admin email ID used to log in to the Google Admin console.

      To learn more about the steps in the Google Admin console, refer to the Google documentation.

      Close

    • To configure Jira Software:

      1. Enter the Atlassian Domain Address you want to connect with Zscaler.

      1. Enter your Jira Organization API Key. For help finding your API Key, follow the instructions on Atlassian Support.

      1. Click Provide Admin Credentials and sign in to your Jira account.
      2. Click Save.
      Close

    • To configure Microsoft 365:

      1. Under Authorize the SaaS Application, copy the SaaS connector ID.

      2. On a new browser tab, log in to the Azure Portal with your Global Administrator account.

      3. On the Azure Portal home page, search for the Microsoft Entra roles and administrators service and click that entry in the drop-down list.

      4. On the All Roles page, search for Exchange Administrator, then click that entry to open it.

      5. On the Exchange Administrator | Assignments page, click Add assignments.

      6. On the Add Assignments page, click the No member selected link.

      7. On the Select a member page, paste the SaaS connector ID you copied in step c. Select the SaaS connector ID in the list below and click Select at the bottom of the screen.

      8. The Add Assignments page appears for the selected SaaS connector ID. Click Next at the bottom of the screen. On the following screen, provide a justification for this assignment and click Assign.

      9. On the Exchange Administrator | Assignments page, verify that the SaaS connector ID you just added appears in the list of active assignments.

      10. Return to the Add SaaS Application Tenant page in the Admin Portal and click Provide Admin Credentials to add the tenant ID.

      Close

    • To enable Microsoft Azure for your organization, contact your Zscaler Account team. To learn more about configuring Azure or for help finding your enterprise ID or storage account name, refer to the Microsoft documentation.

          1. Under Authorize the SaaS Application, select the checkbox for the functionality you want to enable.

          2. Click Provide Admin Credentials, and sign in with your Microsoft Azure account credentials.
          3. Under Register the SaaS Application:
            • Enter your Microsoft Azure Enterprise ID.
            • Enter the name of your Quarantine Storage Account.
            • Click Save to finish.

          Close
          1. Copy the Zscaler SaaS Connector ID.

          1. Log in to the Azure Portal with your Global Administrator account. Go to Azure Active Directory > Enterprise Application.
          2. Copy the Application name matching the ID in Step a.

          1. Go back to the Azure Portal home page, then go to Subscriptions and select your subscription. You must do this for each of your subscriptions.

          1. Select Access Control (IAM) > Role Assignments > Add > Add role assignment.

          1. Search "Storage Contributor". Select Storage Blob Data Contributor and Storage Account Contributor and then click Next (this must be done separately for each role).
          2. Click Select members and add the application name from Step c as a member to Storage Blob Data Contributor and Storage Account Contributor, then select Review + assign.

          Steps f and g must be done separately for both the Storage Blob Data Contributor and Storage Account Contributor roles. Steps d to g must be repeated for all subscriptions.

          Close
        Close

      • To create a custom Microsoft Azure Blob Storage Connector, you must first configure permissions in Azure so that you can provide the Client ID, Client Secret, and Tenant ID, and add Role Assignments for the Microsoft Azure Blob Storage account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Microsoft Applications.

        Close
      Close

    • To configure Microsoft Exchange:

      1. Under Authorize the SaaS Application, select a SaaS Connector option. A Zscaler-defined connector grants the Zscaler service full administrator privileges to the application; whereas, a custom connector grants only necessary permissions.

          1. Click Provide Admin Credentials.

          The Exchange Portal appears.

          1. Log in to Exchange.
          2. Review the required permissions for the Internet & SaaS service to access the Exchange account and click Accept.
          Close

        • To create a custom Exchange connector, you must first configure permissions in Azure so that you can provide the Client ID, Client Secret, and Tenant ID for the Exchange account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Microsoft Applications.

          Close

      2. (Optional) In the Admin Portal, under (Optional) Configure External Trusted Domains & Users for the Tenant:

        • External Trusted Domains: Enter trusted email domains that are outside your organization (i.e., using a different domain). The Zscaler service views any email addresses from the added domains as trusted, internal users for Exchange. For example, if your organization's domain is safemarch.com and your organization recently acquired a company with the domain example.com, you can add example.com to this list, and the service treats any email addresses from example.com (e.g., johnsmith@example.com) as internal users from safemarch.com. You can add up to 1,000 domains.
        • External Trusted Users: Enter trusted email addresses that are outside your organization (i.e., using a different email domain). The Zscaler service views the email addresses as trusted, internal users for Exchange. For example, if your organization's email domain is safemarch.com and your organization recently contracted with someone using an external email domain (e.g., johnsmith@example.com), you can add the contractor's email to this list, and the service treats the contractor as an internal user from safemarch.com. You can add up to 1,000 email addresses.

      Close

    • To configure Microsoft OneDrive:

      Under Authorize the SaaS Application, select a SaaS Connector option. A Zscaler-defined connector grants the Zscaler service full administrator privileges to the application; whereas, a custom connector grants only necessary permissions.

        1. Click Provide Admin Credentials.

        The OneDrive portal appears.

        1. Log in to OneDrive.
        2. Review the required permissions for the Zscaler service to access OneDrive, and click Accept.
        Close

      • To create a custom OneDrive connector, you must first configure permissions in Azure so that you can provide the Client ID, Client Secret, and Tenant ID for the OneDrive account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Microsoft Applications.

        Close
      Close

    • To configure Microsoft SharePoint:

      Under Authorize the SaaS Application, select a SaaS Connector option. A Zscaler-defined connector grants the Zscaler service full administrator privileges to the application; whereas, a custom connector grants only necessary permissions.

        1. Click Provide Admin Credentials.

        The SharePoint portal appears.

        1. Log in to SharePoint.
        2. Review the required permissions for the Zscaler service to access SharePoint, and click Accept.
        Close

      • To create a custom SharePoint connector, you must first configure permissions in Azure so that you can provide the Client ID, Client Secret, and Tenant ID for the SharePoint account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Microsoft Applications.

        Close
      Close

    • To configure Microsoft Teams:

      1. If you select Workflow Automation, an additional step appears to Configure Microsoft Teams Bot.

        1. Click Download Zip File to download the bot’s AppBundle ZIP file, and then name the bot. The name must be identical to its name in the Teams App overview after the upload. By default, the name is ZCN. All other names lead to a 401 error while validating.

        2. In the ZIP file, open the manifest.json file in a text editor and replace the three id values with your Zscaler Connector ID found under the next step in the UI: Authorize the SaaS Application. Save the changes to the manifest.json file.

        3. Go to Microsoft Teams and navigate to Apps > Manage your apps > Upload an app.

        4. Click Upload a custom app, select your AppBundle ZIP file, then return to the Add SaaS Application Tenant page in the Admin Portal. To learn more about packaging or uploading your Microsoft Teams Bot, refer to the Microsoft documentation.
      2. Under Authorize the SaaS Application, select a SaaS Connector option. A Zscaler-defined connector grants the Zscaler service full administrator privileges to the application; whereas, a custom connector grants only necessary permissions.

          1. Click Provide Admin Credentials.

          The Teams Portal appears.

          1. Log in to Teams.
          2. Review the required permissions for the Internet & SaaS service to access the Microsoft account and click Accept.
          Close

        • To create a custom Teams connector, you must first configure permissions in Azure so that you can provide the Client ID, Client Secret, and Tenant ID for the Teams account in the Admin Portal. To learn more, see Authorizing a Custom Zscaler Connector for Microsoft Applications.

          Close
      Close

    • To configure Okta:

      1. Under Register the OAuth Application, enter your Okta client ID and client secret that you copied (learn more in Step f), as well as the URL used to login to your admin account in Okta.

      Enter OAuth Application information

      1. Under Enter Okta Admin Email ID, enter your admin email ID used to log in to Okta portal.
      2. Under Authorize the SaaS Application, click Provide Admin Credentials.
      3. Click Save.

      Create and configure an Okta App Integration:

      1. From the Okta admin console, go to Applications > Applications and then select Create App Integration.

      1. Select OIDC - OpenID Connect for the sign-in method and Web Application for the application type.

      1. Click Next.
      2. Enter a name for the app integration, select Authorization Code and Refresh Token for grant types, and enter https://admin.<Zscaler Cloud Name>.net for the sign-in and sign-out URIs, where the cloud name is the Zscaler cloud where you are hosted. In the following example we are using https://admin.zscaler.net.

      1. Under Assignments, select Allow everyone in your organization to access for controlled access and click Save.

      1. In the General tab of the application you created, copy the Client ID and Secret for use in the previous section's Step b.

      1. In the Okta API Scopes, grant access to the following scopes:
        • okta.apiTokens.read
        • okta.apps.read
        • okta.behaviors.read
        • okta.clients.read
        • okta.domains.read
        • okta.events.read
        • okta.factors.read
        • okta.groups.read
        • okta.linkedObjects.read
        • okta.logs.read
        • okta.networkZones.read
        • okta.policies.manage
        • okta.policies.read
        • okta.reports.read
        • okta.riskProviders.read
        • okta.roles.manage
        • okta.roles.read
        • okta.sessions.read
        • okta.threatInsights.manage
        • okta.threatInsights.read
        • okta.trustedOrigins.read
        • okta.userTypes.read
        • okta.users.read

      To learn more about the steps in Okta, refer to the Okta documentation.

      Close

    • To configure Salesforce:

      To view the activity report logs for Salesforce, ensure that you have access to the Event Monitoring add-on on your Enterprise or Unlimited Salesforce license.

      • You must install the zscalerPackage, which contains the contents for the Zscaler SaaS Connector application.

        1. Under Select Tenant Type, choose the appropriate tenant type based on your deployment:
          • Sandbox Account: This option allows you to access Salesforce from the test.salesforce.com URL where you can test your changes without having them affecting your customers until you move it to your production environment.
          • Production Account: This option allows you to access Salesforce from the login.salesforce.com URL where your changes affect your customers directly as they are applied to your production environment.

        You can add both tenant types separately, but you can't change from a sandbox tenant type to production, or from production to sandbox.

        1. Under Authorize the SaaS Application, click Go to Salesforce.

        The Salesforce portal appears.

        1. Log in to Salesforce.

        The Install zscalerPackage page appears.

        1. On the Install zscalerPackage page:
          1. Ensure Install for Admins Only is selected.
          2. Select I acknowledge that I’m installing a Non-Salesforce Application that is not authorized for distribution as part of Salesforce’s AppExchange Partner Program.
          3. Click Install.

        1. After installation is complete, click Done.

        You are redirected to the Installed Packages page.

        Close

      • You must create a permission set to assign to your user account and the Zscaler SaaS Connector application.

        To create a permission set:

        1. In the left-side navigation, go to Users > Permission Sets.

        1. Click New.

        The Permission Set Create window appears.

        1. In the Permission Set Create window:
          • Label: Enter a label for the permission set. In this example, it's Zscaler SaaS Connector User.
          • API Name: This field populates based on the label you entered.
          • License: Choose Salesforce.

        1. Click Save.
        2. In the Apps section, click App Permissions.

        1. Click Edit.

        1. In the Content section, select the following permissions:
          • Manage record types and layouts for Files
          • Manage Salesforce CRM Content
          • Query All Files

        1. Click Save and then Save again to confirm.
        Close

      • You must assign the permission set you created to your Salesforce user account.

        To assign the permission set to your user account:

        1. In the left-side navigation, go to Users > Users.

        1. In the Full Name column, click your name.

        1. In the User Details section, select Salesforce CRM Content User.

        1. In the Permission Set Assignments section, click Edit Assignments.

        The Permission Sets window appears.

        1. In the Permission Sets window, under Available Permission Sets, select the permission set you configured in Step b, and click Add. In this example, it's Zscaler SaaS Connector User.

        1. Click Save.
        Close

      • To configure the Salesforce CRM Content settings:

        1. In the left-side navigation, go to Feature Settings > Salesforce Files > Salesforce CRM Content.

        1. Select the following Salesforce CRM Content settings:
          • Enable Salesforce CRM Content
          • Autoassign feature licenses to existing and new users
          • Files user interface allows sharing files with libraries

        1. Click Save.
        Close

      • To configure the Zscaler SaaS Connector application:

        1. In the left-side navigation, go to Apps > App Manager.

        1. Click the down arrow icon for the Zscaler SaaS Connector application. The name of the Zscaler SaaS Connector application varies depending on the URL you use to log in to the Zscaler service. For example, if you log in to https://admin.zscalerbeta.net, then your Zscaler SaaS Connector application name is similar to ZscalerSaaSConnectorZSBeta01. This guide uses the ZscalerSaaSConnectorZSBeta01 application as an example.

        1. Click Manage.

        1. Click Edit Policies.

        The Connected App Edit window appears.

        1. In the Connected App Edit window:
          • Permitted Users: Choose Admin approved users are pre-authorized.
          • IP Relaxation: Choose Relax IP restrictions.
          • Refresh Token Policy: Ensure Refresh token is valid until revoked is chosen.

        1. Click Save.
        2. In the Profiles section, click Manage Profiles.

        The Application Profile Assignment window appears.

        1. In the Application Profile Assignment window, select System Administrator.

        1. Click Save.
        2. In the Permission Sets section, click Manage Permission Sets.

        The Application Permission Set Assignment window appears.

        1. In the Application Permission Set Assignment window, select the permission set you configured in Step b. In this example, it's Zscaler SaaS Connector User.

        1. Click Save.
        2. In the Admin Portal, under Enter the Salesforce Admin Username, enter your admin username used to log in to the Salesforce portal.

        Close

      To learn more about the steps in Salesforce, refer to the Salesforce documentation.

      Close

    • To configure ServiceNow as a tenant, you must have a ServiceNow user account with an admin role.

      To configure ServiceNow:

      • To verify the the OAuth 2.0 plugin is installed and active:

        1. Log in to your ServiceNow instance.

        2. Go to System Application > All Available Applications > All.

        3. Enter OAuth 2.0 in the search bar. The OAuth 2.0 plugin appears. Ensure it's Installed.

          If the plugin isn't installed, click Install and then Activate.

        Close

      • To verify that the OAuth property is active:

        1. In the Filter navigator, enter sys_properties.list and press Enter on your keyboard.

        2. On the System Properties page, enter the following property in the search bar and press Enter on your keyboard:
        com.snc.platform.security.oauth.is.active

        1. Ensure that the Value column for the com.snc.platform.security.oauth.is.active property is true.

          If it's not, in the Name column, click com.snc.platform.security.oauth.is.active, enter true for the Value, and then click Update.

        Close

      • To configure an OAuth client application:

        1. Go to System OAuth > Application Registry.

        2. Click New.

        3. Click Create an OAuth API endpoint for external clients.

          The Application Registries New Record window appears.

        4. In the Application Registries New Record window:

          • Name: Enter a name for the OAuth client application. In this example, it's Zscaler SaaS Application Tenant.
          • Client ID: Copy the client ID of the application. You need it for Step ii of d. Add ServiceNow as a Tenant.
          • Client Secret: The shared secret of the application, which the ServiceNow instance and the OAuth client application use to authorize their communication. The secret generates after you submit this application registry.
          • Refresh Token Lifespan: The default lifespan is 8,640,000 seconds (100 days). Zscaler recommends changing it to a larger value, such as 157,700,000 seconds (5 years) because you'll need to configure ServiceNow as a new tenant after the refresh token expires.
          • Access Token Lifespan: The default value is 1,800 seconds (30 minutes). Zscaler recommends changing it to a larger value, such as 86,400 seconds (24 hours).

        5. Click Submit.

        6. On the Application Registries page, in the Name column, click the name of the configured OAuth client application. In this example, it's Zscaler SaaS Application Tenant.

          The Application Registries window appears.

        7. In the Application Registries window, click the Lock icon for Client Secret.

        8. Copy the client secret. You need it for Step ii of d. Add ServiceNow as a Tenant.

        Close

      • To add ServiceNow as a SaaS application tenant:

        1. Under Register the OAuth Application:

          • Client ID: Enter the client ID you copied in c. Configure an OAuth Client Application.
          • Client Secret: Enter the Client Secret you copied in c. Configure an OAuth Client Application.
          • Instance URL: Enter the URL used to log in to your ServiceNow instance.
          • User ID: Enter the user ID of the user account used to configure the OAuth client application.
          • User Password: Enter the password of the user account used to configure the OAuth client application.

        2. Under Enter the ServiceNow Admin Email ID, enter your admin email ID used to log in to your ServiceNow instance.

        3. Under Authorize the SaaS Application, click Authorize.

        Close

      To learn more about the steps in ServiceNow, refer to the ServiceNow documentation.

      To learn more about adding additional object types for ServiceNow tenants, see Adding Object Types for ServiceNow Tenants.

      Close

    • To configure ShareFile:

      1. Under Enter the ShareFile Admin Email ID, enter your admin email ID used to log in to the ShareFile portal.

      1. Under Authorize the SaaS Application, click Provide Admin Credentials.

      The ShareFile portal appears.

      1. Log in to ShareFile.
      Close

    • To configure Slack:

      1. Under Enter the Slack Admin Email ID, enter your admin email ID used to log in to the Slack portal.

      1. Under Authorize the SaaS Application, click Provide Admin Credentials.

      The Slack portal appears.

      1. Log in to Slack.
      2. Review the required permissions for the Zscaler service to access Slack, click Allow.
      3. In the Admin Portal, under Authorize Access to a Slack Bot, click Provide Admin Credentials.

      The Slack portal appears.

      1. Review the required permissions for the Zscaler service to send notifications to users through a custom Slack bot, and click Allow.
      Close

    • To configure Smartsheet:

      Close

    • To configure Trello:

      Trello can only be configured for SSPM scan which requires an Advanced SSPM license. If you don't have the correct license, you will see a message to upgrade your license next to the SSPM Scan checkbox.

      1. Log in to the Trello Power-Ups and Integrations with your admin credentials.

      2. Click New.

      3. Enter your information in the New Power-Up or Integration fields. Click Create when done.
      4. Under API key, click Generate a new API key.

      5. In the Generate API key window, click Generate API key.

      6. Copy the API key and Secret for use later and add the Internet & SaaS URL in the Allowed origins field.

        Required API scopes are as follows:

        1. read: Reading of boards, organizations, etc. on behalf of the user
        2. write: Writing of boards, organizations, etc. on behalf of the user
        3. account: Read member email, writing of member info, and marking notifications read

        To learn more, refer to Authorizing with Trello's REST API.

      7. In the Admin Portal under Enter the Trello Admin Email ID, enter your admin email ID used to log in to Trello.

      8. Under Authorize the SaaS Application, enter your Trello API Key and Organization ID.

        You should have copied your API key earlier, and the Organization ID can be found in the address bar of your Trello workspace page.

      9. Click Provide Admin Credentials. Log in with your Trello admin information and click Allow to give Zscaler access to the application.
      Close

    • To configure Twilio:

      Twilio can only be configured for SSPM scan which requires an Advanced SSPM license. If you don't have the correct license, you will see a message to upgrade your license next to the SSPM Scan checkbox.

      1. Log in to the Twilio Portal with your admin credentials.

      2. Go to Account-Management from the top-right corner.

      3. In the left-side navigation, click API keys & tokens.

      4. Click Create API Key. Enter the name, region, and set Key Type as Main. Click Create.

      5. Copy the SID and Secret for use later.

      6. In the Admin Portal, under Enter the Twilio Admin Email ID, enter your admin email ID used to log in to Twilio.

      7. Under Authorize the SaaS Application, enter the Account SID and Secret you copied earlier and click Provide Admin Credentials to grant Zscaler access to the application.

      Close

    • To configure Webex Teams:

      • Both onboarding options for Webex Teams allow you to configure rules for messages, but for file attachments you need to onboard the tenant for Real-time DLP. To learn more about rules and in-line DLP configuration, see Adding a Collaboration & Online Meetings Rule for Cloud App Control and Configuring DLP Policy Rules.
      • DLP and Malware scanning SaaS API and Real-time DLP cannot be enabled at the same time. You have the ability to easily switch between the two when editing the tenant.
        1. Under Enter the Webex Teams Admin Email ID, enter your admin email ID used to log in to the Webex portal.

        1. Under Authorize the SaaS Application, click Provide Admin Credentials.

        The Webex portal appears.

        1. Log in to Webex.
        2. Review the required permissions for the Zscaler service to access Webex Teams, follow the on-screen instructions, and click Allow.
        3. In the Admin Portal, click Authorize if you already have a Cisco connection, or click Create a Bot if you don't.

        The Webex portal appears.

        1. Sign in and review the required permissions for the Zscaler service to send notifications to users through a custom bot, and click Allow.
        Close

        1. Under Enter the Webex Teams Admin Email ID, enter your admin email ID used to log in to the Webex portal.

        2. Under Authorize the SaaS Application, click Provide Admin Credentials.
        3. Log in to Webex.
        4. Review the required permissions for the Zscaler service to access Webex Teams, follow the on-screen instructions, and click Allow.
        5. In the Admin Portal, click Authorize.
        Close

    • To configure Zoom SSPM scan:

      1. Sign in to Zoom with your admin account.
      2. Go to the Zoom Marketplace.

      3. Go to Develop > Build App.

      4. Select General App and click Create.

      5. Go to the Production tab and choose Admin-managed for the app type. Click Save.

      6. Go to the App Credentials tab in the left-side navigation and note down your Client ID and Client Secret for use later.

      7. Under OAuth Redirect URL and OAuth Allow Lists, enter the URL of your Zscaler server.

        List of Zscaler URLs:

        • https://admin.zscalerbeta.net
        • https://admin.zscalertwo.net
        • https://admin.zscalerthree.net
        • https://admin.zscaler.net
        • https://admin.zscloud.net
      8. Go to the App Listing tab and add Short Description, Long Description, Developer Contact Information, and any other mandatory fields.

      9. Go to the Scopes tab and add the following scopes:

        • account:read:settings:admin
        • account:update:settings:admin

      10. After adding the scopes, add a Scope Description and click Continue.

      11. Go to Beta Test in the left-side navigation. If everything has been set up correctly, you will see an Add App Now button. Don't select the button, it just indicates you have configured everything. If any required information is missing, this page will show you what is still missing before the Add App Now button appears.

      12. In the Admin Portal, under Authorize the SaaS Application, enter your Client ID and Client Secret noted down earlier.

        In the Admin Email ID field, enter the email address of the Zoom user assigned the Owner role, and click Authorize. For information on Zoom user roles, refer to the Zoom documentation.

      Close
  7. Click Save and activate the change.

After adding the tenants, you can configure the Data at Rest Scanning DLP policy, Malware Detection policy, and Scan Configuration. You can also view reports and data for the tenants in the SaaS Security Report, Insights, and Logs.

You can add up to 16 tenants per SaaS application. Contact Zscaler Support for a possible increase in this limit.

Related Articles
Authorizing a Custom Zscaler Connector for Google ApplicationsAuthorizing a Custom Zscaler Connector for Microsoft ApplicationsAbout SaaS Application TenantsAdding SaaS Application TenantsSaaS Application Validation Error CodesAdding Object Types for ServiceNow Tenants