A machine tunnel allows a user's Windows or macOS device to establish a connection to a service before the user is logged in to Zscaler Client Connector.

Admins can enable ZPA Machine Authentication in App Profiles to require users to authenticate against their IdP before the machine tunnel starts.

To use a machine tunnel, you must configure Machines groups and Machine Provisioning keys in the Zscaler Private Access (ZPA) Admin Portal, add keys to Zscaler Client Connector app profile rules for Windows or macOS, and enable the ZPA machine tunnel for all.

About the Machine Tunnel Page

On the Machine Tunnel page (Enrolled Devices > Machine Tunnel), you can do the following:

1. Filter the list of enrolled devices with the following options:
   • View machines for a specific operating system.
   • View machines using one of three statuses: Active, Inactive, or Removed. The default status is Active.
2. Remove selected machine tunnels from the Zscaler Client Connector Portal.
3. View a list of machines for your organization. For each machine tunnel, you can see:
   • Hostname: The name of the machine.
   • OS Type: The operating system of the machine.
   • Device Model: The model of the machine.
   • Zscaler Client Connector Version: The Zscaler Client Connector version installed on the machine.
   • Status: The status of the machine tunnel.
4. Select machine tunnels for removal from the Zscaler Client Connector Portal.
5. Search for a machine tunnel by Hostname, Machine Tunnel Token, Hardware Fingerprint, or Zscaler Client Connector Version.
6. View the details for a machine tunnel. You can view and copy the token for each machine.
7. Export the machine tunnel details as a CSV file for all items listed in the table, as determined by the filters.