To deploy Zscaler Client Connector using the Jamf Pro Portal, you must obtain a .pkg file from the Zscaler Client Connector Portal.

To download the Zscaler Client Connector .pkg file:

1. In the Zscaler Client Connector Portal, go to Administration.
2. In the left-side navigation, go to Client Connector App Store.
3. On the New Releases tab, select macOS.
4. Download the .pkg file.

To deploy Zscaler Client Connector on your macOS devices from the Jamf Pro Portal:

1. In the Jamf Pro Portal, go to Settings > Computer Management > Packages​​​​​​.
2. Under the General section, click Choose File to upload the .pkg file.

See image.

Close

3. Click Save.
4. In the left-side navigation, go to Computers > Policies.
5. In the Policies window, click New.

See image.

Close

6. In the General section, choose the Trigger events and Execution frequency as needed in your environment.

See image.

Close

7. Click Save.
8. In the left-side navigation, select Packages, and click Configure.

See image.

Close

9. Click Add, and choose the .pkg file uploaded previously.
10. Click Save.
11. In the Scope tab, assign the .pkg to the applicable devices.

See image.

Close

12. Click Save.

To reinstall the same version of Zscaler Client Connector for a specific device or user, go to the computer's history and select Flush All for all the Policy Logs. Alternatively, you can delete the device or user from Jamf Pro and reinstall via the client.

You can use a property list file to set tunnel parameters, allowing DNS caching to be cleared from users’ devices. To configure tunnel parameters in the Jamf Pro Portal:

1. In the Jamf Pro Portal, go to Computers > Configuration Profiles.
2. Click Application & Custom Settings to expand the section and select Upload.

See image.

Close

3. In the Upload section:
   • Preference Domain: Enter com.zscaler.tunnelparams
   • Property List: Download ZscalerSampleConfig.plist
     • clearDnsCacheOnT2Start: If enabled, on Tunnel restart, DNS caches are cleared from the device. Enter 1 to enable, or 0 to disable.

If you are already logged into Zscaler Client Connector, exit and relaunch the app or click Restart Service in the More window of the app.

4. Click Upload to upload the Plist file.
5. Click Save.

You can use a property list file to set values for various configuration keys in the Jamf Pro Portal. To configure a custom settings profile in the Jamf Pro Portal:

1. In the Jamf Pro Portal, go to Computers > Configuration Profiles.
2. Click Application & Custom Settings to expand the section.
3. Select Upload.

See image.

Close

4. In the Upload section:
   • Preference Domain: Enter com.zscaler.installparams.
   • Property List: Upload the ZscalerSamplePlist file.

See image.

Close

5. Use the ZscalerSample.plist file as a starting template, and remove the keys you don't require before uploading the file to the MDM.
   • cloudName: The name of the cloud on which your organization is provisioned. For example, if your cloud name is zscalertwo.net, you would enter zscalertwo. To learn more, see What is my cloud name for ZIA?
   • deviceToken: The appropriate device token from the Zscaler Client Connector Portal, if you want to use the Zscaler Client Connector Portal as an IdP.
   • hideAppUIOnLaunch: Forces the app window to stay hidden before users enroll. Users can always open the window by clicking the app icon in the system tray.
   • launchTray: By default, Zscaler Client Connector starts its services and user interface after installation. launchTray prevents Zscaler Client Connector from automatically starting after installation. Users must open Zscaler Client Connector manually to start the app, or Zscaler Client Connector automatically runs after the next reboot.
   • policyToken: Allows you to specify which app profile policy you want to enforce for the app before the user enrolls. All relevant settings associated with the policy apply, including the bypass of the IdP login page. After the user enrolls, this policy is replaced with the app profile policy that matches the user based on group affiliation.
   • strictEnforcement: Allows you to block internet traffic before the user enrolls in Zscaler Client Connector. strictEnforcement works when the forwarding profile action for Zscaler Client Connector is Tunnel or Tunnel with Local Proxy.
   • userDomain: Allows you to configure the user domain so that the users skip the Zscaler Client Connector enrollment page and directly go to the SSO login page.
   • externalRedirect: Allows you to redirect authentication to your organization's SAML IdP through the Safari browser. When redirected to the browser for the first time, the users must select Remember Me on their IdP login screen. For any subsequent authentications, the browser remembers the user and automatically logs them in.
6. In the Scope section, set Targets, Limitations, and Exclusions to bind the configuration profile to particular devices and users.

You can use a mobileconfig file to enter the bundle identifier for the applications you want to bypass. To configure a custom settings profile in the Jamf Pro Portal:

1. In the Jamf Pro Portal, go to Computers > Configuration Profiles.
2. Select Upload.
3. Upload the mobile config file.

4. Use the ZscalerSampleMobileConfig file as a starting template, and edit the values in the <VendorConfig> section of the file based on your needs.

   For BypassAppProcesses, enter the bundle identifier for the applications you want to bypass.

   If your identifier has both a Team ID and a Bundle ID in it, enter them in the format <Team ID>.<Bundle ID>. For example:

   <string>UBF8T346G9.com.microsoft.teams</string>

   Where:

   • UBF8T346G9 is the Team ID
   • com.microsoft.teams is the Bundle ID
5. In the Scope section, set Targets, Limitations, and Exclusions to bind the configuration profile to particular devices and users.

Zscaler Endpoint Data Loss Prevention (DLP) requires full disk access for proper operation. Choose either of the following two options to create a DLP profile with Jamf Pro Portal to allow full disk access.

You can configure managed login items to prevent users from disabling Zscaler Client Connector on their own devices. To configure managed login items in the Jamf Pro Portal:

1. In the Jamf Pro Portal, go to Computers > Configuration Profiles.
2. Select Managed Login Items.

3. Click Add for each of the following Rule Types and Rule Values:

com.zscaler.tray

com.zscaler

com.zscaler

com.zscaler.tray

PCBCQZJ7S7

• Bundle Identifier Prefix: A part of the bundle identifier reflecting the developer or organization.
• Label: A descriptive name for an app or an element in the app's UI or settings.
• Label Prefix: Used to group or categorize labels.
• Team Identifier: A unique identifier for the developer team or organization within the Apple ecosystem. Applies to all of the configured rules.
• Rule comment (optional): Enter a comment for the rule.

4. Click Save.

5. In the Scope section set Targets, Limitations, and Exclusions to bind the configuration profile to particular devices and users.