When a user tries to access a private application, a request is mapped to an application segment. After the application is mapped to an application segment, the policy search is performed, and the request is either allowed or blocked based on the policy configuration.

To learn more, see About Access Policy and Configuring Access Policies.

Prerequisites

Use the Zscaler Client Connector version that has 50K applications support (4.1 for MacOS and 4.0 for Windows). To enable the necessary version for your organization, contact Zscaler Support.

Exact Match vs. Multimatch

There are two application match behaviors available in Private Applications: Exact Match and Multimatch. Exact match is the default behavior.

About Exact Match

The default behavior of Private Applications is to perform an exact match of applications. If two or more application segments cover the same destination address, Zscaler Client Connector attempts to match traffic to the more granular application segment. Consider the following example of two Application Segments with the overlapping domain name "example.com":

About Multimatch

Multimatch allows an application request to match multiple application segments.

The following examples illustrate how applications are mapped to application segments, as well as how policy execution works when Multimatch is enabled vs not enabled on application segments.

Matched vs. Not Matched

Multiple matches apply to applications from most specific to least specific. As soon as an application is encountered that does not support Multimatch, the multimatching stops. The examples below show each possible outcome for matched and not matched results:

When you have decided what application segments you want matched, you can enable Multimatch for that application segment. To learn more, see Configuring Defined Application Segments.